Chapter 1 Dumpster Diving
Hackers pilfer secret data in lots of different ways, but did you they can suck sensitive data right off a corporate network without even touching the network? You might think Iâm talking about wireless technology, which doesnât require any âtouchingâ at all, but Iâm not. Be a good sport and donât read the two âDâ words written in big bold letters at the top of this page, and act surprised when I tell you hackers can accomplish this without relying on a single bit of technology (punny). Or, donât play along, and pretend not to be surprised. In fact, maybe itâs better you go on thinking your personal or corporate secrets arenât sitting exposed in a dumpster somewhere, waiting for a no-tech hacker to snatch them up. In that case you better just skip this chapter.
Introduction to Dumpster Diving
Dumpster diving involves ⊠diving into dumpsters in search of valuable information. I know, itâs bad form to use the phrase in the definition of the phrase, but thatâs what dumpster diving is, or what it used to be. These days, diving is optional. As this next photo shows, I find interesting stuff just hanging out in the open, waiting to be grabbed.
I find valuable trash in plain view all the time, like the insurance bill shown in the next photo, which is visible through the clear trash liner.
The next photo shows a pile of discarded documents belonging to a network administrator. I used my strong power of intuition to determine that these belonged to an administrator.
Judging from the next photo, âFredâ is obviously unhappy with his jobâheâs hard at work surfing careerbuilder.com in search of a new position. This printout reveals an awful lot about Fred. What else can you tell me about him based on this single document?
For starters, itâs very probable that Fredâs got a four-year degree of some kind, otherwise he wouldnât have printed out a job description that required that much schooling. Itâs a good bet that he makes a good deal less than $80,000 a year, judging from the positionâs salary, that heâs looking for a full-time gig, and that heâs probably working in the Defense Aerospace industry. Stuff like this makes me want to write Foreign Intelligence Service Recruiting for Dummies. Forget all the hard work of finding a markâs name, email address, employer, educational background, department of defense affiliation and career aspirations. All it takes is a brainless dumpster sweep to find juicy recruiting targets.
Personal info is one thing, but I find sensitive corporate information all the time as well. The next photo shows a purchase order, detailing a companyâs several thousand-dollar purchase.
Although the form is quite dated, it lists a great deal of information including the clientâs name, address and phone number, a description of the service (which is technical in nature and reveals information about the inner workings of the client), and authorized management signatures (which may be of use to a forger if the manager is still employed with the service company).
A purchase order isnât really a big deal, but I think the next document might be. Itâs marked âDo Not Disseminate.â
Disseminate is such a big word that I think people might not understand what it means. This causes obvious problems when it comes time to discard (or should I say throw away) the document. Confusing phrases abound though, like proprietary information. I found it written on the next document which was lying on the ground outside a dumpster.
A clearer phrase to use might be âFor Internal Use Only.â But even this phrase is obviously somewhat confusing, because I found it written on this now-famous dumpster dangling document.
I guess I miss the point of warning phrases like these. Inigo Montoya had it right in The Princess Bride when he said âYou keep using that [phrase]. I do not think it means what you think it means.â I vote for banning confusing phrases like Proprietary Information and Do not disseminate. I vote for splashing every document with a clearer tagline like âPut In Parking Lot For Everyone To Read.â At least then thereâs no confusion about what people are supposed to do when it comes time to throw the thing away.
And just in case you think itâs an awful lot of effort to walk past a dumpster and grab stuff thatâs hanging out of it, Iâve got good news. Sometimes if youâre really lucky, all you have to do is stand in a parking lot on a windy day and wait for sensitive stuff to blow right into your face. Thatâs exactly what happened to my buddy Mike at work one day. He grabbed the offending document and after discovering it didnât belong to his employer, he shared it with me. Now Iâm sharing it with you.
This bunch of scribble might not look like much to the untrained eye, but any techie will tell you that this map outlines everything needed to take control of a computer network. The (blurred) IP addresses is a real live address, and the username (admin) and password (blurred, beginning with the letters âGâ and âaâ) provide everything needed to log into the machine as an administrator. Another password (blurred, beginning with âR0ck3tâ) written at the top of the page provides access to another private IP address (blurred, ending with â0.57â), and perhaps to other machines on the private network. The routing and subnet map along with terms like packet filter and strict routing reveal that the scribbler is technically adept, while terms like AES128, MD5 and ipsec indicate that he or she is at least somewhat security-conscious, but the simple fact remains that this document was tossed aside (along with other documents Mike didnât bother to pluck out of the air) as if it were not important.
A high-tech attacker could spend hours, days, or weeks poking at the external box in an attempt to bypass AES-128 encryption and IPSEC to gain access to the private network behind it. Even then, he or she would struggle to bypass the security of the internal machines, to gain access to the ârocketâ box. On the other hand, a no-tech hacker can bypass the security of the entire network in moments, just by peeling a document off his face and hanging on to it.
Fortunately, this kind of parking lot fodder is pretty rare. Admittedly, Iâve only seen a handful of cases that were this blatant. Most of the time I have to really push the limits and actually stick my head into the dumpster and peer inside. I discovered the next document in a dumpster on top of an open box of similar papers. The doc lists client names, account information, and a handy list of sales reps, the commissions they made and their Social Security numbers. A rival company might be interested in these documents, but an identity thief would have a field day with them.
When I found the dumpster shown in the next photo, I was disappointed because it had obviously just been emptied. The scattering of white envelopes left behind seemed innocuous enough, until I read the words healthcare information in bold red lettering. The rough, ripped edge of the envelope shown in the next photo seemed to suggest that some dummy had gotten the invoice in the mail, opened it, stuffed it back in the envelope and threw it out for a creepy (talented) no-tech hacker like me. If this were my invoice, I would have shredded it, then used the scraps to line my catâs litter boxâwhich seems to deter even the most dedicated of dumpster divers.
But the white envelope was not alone in this dumpster. I spotted a few more envelopes, each bearing the same scarlet lettering, and realized that each of the other envelopes (like the one sho...