For example, if someone were to call a cell phone provider like T-Mobile, pretending to be another person to get some information, how can T-Mobile verify if it is the actual person? I'm assuming that if someone is planning an attack, and are using social engineering then they do not know the username/password of the victim. So when the customer service representative asks for a password or pin, the attacker doesn't know it.
3 Answers
There are "script books" for this, either used in operator training or even kept on the operator's desk when they answer. They detail what you can say, what you must provide, and what the operator can do in any conceivable circumstance.
In this case the T-Mobile operator would ask for some kind of proof among those listed in their script book. The attacker either can supply it or he can't. I have seen such a script book for one of my country's providers, and if you asked, say, for a PIN reset or a new SIM, you'd be either directed to a point of sale where they would ask your ID, or requested to send them through fax or email.
As a routine precaution, at semi-regular intervals (I am not aware of this being done by telecom providers, but I saw it done in more sensitive customer care contexts) a fake customer would call with a two-handkerchief sob story, doing his/her damnedest to convince the operator to help him/her. If he/she succeeded, the next day the operator would have been called by management for an uncomfortable discussion on security rules.
This had two purposes: to be sure that the operators were proof against at least some attacks; and to harden them against said attacks, because even if they did not suspect it was a social engineering attack, they would still suspect it was the management testing them.
Personal story: I was in the habit, waaay back in the days, of sending employees emails with executable attachments that sounded a bullhorn WAV, displayed "SUCKER!" on screen, and sent me back confirmation of a "hit". One day, I overheard unseen a colleague asking, "I've just received an attachment called QJWFWKEK.EXE, what do I do?" - and while thinking "Oh no, he got a real one - and what a moron to ask what to do!", I heard his mate cry, "For Pete's sake do not click on it! Delete it immediately! It's surely one of those fucking traps Serni keeps sending us!"
Well, it's all about the challenge questions as LSemi has mentioned for script books, run books, etc. You could also have challenge tokens via multi factor authentication that operators can send. If you're looking for formalized training against security social engineering attacks and possibly some fraud use cases, SANS has a security awareness training program. And being SANS, it's not free.
There are ways to identify if someone is the one he/she claims to be without using pins and passwords. Companies like that have some users credentials like national id number, tax number, social security no. etc. Unique numbers that people usually keep "safe". Then, company employees need to stick to the playbook and follow all the identification steps the company enforces. Most social engineering attacs through succeed because of that. People are trying to be helpful causing as less trouble as possible to the customers and some times that leads to a successful attack.
answered Aug 1, 2017 at 9:19
