In the past days I have watched a lot of 30C3 talks that I missed to attend in person. Getting a brain update of what is really going on in this world is what I enjoy. A well deserved break from politicians’ lies and mass media. One of the talks I came across was about social engineering. And just today yet another idiot in the world showed me that some people have become stupid enough to hack themselves. This is what I call reverse social engineering.
Corporate human hacking
I used to study psychology as a secondary subject at university and am thus also interested in “hacking people” as the speaker called it. I don’t intend to spoof anyone but I wanted to be aware of the daily tricks that others may use to hack me. After all social engineering is a serious threat in today’s IT-driven world. Why spend thousands of bucks on high-tech hardware to get to other people’s data when exploiting their fundamental psychological bugs placed there by evolution is much easier. If you are remotely familiar with the matter you probably know that social engineering works very well. A while ago I have been working at a corporation that once paid hackers for spoofing the employees and trying to get to classified information. They were supposed to find out how resilient the employees were against such attacks. They wrote a dialer to scan the network for hidden maintenance accesses and also recorded when a human picked up the phone. It worked well. I don’t know how much the hackers actually learned but it scared me already how well it worked.
The web of stupidity
Not much later in 2006 I attended an Ubuntu developers’ conference in Spain. Apart from other activities we held a keysigning party to grow the GnuPG web of trust. Not everyone seemed to be familiar with the concept of keysigning and what is needed to make a PGP key trusted. So I already was a bit sceptical how much I can actually trust every one of these people. When I returned home from the conference other participants of the keysigning party sent me my signatures. However I received a few more signatures than I had expected. So I went through my list and it turned out that a few signatures were from people I did not meet there. I wrote them an email asking whey they signed me their signature and was told that they just signed all keys on the list because they missed to tick off the names and signatures of the people they met. WTF?
A few months later there was a local conference that I wanted to attend. I subscribed to the keysigning party to make sure that my name and fingerprint was on the list. Unfortunately I couldn’t make it to the conference and thus did not attend the keysigning party. Guess what – the next day after the party I received a dozen signatures by people who assumed they met me. I told the organizers of the event about it and they sent out an email to the participants explaining why they must not sign key from people they did not meet. WTF?
How many idiots does it take to render the web of trust useless? I could try to put my name on every keysigning party around the world and hope for idiots to send me signatures. But as much as I believe it would work I don’t want to weaken the web. But my trust in the web of trust was harmed irrecoverably. I now only trust the people I have met in person and who I can judge to have understood PGP and who use it properly. Of course I encrypt emails whenever possible because encrypting to someone who is too stupid to use PGP properly is almost always better than sending out emails unencrypted. That’s why I’m a fan of opportunistic encryption that rather tries to encrypt and hope for the best than to send plain text.
GMail facepalming
And then there is Google Mail – a permanent source of fun for me. I do not use GMail as my primary email address and I feel sorry for the people who use it without understanding the implications. But as I have an Android phone I’m forced to have a GMail account to be able to pay for Android apps. And to make sure that I get the payment receipts I just forward the GMail account to my personal address. So it happens pretty frequently that people I have never heard of send me personal emails. Apparently they try to contact someone with the same name as me and just guess the email address. I usually respond politely telling them they got the wrong person.
But some people (like Simone) are annoyingly persistently stupid. Although I have told them that they apparently mistyped the recipient address they keep sending me emails. For years! Simone is brilliantly ignorant. We have had quarrels about our children. She divorced from me. She sends me vouchers for coooking shows. Recently she was stranded in Bristol with no money and begged me to help her. And today she told me that her GMail account was hacked so she educated a large list of people (at least BCC’ed them this time) how to use GMail properly. This is not the usual case of father-in-law-information-technology-ignorance where people are overwhelmed by the internet and its threats. I can imagine Simone to even send paper letters to the same wrong person time and again despite the recipient telling her to STFU. If you couldn’t get a good explanation why scammers are so successful – it’s probably because of such individuals.
Morale
Human stupidity can spoil the best effort of mathematics, cryptography and computer science. Use encryption wherever possible. But rely on it only if you also trust the person – not only the mechanism.