Hackers' Low-Tech Tool: A Phone Call

MELISSA BLOCK, host: For a company, security can mean a lot of things. Computers are part of it - firewalls to protect data or personal information. But just as dangerous as a computer hacker can be someone on a phone. Here's Zoe Chace of NPR's Planet Money.

ZOE CHACE: To learn how to hack a corporation, I figured I had to go to DefCon. DefCon is a conference for computer hackers. It's $150 in cash to get in. Don't use the Wi-Fi and don't use the ATMs because you might get hacked or your card number will be stolen.

It's where the weirdos（怪人）come to be as weird as possible and be rewarded for it, like this guy's beard is as purple as the day is long.

UNIDENTIFIED MAN #1: I competed in a beard contest and I took second place next to some guy with some really gnarly（粗糙的） wolverine chops and my hats are off to him.

CHACE: This other dude rolls up a short while later, wheelchair, leg in a cast.

UNIDENTIFIED MAN #2: That's why those signs say no diving.

UNIDENTIFIED MAN #3: What do you mean?

UNIDENTIFIED MAN #2: No diving. They also mean no cannonballs（炮弹）.

CHACE: The broken leg is new. It's from cannonballing into the pool last night.

This conference for the best computer hackers in the free world is held every year in Las Vegas and there are many computer hacking competitions held at this conference, most of which would be way over your heard, but not this one.

MARK: We can use his phone number to call someone else and impersonate him to get information.

CHACE: One of the most popular competitions at DefCon is called social engineering. Social engineering means, essentially, you seduce an actual person into giving you sensitive information over the phone.

Mark is preparing to call Wal-Mart. He didn't want me to use his last name in this story because what he's doing is possibly illegal.

MARK: Earlier, we were actually looking at a Wal-Mart intern and we were just looking at, you know, everything he's done, what college he went to. His parents' blog, actually, was able to give us a good amount of information.

CHACE: Mark is getting psyched up to sit in a glass phone booth(【美】公用电话亭)in front of dozens of people and call Wal-Mart. Their conversation is broadcast over a PA system. Here is Mark's side of the conversation. He's using a fake name.

MARK: Hello. This is Matthew Hughes from Corporate IT.

CHACE: As soon as Wal-Mart picks up, I have to shut off my recorder since they don't know they're being recorded. I check in with the contest host, Chris Hadnagy, about how Mark's doing.

CHRIS HADNAGY: Not getting nervous about things. When he wasn't messing up and getting nervous when he's on hold.

CHACE: Each contestant has 25 minutes in the glass phone booth. They have a checklist of stuff they have to get out of the company. What time their packages are delivered, what's their antivirus software, do they have the latest version of their operating system.

And Mark actually gets a few, even though it's his very first time. He's baby-faced already, being that he's only 18 and, right now, he's actually flushed with pride.

CHACE: And then he's not out of the booth for more than two seconds when he gets a job offer.

UNIDENTIFIED MAN #4: What do you normally do when you're not (unintelligible)?

CHACE: They asked me not to record this conversation, but I can tell you a security company offers him a job on the spot.

The unsuspecting companies that got hacked get rated on a scale of how vulnerable they are in a report that will come out in a few months.

I called Wal-Mart to see what they thought. They declined to comment.

It's funny. Even if companies try to upgrade their security systems, they're also spending money making their customer service better, more friendly and helpful. It's precisely that helpfulness that might get them hacked later.

In many of the high profile hacks of late, Sony, the security company HBGary, had a social engineering component. Hackers got what they needed to steal a bunch of data through a phone call. Zoe Chace, NPR News.

ROBERT SIEGEL, host: This is ALL THINGS CONSIDERED from NPR News.
 

声明：音视频均来自互联网链接，仅供学习使用。本网站自身不存储、控制、修改被链接的内容。"沪江英语"高度重视知识产权保护。当如发现本网站发布的信息包含有侵犯其著作权的链接内容时，请联系我们，我们将依法采取措施移除相关内容或屏蔽相关链接。