Language Selection

English French German Italian Portuguese Spanish

What's your number, Kevin Mitnick?

Filed under
Security

Doing this, he said, would allow employees to verify a caller was who they said they were by calling them back at the provided number. In the case of someone looking to snaffle company details over the phone, it would scare them off immediately. If the caller was legitimate, they would be happy to comply with the request.

"If people would just call people back," Mitnick told attendees at a forum hosted by vendor Citrix this morning in Sydney, "it would eliminate 80 percent of the threat".

Mitnick described how the Motorola employee who delivered him secret company source code back in his hacking days gave him a nervous moment when the call was almost lost as she put him on hold to check some details with her security manager. Ultimately, however, that attempt succeeded.

While most people naturally wanted to help others who contacted them, he said, employees needed to be taught to deny requests that could compromise security.

The reformed hacker -- currently a security consultant -- pointed out those attempting to breach company security relied upon the intelligence-gathering they did in the lead-up to an attack. One fantastic target for such information, he said, was the company's IT helpdesk.

"They're there to help," he enthused, pointing out fraudsters calling a help desk number would be able to find out what verification tokens -- such as date of birth or employee ID number -- help desk staff used to verify a caller's identity. They could then go away, do some research and come back armed and ready to breach a user's account.

While Mitnick's social engineering tips are ultimately timeless and technology-neutral, the ex-hacker is obviously keeping up with today's tech gadgets.

He pointed out one of Apple's AirPort devices (a popular wireless hub) could instantly create a wireless access port into any company's headquarters if plugged into a company network port.

"You could just put a company logo on it, with a label saying 'IT Department, do not remove'," he said. "You could be browsing the network from the parking lot."

A USB bluetooth device would fulfil the same function if plugged into the back of an employee's PC, he said.

By Renai LeMay
ZDNet Australia

More in Tux Machines

PuppEX Linux Live CD Now Based on Puppy Xenial, Compatible with Ubuntu 16.04 LTS

Arne Exton informs us about the availability of a new stable build of its Puppy-derived PuppEX Linux Live CD distribution, version 160822, which is now using the latest kernel and software applications. Read more

KDevelop 5.0 Open-Source IDE Officially Released with New C/C++ Language Support

After being in development for the past two years, the open-source KDevelop IDE (Integrated Development Environment) software has finally reached the 5.0 milestone. Read more

Open source drone controller has an FPGA-enhanced brain

Aerotenna has launched an open source, $499 “OcPoc” drone flight controller that runs Linux on an Altera Cyclone V ARM/FPGA SoC. Lawrence, Kansas based Aerotenna, which bills itself as “the leading provider of innovative microwave sensors and flight control systems,” describes OcPoC (Octagonal Pilot on Chip) as a ready-to-fly, open source flight control platform. The system integrates an IMU, barometer, GPS, and a CSI-camera interface. Read more

Linux Kernel 3.16.37 LTS Is a Massive Update with Tons of Networking Changes

Immediately after announcing the release of Linux kernel 3.2.82 LTS, maintainer Ben Hutchings proudly informed the community about the availability of the thirty-seventh maintenance update to the Linux 3.16 LTS kernel series. Read more