Social Engineering

    I’ll never forget receiving the email that I was needed as a “cybercriminal” for class that day. I was filled with a mix of excitement and dread at the thought of having to con one of my classmates. However, after learning about scams over the past couple of weeks, I was thrilled to be able to put my skills to the test. When I walked into class to receive my task, I immediately got to work, devising a plan to find out one of my group members’ mother’s maiden name. I thought this would be a breeze; unfortunately, I was mistaken. Although I had already spent an hour before class coming up with fun ways I could collect information from my peers, I found myself at a roadblock when it was time to actually carry out the task at hand. 

My first tactic was to try to use the assignment to elicit the information. We were creating our own scams, and my group decided to make fake parking tickets. Hypothetically, we would print fake parking tickets that looked identical to the authentic ones. We would use a fake QR code that would take the victims to a fake website where they could pay their parking tickets. However, the money would actually be going straight to us. I first tried to present a fake login situation to my group that would require a security question. The question would be, “What’s your mother’s maiden name?” I thought this would work, but I couldn’t figure out how to get my group members to answer the question without asking directly. 

I shifted gears and tried to move the conversation from the assignment toward topics closer to the information I was trying to gather. I figured Ashley would be the easiest target since we are partners for this class. I started asking her about her last name, Zindler. I came up with a fake fear of marrying someone further back in the alphabet than me. It’s not entirely fake, as I have thought about this dilemma before. Having the last name Crowder, I’m always at the front. I then asked if her mom ran into this problem when she married her dad and took on the last name Zindler. That was when I got my answer. 

My takeaway from this exercise was that it was surprisingly easy to get the information I was looking for once I found the right way to phrase my questions. At first, I thought social engineering would require an elaborate scheme, but I learned that a casual conversation can be just as effective. By integrating the question into our normal conversation, Ashley had no way of knowing I was trying to elicit this one piece of information. In social engineering, the naturalness of the interaction takes precedence over the scheme's complexity.