So, my networking teacher was discussing some various caveats of cyber security, and one threat he mentioned was social engineering. He decided to give a real-world example - two students from his Cyber Security class (which I'm taking next semester). The two of them followed this little scheme, and managed to get ahold of a passcode to what was supposed to be a locked lab with restricted access. Oops!

Note: this does not advocate the abuse of these weaknesses in a college bureaucracy. Do not do this. It's bad for you. God kills a kitten for every time you do this.

Call your campus IT services. Ask for a list of computer lab monitors in the building. Pick a monitor and create a Hotmail account using the name of the person as a username. Contact the secretary for engineering using this e-mail address, saying that you lost the password. Bing-o, you got the passcode to the door.

Whoopsies! I expect this little security hole will be fixed shortly.

I'll be logging in as Wolfy Shortly.

Human error is to blame here.

This is exactly why Social Engineering is the #1 security risk at "secure" facilities.

Yes social engineering. Great stuff.

I still remember all my sneaky methods of hacking at work and at school

Wow, that's stupid. They should be sending passwords only to the user's university e-mail account and none other.

GOD DOESNT KILL KITTENS!!!11


ahem... *wanders off*

Yes, social engineering at its finest. Kevin Mitnick would be proud.

That is stupid, and wouldnt work at any place with any sense in secuirty. I know it wouldnt work here, cause I work at the helpdesk, and it wouldnt work at my other place of work.

I was in one of the electronics labs a couple of weeks ago, and my lab partner accidentally entered the wrong command into the bash console - thereby bringing up a list of the door codes for the labs. Needless to say, we both wrote them down, but haven't had a chance to use them as of yet.

I'd say this one is just a case of bad programming.

the art of deception by kevin d mitnick... read it, wonderful book. has some really good story type examples.

You use Unix at school?

A bit, yeah. This was actually just a Unix terminal.

I was going to mention this book. I read it, and it was awesome

I'm going to go find that book now.

That's all I use at school. Some PCs run XP, but most of my work is done via SSH on the school's CS servers which run SunOS (blah, Solaris, same thing). There's also SunRay thin clients in both the public labs and the CS labs.

As to the topic, I'd be shocked if this actually worked at my school. They're pretty good with security.

i just use the key thay gave me :em321:




i work in the computer labs

I will also advocate The Art Of Deception. Someone once said (too lazy to look it up, hell the quote may not be verbatim) "Security is a proceeder not a product."

heh, my school just has you scan your ID to open the door (they don't really track what rooms you open with your ID, though...) and then you're supposed to sign in. all the lab monitors do is ask you to sign in or *try* to fix Word for people heh

our computer labs are boring places. i only go there to print stuff.