[00:40.530 --> 00:41.610]  Yeah, sound guy.
[00:41.830 --> 00:43.670]  Can we turn Emmanuel's mic up a little bit, please?
[00:43.830 --> 00:44.450]  Like, all the way?
[00:51.650 --> 00:53.910]  It's getting better.
[00:54.210 --> 00:55.150]  Ah, there we go.
[00:58.450 --> 00:58.890]  All me.
[00:59.090 --> 00:59.550]  It was all me.
[01:00.070 --> 01:01.410]  I don't know what else to say, anyway.
[01:03.210 --> 01:03.730]  To me.
[01:07.670 --> 01:09.830]  Have we verified we have a signal going to the other room?
[01:13.310 --> 01:14.290]  The projector's busted.
[01:14.490 --> 01:14.870]  How nice.
[01:16.890 --> 01:18.770]  We could go without those people, I guess.
[01:20.610 --> 01:22.290]  They won't have a bunch of losers.
[01:23.730 --> 01:25.550]  They can't hear me say that, so it doesn't matter.
[01:25.630 --> 01:26.490]  For those of you who are just upset.
[01:26.490 --> 01:27.410]  None of you are going to tell them.
[01:33.880 --> 01:35.180]  I've always been imitating my voice.
[01:35.280 --> 01:35.740]  Stop it now.
[01:38.440 --> 01:40.000]  Yeah, Chester, you can do a really good Emmanuel.
[01:40.280 --> 01:40.360]  Gosh.
[01:46.340 --> 01:56.860]  All right, just so people know, this is a social engineering panel, but we're also kind of co-opting it into a Kevin Mitnick panel, because we're actually able to get him to join us by a phone link.
[02:01.180 --> 02:10.070]  There's a slight problem in that we are trying to get the phone line here, and we have to bribe the hotel people to let us use one of their lines, so we're in the process of doing that.
[02:10.620 --> 02:11.260]  We have a line.
[02:11.420 --> 02:12.570]  Okay, the bribe has gone through.
[02:14.220 --> 02:14.890]  All me.
[02:15.120 --> 02:15.560]  Yes.
[02:16.510 --> 02:22.700]  Okay, first, does anybody have that... a few people showed me a little press release from AT&T.
[02:22.780 --> 02:23.500]  Can we bring that up?
[02:23.700 --> 02:25.070]  This is really kind of cool.
[02:26.200 --> 02:30.570]  It goes to show how the tower of suggestion...
[02:31.260 --> 02:31.700]  What's up, yo?
[02:32.390 --> 02:33.240]  Should I pull up here?
[02:34.640 --> 02:35.660]  Yes, no, yes, no.
[02:36.570 --> 02:37.420]  Go that way.
[02:38.500 --> 02:39.360]  Sorry about your foot.
[02:39.700 --> 02:40.340]  Go through there.
[02:45.200 --> 02:50.100]  Okay, this... a bunch of people got this, this little memo.
[02:50.940 --> 02:52.500]  Be aware of who is calling.
[02:53.020 --> 03:02.920]  AT&T security warns employees this weekend to be especially careful about giving proprietary company information to anyone claiming to be an AT&T employee or customer.
[03:02.920 --> 03:06.640]  as part of a H2K hacker conference.
[03:13.420 --> 03:17.460]  July 14th to 16th in New York City, there is a social engineering contest.
[03:18.140 --> 03:19.160]  Oh, that was painful.
[03:19.280 --> 03:19.520]  Thank you.
[03:19.520 --> 03:26.140]  There was a social engineering contest where hackers tried to use the phone in an attempt to gain proprietary information about a company.
[03:26.420 --> 03:34.100]  If anyone unknown to you calls for such information, request a callback number and check it before returning the call.
[03:34.100 --> 03:39.560]  Verify the person is an AT&T employee or legitimate customer and if he or she has a need to know.
[03:39.820 --> 03:43.960]  If you can't verify employment or the number, don't give out the information.
[03:44.800 --> 03:54.000]  Any incident or apparent attempt to compromise the security of the company's network and or computer systems should be reported immediately to AT&T corporate security.
[03:56.640 --> 04:00.300]  I think AT&T corporate security should be the first target.
[04:05.620 --> 04:07.820]  I'd like to see more information about this myself.
[04:11.040 --> 04:13.820]  So, I guess what we have to do is we have to get...
[04:13.820 --> 04:15.220]  First of all, do we have a link to the other room?
[04:16.940 --> 04:18.220]  Can they hear us?
[04:21.080 --> 04:22.460]  Hang on, can they hear us in the other room?
[04:25.060 --> 04:26.460]  Okay, can they hear us in the other room?
[04:27.180 --> 04:28.740]  Okay, can they hear us in the other room?
[04:28.920 --> 04:30.720]  I guess my mic is going to be obvious.
[04:31.080 --> 04:34.700]  Any of your number starts with an N and N to four digits.
[04:38.080 --> 04:40.880]  Okay, we're not going to go far until they join us with the audio.
[04:41.060 --> 04:41.960]  It shouldn't take very long.
[04:42.080 --> 04:43.680]  It only took us an hour on Friday to figure it out.
[04:45.900 --> 04:47.380]  So, we had it working before.
[04:48.300 --> 04:49.900]  By the way, call me number for perfect.
[04:49.900 --> 04:50.820]  It's Chris the AV guy.
[04:50.900 --> 04:51.880]  Give him a round of applause there.
[04:52.600 --> 04:52.920]  I
[05:08.620 --> 05:09.640]  just asked for an N.C.P.
[05:09.720 --> 05:10.940]  Look, if you need any speakers.
[05:11.580 --> 05:12.700]  Well, we've got this memo.
[05:13.000 --> 05:13.580]  What does this mean?
[05:14.280 --> 05:14.720]  All right.
[05:15.500 --> 05:16.180]  They might not be open.
[05:16.860 --> 05:18.240]  It's just kind of weird when you think of it.
[05:28.600 --> 05:30.520]  So, we still don't have audio to the other room, are we?
[05:31.100 --> 05:32.220]  Uh, we have audio.
[05:32.760 --> 05:33.580]  We have audio.
[05:33.920 --> 05:34.560]  We have audio.
[05:34.940 --> 05:36.300]  Hello, other room.
[05:36.300 --> 05:36.620]  Okay.
[05:36.980 --> 05:39.440]  And I'm missing anything because there's no video except our faces.
[05:39.680 --> 05:40.680]  And, uh...
[05:40.680 --> 05:42.040]  You'll already know what we look like.
[05:42.500 --> 05:45.480]  Unless you're a federal officer, then you don't really know what we look like.
[05:46.320 --> 05:46.680]  Okay.
[05:46.800 --> 05:48.720]  Well, I want to start with zero knowledge.
[05:48.940 --> 05:49.060]  Okay.
[05:49.160 --> 05:50.380]  So, you give us a phone number.
[05:50.460 --> 05:51.340]  We don't even have that yet.
[05:51.500 --> 05:52.600]  So, let's start with nothing.
[05:52.960 --> 05:53.300]  All right.
[05:53.420 --> 05:55.400]  So, let's get, uh, 800 information.
[06:01.290 --> 06:02.850]  Getting, uh, fast busy here.
[06:04.270 --> 06:04.950]  I'm sorry.
[06:05.030 --> 06:05.190]  Yeah.
[06:05.310 --> 06:05.890]  Got it on my own.
[06:10.500 --> 06:12.680]  This is such a crude version here.
[06:13.140 --> 06:13.580]  Okay.
[06:13.640 --> 06:18.480]  I gotta ask people to be quiet because, uh, a thousand people laughing kind of tips them off.
[06:23.070 --> 06:24.770]  Remember when you got an operator right away?
[06:30.460 --> 06:31.400]  Let's go on hold.
[06:33.080 --> 06:35.360]  But we know that our call is important to you.
[06:36.920 --> 06:37.480]  No, no.
[06:38.360 --> 06:40.400]  The cable plug in here was running for the project.
[06:40.580 --> 06:41.380]  Is this loud enough?
[06:41.480 --> 06:42.100]  Can you guys hear this?
[06:42.620 --> 06:43.340]  This is loud enough.
[06:43.340 --> 06:44.100]  Let's bring up the phone.
[06:47.160 --> 06:47.560]  Now.
[06:48.260 --> 06:49.580]  We have video and Skype now?
[06:56.100 --> 06:58.260]  Directorate, please continue to hold.
[07:06.570 --> 07:07.710]  It's not that kind of feedback.
[07:08.190 --> 07:08.530]  This is loud.
[07:09.010 --> 07:09.650]  That's feedback.
[07:12.230 --> 07:13.050]  Tell me about it.
[07:14.050 --> 07:19.090]  See, years ago, when they had people working for them, you would call and you'd get a person and they'd give you the number.
[07:19.190 --> 07:23.450]  Now you gotta hold and wait for the one operator that can push the button to play the computer message.
[07:26.390 --> 07:27.970]  Someone will be with you soon.
[07:31.030 --> 07:34.090]  Maybe, maybe this is some of the information they're not supposed to give us this weekend.
[07:40.130 --> 07:41.450]  Thank you for your patience.
[07:41.750 --> 07:44.150]  Your call will be answered as quickly as possible.
[07:44.650 --> 07:45.150]  Uh-huh.
[07:46.210 --> 07:48.350]  Which, in AT&T's world, is not very great.
[07:49.450 --> 07:51.170]  Didn't have time for two games of solitary.
[07:51.250 --> 07:53.190]  Let's introduce ourselves while we're waiting for this.
[07:53.610 --> 07:54.290]  Cheshire Catalyst.
[07:54.390 --> 07:55.370]  I'm the Cheshire Catalyst.
[07:55.370 --> 07:58.790]  And, uh, my client's in favor is we need to sign an area code.
[07:59.810 --> 08:01.270]  I live in Central Florida.
[08:01.510 --> 08:10.090]  When I split up 4-0-7, I went through the list of available numbers and decided that the Countdown Capital of the World should have area code 3-2-1.
[08:10.750 --> 08:12.150]  And the Public Service Commission will...
[08:12.150 --> 08:12.270]  Hello?
[08:19.620 --> 08:21.160]  The word, the word, the Public Service Commission.
[08:21.680 --> 08:22.160]  All right.
[08:22.680 --> 08:23.300]  Don't hit that.
[08:23.720 --> 08:24.060]  All right.
[08:24.160 --> 08:27.120]  The word, the Public Service Commission throw a fear into any telephone operator.
[08:27.400 --> 08:27.600]  All right.
[08:28.500 --> 08:29.780]  So, am I going to...
[08:38.850 --> 08:40.750]  Maybe we'll, we'll luck out this, but...
[08:42.150 --> 08:44.050]  Actually, when I'm on the phone, you can turn my mic down.
[08:44.210 --> 08:45.050]  That way there won't be feedback.
[08:46.770 --> 08:47.130]  Okay?
[08:49.810 --> 08:50.410]  Good safety.
[08:50.550 --> 08:51.070]  Is the phone up?
[08:51.250 --> 08:52.050]  Okay, I just missed.
[08:52.050 --> 08:52.370]  No.
[08:55.370 --> 08:55.570]  No.
[08:55.910 --> 08:56.670]  You already said that?
[08:56.850 --> 08:57.050]  Yeah.
[08:57.470 --> 08:59.950]  Please try again later, like they can't even take our call at all.
[09:00.350 --> 09:00.750]  Yeah.
[09:00.750 --> 09:01.090]  All right.
[09:02.330 --> 09:03.170]  We're hanging up.
[09:03.270 --> 09:04.150]  The other thing...
[09:04.990 --> 09:07.990]  Let's signal the people before we hang up so we don't want to speak.
[09:19.200 --> 09:19.540]  Okay.
[09:19.540 --> 09:20.400]  I'm going to pick up.
[09:20.720 --> 09:21.700]  Okay, we'll go up.
[09:21.880 --> 09:23.480]  We're going to hang up and then we'll press it.
[09:24.940 --> 09:25.340]  Now.
[09:27.340 --> 09:29.440]  I'm going to put it right on the header.
[09:30.120 --> 09:30.520]  Hi.
[09:30.700 --> 09:31.120]  What's up?
[09:43.420 --> 09:44.580]  We need phone.
[10:00.380 --> 10:03.160]  We are unable to plan for your call at this time.
[10:03.540 --> 10:05.940]  Okay, why don't we just go with the number we know before the headquarters?
[10:06.880 --> 10:07.800]  We're going to hang up.
[10:10.980 --> 10:11.860]  We're going to pick up.
[10:13.040 --> 10:14.940]  As you can see, it's getting harder to get information.
[10:14.940 --> 10:19.080]  They're getting better, but the problem is that they're cutting off all information to everybody.
[10:19.300 --> 10:19.640]  I know.
[10:19.980 --> 10:21.740]  This is no way of putting all the information from us.
[10:21.860 --> 10:22.060]  Yeah.
[10:22.060 --> 10:22.840]  2-2-1.
[10:23.760 --> 10:24.760]  2-thousand.
[10:26.780 --> 10:29.620]  H&T corporate headquarters in Basking Ridge, New Jersey.
[10:29.900 --> 10:30.020]  Okay.
[10:33.820 --> 10:34.540]  Phone up.
[10:36.240 --> 10:36.960]  Phone up.
[10:39.430 --> 10:40.570]  Uh, yes, hi.
[10:40.690 --> 10:44.390]  I'm calling about a memo I received, concerning, um...
[10:45.950 --> 10:47.790]  Uh, something called social engineering.
[10:48.130 --> 10:48.850]  Do you know anything about this?
[10:56.690 --> 10:58.470]  Uh, on 34th Street.
[10:58.930 --> 10:59.990]  And, uh...
[10:59.990 --> 11:00.390]  I'm sorry.
[11:00.650 --> 11:02.390]  I'm having trouble hearing it's a bad connection.
[11:04.690 --> 11:05.130]  This...
[11:05.130 --> 11:06.930]  This one out last, uh, Thursday, I believe?
[11:07.250 --> 11:08.330]  Corporate security center.
[11:08.470 --> 11:10.310]  Uh, it came off corporate security.
[11:11.670 --> 11:12.110]  Yeah.
[11:12.590 --> 11:12.970]  Okay.
[11:15.850 --> 11:16.310]  What's that?
[11:16.350 --> 11:16.790]  1-800.
[11:16.790 --> 11:17.630]  1-800.
[11:21.570 --> 11:22.290]  822-90000.
[11:22.930 --> 11:23.850]  Would they be in no?
[11:24.570 --> 11:25.590]  I don't know, sir.
[11:25.990 --> 11:26.950]  Okay, I'll give it a try.
[11:27.050 --> 11:27.670]  Thanks for your help.
[11:33.950 --> 11:37.070]  We got the number they weren't trying to give us, uh, information.
[11:37.530 --> 11:39.390]  So now we have the appropriate security number.
[11:40.350 --> 11:41.930]  Hackers 1, AT&T 0.
[11:43.390 --> 11:46.430]  We're talking for Hackers 1, AT&T 0.
[11:46.610 --> 11:48.430]  A little, okay, let's try to feed this man together.
[11:48.590 --> 11:49.770]  A little on the face of who I should feed.
[11:49.770 --> 11:52.350]  I mean, why am I calling these people asking me?
[11:53.050 --> 11:54.610]  I mean, there's really a good possible excuse.
[11:55.130 --> 11:56.470]  You've been asking, got a call!
[11:56.550 --> 11:57.130]  You've got a call!
[11:57.190 --> 12:00.090]  I've been receiving, uh, calls from a lot of them.
[12:00.190 --> 12:03.810]  Several calls were asking for, uh, providers that they have to...
[12:03.810 --> 12:04.330]  Who am I?
[12:07.550 --> 12:09.190]  We're in marketing, on a Sunday.
[12:09.950 --> 12:10.170]  Yeah.
[12:10.630 --> 12:12.630]  Well, first off, you need a location.
[12:12.970 --> 12:13.230]  Uh-huh.
[12:13.530 --> 12:16.210]  So, 32 Avenue of the Americas is here in Manhattan.
[12:16.770 --> 12:16.910]  Okay.
[12:17.030 --> 12:18.730]  And here's AT&T headquarters building.
[12:19.010 --> 12:19.110]  Okay.
[12:19.110 --> 12:20.230]  So, we're at...
[12:20.230 --> 12:21.470]  And we know that...
[12:21.470 --> 12:23.430]  That address will bring us out with them.
[12:24.250 --> 12:25.530]  So, we're at 32 Avenue of the Americas.
[12:25.650 --> 12:27.630]  Is there a particular information we want to get from them?
[12:30.980 --> 12:31.660]  I don't know.
[12:31.740 --> 12:32.700]  They've got a big buzz full.
[12:33.080 --> 12:35.160]  Oh, yeah, instructions on what you're supposed to do when the hackers call.
[12:35.160 --> 12:36.020]  Step in.
[12:36.940 --> 12:38.980]  Road number on the head of the security.
[12:49.780 --> 12:51.000]  It's on the website there.
[12:52.400 --> 12:52.920]  Right.
[12:53.060 --> 12:53.300]  Hey, it's...
[12:53.300 --> 12:53.940]  It's dialing.
[12:54.480 --> 12:55.560]  Hey, this is Drew Pepper here.
[12:57.420 --> 12:58.280]  I have video.
[13:04.970 --> 13:06.610]  Did everybody else write that number down?
[13:07.070 --> 13:07.370]  Yeah.
[13:22.430 --> 13:24.770]  AT&T Corporate Security, this is Jim.
[13:24.930 --> 13:25.350]  I'm helping you.
[13:25.350 --> 13:25.990]  Yeah, hi.
[13:25.990 --> 13:27.250]  This is Mr. Goldstein.
[13:27.450 --> 13:30.130]  I'm over in sales on Avenue of the Americas.
[13:30.930 --> 13:35.010]  I've gotten a memo about something that might be going on this weekend.
[13:35.130 --> 13:36.470]  I was wondering if you could give me more information.
[13:36.950 --> 13:37.430]  Okay.
[13:38.090 --> 13:45.330]  Concerning something having to do with information being obtained by people that weren't supposed to obtain it or something like that.
[13:46.390 --> 13:47.190]  There's a very sketch.
[13:47.330 --> 13:48.150]  I heard a third hand.
[13:48.370 --> 13:51.410]  But there's something that we should be able to be more careful this weekend.
[13:51.670 --> 13:53.150]  Do you have any information on that?
[13:53.590 --> 13:54.070]  Yeah.
[13:54.450 --> 13:58.250]  You should definitely be careful about, you know, giving any information.
[13:58.630 --> 14:06.830]  I mean, it's always a good idea to be especially careful of, you know, giving out information if somebody's calling in.
[14:08.330 --> 14:14.970]  And this weekend what's going on is some sort of a conference for hackers.
[14:14.970 --> 14:20.130]  And they're calling in and doing a lot of live demonstrations.
[14:21.730 --> 14:25.630]  And so they'll call in to different businesses and obtain
[14:29.790 --> 14:35.690]  information so that they can use that to defraud, probably ultimately to defraud you or your business.
[14:35.970 --> 14:38.530]  You're saying is that this whole conference of people doing this?
[14:40.530 --> 14:42.030]  That's what I understand, right?
[14:42.610 --> 14:43.430]  And that's legal?
[14:45.830 --> 14:48.630]  I don't know the legalities around it.
[14:48.710 --> 14:51.410]  I guess, you know, for them to meet is not illegal.
[14:51.650 --> 14:55.870]  But, you know, certainly if they do something that's...
[14:57.330 --> 14:59.570]  You know, I don't know what's surrounding it.
[14:59.650 --> 15:02.210]  But in a nutshell, be on the lookout, you know.
[15:03.310 --> 15:05.330]  This weekend, any time.
[15:06.530 --> 15:09.330]  Today, I know, was the day that...
[15:09.950 --> 15:12.250]  By the way, the memo that you had received was...
[15:14.050 --> 15:15.970]  You received an email or a hundred...
[15:15.970 --> 15:20.990]  Actually, a co-employee who has since lost the memo told me about it.
[15:21.070 --> 15:22.170]  And that's why I'm calling for clarification.
[15:22.610 --> 15:24.090]  Is there any way to get another copy of that?
[15:24.510 --> 15:24.830]  No.
[15:25.090 --> 15:25.650]  You were...
[15:26.150 --> 15:26.890]  You were in 18?
[15:27.390 --> 15:27.710]  Yeah.
[15:28.030 --> 15:28.070]  Yeah.
[15:29.090 --> 15:29.930]  I mean, the Americas.
[15:30.850 --> 15:31.170]  Okay.
[15:31.970 --> 15:33.510]  Do you have a...
[15:33.930 --> 15:34.250]  Which...
[15:34.250 --> 15:34.650]  What was your name?
[15:35.310 --> 15:36.490]  I'm sorry, my name is Mr. Goldstein.
[15:37.110 --> 15:37.430]  Armand.
[15:39.170 --> 15:41.410]  If I give you a fax number, would you be able to just send that over?
[15:42.370 --> 15:43.430]  Well, I don't...
[15:47.330 --> 15:51.090]  You say there's a group of people that are planning to do something and nothing can be done to stop them?
[15:51.790 --> 15:55.090]  Well, I mean, it's like, you know, the freedom of...
[15:55.790 --> 15:57.290]  They're covered under the first amendment.
[15:59.010 --> 16:02.530]  I mean, this is not something that's actually hidden from the public.
[16:02.950 --> 16:04.710]  It's more or less, you know, the...
[16:04.710 --> 16:10.650]  They can't, obviously, in the meeting advocate to doing anything illegal, but...
[16:10.650 --> 16:21.530]  But the things that they may talk about in the meeting are for that purpose of probably, you know, hackers.
[16:21.530 --> 16:22.730]  You know, it is...
[16:22.730 --> 16:23.410]  Yeah.
[16:23.510 --> 16:24.130]  That type of thing.
[16:24.350 --> 16:33.510]  But in general, like I said, yeah, any time somebody calls in and asks for something like, you know, information that you wouldn't normally give out and
[16:39.370 --> 16:54.250]  seen information that you don't feel comfortable giving out, the memo just states, you know, don't do what they're asking without asking for their callback number or their name, and then call it back and verify that they're who they say they are and all of that.
[16:54.430 --> 16:55.990]  That's the only thing the memo stated.
[16:55.990 --> 16:58.610]  I know it was in AT&T today.
[16:59.050 --> 16:59.370]  Uh-huh.
[16:59.850 --> 17:00.090]  Okay.
[17:00.410 --> 17:05.130]  And it went out to every AT&T office, I assume, more than just locally, right?
[17:06.050 --> 17:06.530]  Yeah.
[17:06.890 --> 17:11.630]  I know it was available in AT&T today and on Friday, I believe.
[17:11.630 --> 17:11.690]  Thank you.
[17:12.230 --> 17:13.630]  I can hear...
[17:19.790 --> 17:20.500]  Can you hold for a moment?
[17:20.790 --> 17:21.120]  Yeah, sure.
[17:21.360 --> 17:21.640]  Thank you.
[17:22.040 --> 17:22.220]  Thank you.
[17:33.910 --> 17:35.070]  Thank you.
[17:37.290 --> 17:37.790]  Thank
[17:44.660 --> 17:44.660]  you.
[17:44.660 --> 17:46.160]  This speakerphone is really...
[17:46.880 --> 17:47.760]  It's not...
[17:47.760 --> 17:49.080]  It's a Radio Shack speakerphone.
[17:49.160 --> 17:49.580]  Okay.
[17:49.940 --> 17:51.080]  What was your first name?
[17:51.200 --> 17:51.680]  Armand.
[17:51.720 --> 17:53.040]  A-R-M-A-N-D.
[17:59.230 --> 18:06.310]  I was just looking internally to see your email list there.
[18:07.410 --> 18:08.890]  I didn't see your name here.
[18:09.090 --> 18:09.310]  No.
[18:11.150 --> 18:12.630]  No, it's not likely you would.
[18:13.370 --> 18:13.810]  Okay.
[18:16.070 --> 18:16.510]  Why...
[18:16.510 --> 18:17.130]  Why would...
[18:17.130 --> 18:18.110]  Why does that mean?
[18:18.310 --> 18:22.070]  Well, uh, basically, we were just, uh, making our first phone call.
[18:22.230 --> 18:22.710]  And we wanted to...
[18:46.140 --> 18:46.580]  Telephone.
[18:52.620 --> 18:54.780]  They just kinda handed that one to us in there.
[18:58.420 --> 18:58.860]  Sweet.
[19:00.960 --> 19:02.700]  I think he was starting to suspect.
[19:02.700 --> 19:03.840]  He was like, uh...
[19:03.840 --> 19:04.100]  Okay.
[19:04.960 --> 19:06.540]  Well, you have to understand social engineering.
[19:06.680 --> 19:08.940]  It becomes a point of no return where you just can't recover.
[19:09.540 --> 19:11.500]  And that's when you just, you know, whatever.
[19:12.520 --> 19:13.320]  He hung up.
[19:13.520 --> 19:14.200]  That's precious.
[19:15.620 --> 19:15.820]  Oh.
[19:16.120 --> 19:16.480]  Okay.
[19:16.640 --> 19:18.040]  So if you guys want to tell some stories...
[19:18.040 --> 19:18.620]  Oh, hey.
[19:18.760 --> 19:19.440]  Introduce myself.
[19:20.680 --> 19:21.340]  I'm Virus.
[19:21.520 --> 19:22.980]  Did anybody actually make my Virus talk today?
[19:23.380 --> 19:23.540]  Yeah.
[19:24.100 --> 19:24.320]  Yeah.
[19:24.520 --> 19:24.700]  Thanks.
[19:25.840 --> 19:26.560]  Love you, Mayor.
[19:27.620 --> 19:28.840]  I'm actually from California.
[19:29.500 --> 19:31.420]  My first trip out here to New York.
[19:31.580 --> 19:32.280]  Actually, that's not true.
[19:32.280 --> 19:33.660]  I was out here when I was a year and a half.
[19:33.880 --> 19:34.560]  I don't remember anything.
[19:35.480 --> 19:36.980]  And this place is awesome.
[19:37.140 --> 19:37.880]  I really like it out here.
[19:39.620 --> 19:42.140]  I was also a professional magician for 15 years.
[19:43.440 --> 19:45.140]  So being a professional magician...
[19:45.680 --> 19:48.620]  Basically, as a magician, you are social engineering when you're on stage.
[19:48.620 --> 19:49.480]  It's 24-7.
[19:50.240 --> 19:54.700]  But on top of that, I like to get a lot of free stuff.
[19:56.180 --> 19:59.540]  So we're going to discuss a couple of different techniques and stories here.
[20:00.060 --> 20:01.200]  I have some techniques.
[20:01.580 --> 20:03.280]  If you want to go out and have some fun.
[20:03.580 --> 20:07.140]  There's some specific things you can do that will actually help you out a lot.
[20:09.300 --> 20:10.840]  One is dealing with props.
[20:11.320 --> 20:17.060]  I have discovered that if you have a hard hat, a clipboard, and you're wearing a suit, you can go anywhere the hell you want.
[20:18.740 --> 20:19.500]  Kid you not.
[20:20.060 --> 20:21.880]  I've been to two Rush concerts.
[20:22.580 --> 20:24.900]  I went to Pink Floyd and I went to Oingo Boingo.
[20:25.240 --> 20:26.440]  Did not buy a ticket.
[20:27.940 --> 20:29.660]  Walked in and said, hi, safety inspector.
[20:29.900 --> 20:30.800]  This is when I had short hair.
[20:31.980 --> 20:32.820]  Walked right through.
[20:33.020 --> 20:33.780]  He said, oh, no problem.
[20:34.080 --> 20:35.700]  And gave me a security escort.
[20:35.840 --> 20:37.600]  Basically took me anywhere I wanted to go.
[20:37.980 --> 20:39.440]  And I said, okay, I'm cool.
[20:39.720 --> 20:41.200]  Do you mind if I just sit here and enjoy the show?
[20:41.360 --> 20:42.080]  Hey, no sweat.
[20:43.560 --> 20:44.280]  No problems.
[20:45.880 --> 20:53.460]  The thing with the social engineering is when you first start, if you're going to commit, you have to commit 100%.
[20:53.460 --> 20:54.580]  You can't back out.
[20:54.700 --> 20:55.460]  You can't start sweating.
[20:55.640 --> 20:56.360]  You can't start shaking.
[20:57.100 --> 21:02.760]  Anything you say to the person, you have to believe yourself 150%.
[21:03.220 --> 21:09.720]  You know, if I'm telling you that I'm a safety inspector, I've got to believe that I'm a safety inspector.
[21:09.920 --> 21:11.980]  And I've got to act like a safety inspector.
[21:13.100 --> 21:14.200]  Or it's not going to work.
[21:14.520 --> 21:16.620]  And then people with badges walk away with you.
[21:16.900 --> 21:17.920]  And that's not fun.
[21:20.160 --> 21:25.660]  So, I mean, start looking at the part and start looking at what you need to do to get into the places you want to go.
[21:26.820 --> 21:30.800]  Remember that people inherently will trust you 100% of the time.
[21:31.360 --> 21:32.560]  Well, maybe not 100% of it.
[21:32.640 --> 21:33.200]  Most of the time.
[21:33.860 --> 21:37.760]  If you act like you belong there, don't let you walk through.
[21:39.660 --> 21:45.320]  I've gone into many, many places just because I'll just start walking right through the door, looking very determined.
[21:45.960 --> 21:48.140]  Look at the guard and go, what's up?
[21:48.460 --> 21:48.800]  Boom!
[21:48.960 --> 21:49.280]  Right through.
[21:49.940 --> 21:51.720]  And you go, okay.
[21:53.000 --> 21:55.940]  Obviously, I belong there because I said, hey, how are you doing?
[21:56.180 --> 21:57.080]  Get the eye contact.
[21:57.400 --> 21:58.040]  Get the recognition.
[21:58.460 --> 21:59.360]  Be friendly.
[21:59.620 --> 22:00.140]  Be friendly.
[22:00.820 --> 22:02.740]  That's one of the best ways you can do things.
[22:03.400 --> 22:06.340]  I got into the pit of the Indianapolis 500 this year.
[22:08.720 --> 22:10.080]  It was actually the poll trials.
[22:10.360 --> 22:10.900]  I was down there.
[22:11.600 --> 22:13.380]  I went down to the poll trials and I said, you know what?
[22:13.380 --> 22:14.200]  I want to get into the pits.
[22:14.320 --> 22:15.080]  I want to check this out.
[22:15.520 --> 22:19.020]  Well, the securities were at each side of the gates and they were blocking everybody in.
[22:19.080 --> 22:21.180]  If you didn't have a pit pass, you could not get in.
[22:21.540 --> 22:27.800]  So I went into one of the guards was distracted and just as she was being distracted, I walked by the other guy and slept on the shoulder and said, yo, man, what's up?
[22:28.100 --> 22:28.640]  Good to see you again.
[22:28.800 --> 22:31.480]  And I walked right towards the pit and started talking to one of the pit crew.
[22:31.900 --> 22:33.320]  And I was like, hey, how are you doing, man?
[22:33.480 --> 22:38.460]  But what he sees is me sitting there talking to a pit crew and pointing at the car and discussing things with the car.
[22:38.820 --> 22:40.100]  And I was like, hey, man, how are you doing?
[22:40.160 --> 22:40.520]  Good to see you.
[22:40.600 --> 22:41.100]  What's happening?
[22:41.440 --> 22:43.240]  And he's like, oh, obviously he belongs here.
[22:43.360 --> 22:46.000]  And now he started walking up and down the pits and said, okay, I'm bored with this.
[22:46.100 --> 22:47.500]  Let's go find something else to get involved with.
[22:48.200 --> 22:50.440]  But it's all determination and it's your attitude.
[22:50.640 --> 22:53.340]  Your attitude is going to carry you or drop you one way or the other.
[22:55.020 --> 22:56.920]  I'll give you a quick little story of one thing I did.
[22:57.060 --> 22:58.440]  I like to play practical jokes.
[22:58.620 --> 23:00.420]  I think practical jokes are the funnest thing in the whole world.
[23:01.100 --> 23:05.200]  But I don't like to do it to my friends as much as I like to do to the lay person.
[23:05.900 --> 23:09.020]  So we actually got a radio.
[23:09.180 --> 23:11.000]  We were in the old brick bulky radios.
[23:11.340 --> 23:14.060]  And we hauled it out and put a tape recorder inside of it.
[23:14.060 --> 23:17.620]  So if you press the talk button, it actually would play the tape.
[23:18.580 --> 23:23.400]  And I dressed up in a suit, a hard hat, and a clipboard, and got into an elevator in a building.
[23:24.960 --> 23:28.700]  And grabbed the thing and pressed the button and said, Yeah, this is John.
[23:29.000 --> 23:31.580]  I'm going up to the 14th floor.
[23:31.820 --> 23:32.720]  I'm in elevator 3.
[23:33.160 --> 23:36.160]  I'm going to inspect elevator number 2.
[23:36.360 --> 23:37.200]  And then I was in here.
[23:37.940 --> 23:40.020]  Did you say elevator number 3?
[23:40.720 --> 23:41.640]  And I started talking.
[23:41.980 --> 23:42.740]  Yeah, that's right.
[23:42.780 --> 23:43.340]  Elevator 3.
[23:43.340 --> 23:44.940]  He goes, oh man, you have to get out of there.
[23:44.980 --> 23:45.860]  They're working on the cables.
[23:46.420 --> 23:51.040]  So I calmly walked off the elevator the next floor and almost got trampled.
[23:53.900 --> 24:00.140]  And the next thing you know, there's a lot of these people running towards the elevators and inspection crews and maintenance people.
[24:00.280 --> 24:01.280]  And we left.
[24:01.460 --> 24:01.740]  Quick.
[24:06.270 --> 24:09.630]  Okay, actually I should probably talk for this phone to avoid the horrible feedback.
[24:10.350 --> 24:10.770]  Ready?
[24:11.550 --> 24:11.670]  Yeah.
[24:12.830 --> 24:13.790]  We have... Amara?
[24:14.250 --> 24:14.370]  Yeah.
[24:15.070 --> 24:15.450]  Can you hear me?
[24:15.750 --> 24:15.930]  Yeah.
[24:16.370 --> 24:16.870]  Turn the phone up.
[24:18.670 --> 24:20.210]  Ah, Kevin is with us.
[24:20.310 --> 24:20.830]  Kevin Mitnick.
[24:29.230 --> 24:37.070]  According to John Markoff from the New York Times, Kevin is probably the most dangerous social engineer in the history of the world.
[24:37.730 --> 24:42.290]  I don't know if that's necessarily true, but Kevin can probably explain it better.
[24:42.910 --> 24:55.110]  No, I don't... Well, we all know that the media hyped me up in John Markoff specifically, so I could create a character and write a book about me and, you know, prophets.
[24:55.410 --> 24:59.230]  But everybody knows about that and it's a pretty worn out subject.
[24:59.630 --> 25:04.310]  But I'm sorry I'm not able to be with H2K.
[25:04.970 --> 25:08.410]  The probation department is taking the position that I can't travel.
[25:08.730 --> 25:10.590]  So obviously I can't go to New York.
[25:10.830 --> 25:13.310]  However, I'm pretty much allowed to go to Las Vegas.
[25:14.210 --> 25:17.730]  Because my family is there and has pretty much the trouble that they're going to let me do.
[25:20.050 --> 25:20.790]  Let's see.
[25:21.490 --> 25:24.870]  This is a social entreatment.
[25:25.330 --> 25:30.450]  The kind of things that I used to do when I was, like, phone briefing and hacking, you know, years ago.
[25:31.870 --> 25:34.030]  It just really came easy to me.
[25:35.430 --> 25:38.130]  I guess, manipulating the telephone company.
[25:38.470 --> 25:43.250]  Because of the size of the phone company and the amount of people that worked there.
[26:14.190 --> 26:16.390]  A vision within the phone company called the non-stop bureau.
[26:17.150 --> 26:23.510]  And they would have a list of authorized people that were allowed to, all
[26:34.990 --> 26:35.790]  the requests you wanted.
[26:36.070 --> 26:37.910]  What they would do is simply call you back.
[26:39.450 --> 26:48.330]  And so, how I, what I thought about is, you know, what I simply needed to do was have them call me back.
[26:48.770 --> 26:51.190]  And, you know, verify who I was.
[26:52.170 --> 26:53.470]  To, you know, get the
[27:12.670 --> 27:14.810]  benefit from a different office.
[27:15.390 --> 27:18.070]  Or that I was from the non-stop bureau itself.
[27:18.290 --> 27:19.870]  And then I would use some sort of rules.
[27:20.030 --> 27:21.710]  Usually I did this all by improv.
[27:22.630 --> 27:33.130]  Except that, you know, I was really had a, I was really trying to, I would say, if I really had a true target, then I would be my homeless.
[27:33.310 --> 27:34.610]  But pretty much everything was improvised.
[27:35.170 --> 27:38.270]  And I basically say something to the effect time with the non-stop bureau.
[27:40.730 --> 27:46.490]  I had some, some representatives, you know, claim that they were having trouble getting through, but
[28:12.580 --> 28:13.320]  it was really after.
[28:13.700 --> 28:23.520]  And then once I obtained the number of the non-stop bureau, then I would simply call around to, to first level supervisors or second level managers.
[28:24.060 --> 28:29.180]  And how those numbers would be obtained is just simply by asking, you know, the customer service reps for them.
[28:29.180 --> 28:37.980]  And then I would ask, you know, I would represent myself as being from this non-stop bureau, and ask, you know, if they were authorized.
[28:38.580 --> 28:43.780]  And, you know, receive the numbers because what we're doing is we're updating, we're, you know, updating the list.
[28:45.790 --> 28:52.830]  Authorize if you're on it, or if you're not, you can fax you a form, or, you know, some sort of ruse like that.
[28:52.970 --> 28:55.050]  And usually, they would tell you.
[28:55.050 --> 29:00.070]  And right away, you don't really know what their callback number is because you already have their number that you're calling.
[29:00.210 --> 29:03.410]  So now you have a valid name and a valid callback number.
[29:03.810 --> 29:10.970]  So then what I would simply do is call the area of the phone company that handled that particular telephone service.
[29:11.190 --> 29:14.070]  Now, it could have either been done through
[29:21.010 --> 29:27.630]  instructing the switch to forward the number to whatever target number you wanted, like a pay phone, a cell phone, or whatever.
[29:28.690 --> 29:50.150]  Or you'd simply call up the assignment bureau within the phone company, find out the blocking or the cable impaired, and call the frame and just have one of the frame techs click onto the line and forward the number for me to wherever I wanted to receive the call.
[29:50.690 --> 30:05.870]  So then, once I...then I would call up the mount-up bureau, I would say that I'm so-and-so, if I call back a so-and-so, it would be validated, and they'd call me back, and then they would, you know, pretty much answer, you know, give me all the requests that I had,
[30:06.230 --> 30:14.610]  and that's simply to call the frame and have them slip on the line and deactivate the call forwarding or go into the switch itself and deactivate the call forwarding myself.
[30:14.610 --> 30:25.610]  So that was like...that's like a story of how just by social engineering, you know, I was able to basically obtain anybody that looked at their telephone number.
[30:26.070 --> 30:40.790]  And most likely, those techniques probably could still be used today unless, you know, these phone companies really, you know, create some, you know, policies and procedures and their people, all of them to the key.
[30:41.430 --> 30:57.390]  Because a lot of, you know, a lot of ways or a lot of ways that social engineering was accomplished was doing some homework, finding out, like, who was important in the organization, kind of like the hierarchy or people that work for certain groups, trying to,
[30:57.430 --> 31:07.510]  you know, get some names, get some extensions, trying to find out who was on vacation, who managed what project.
[31:08.790 --> 31:21.190]  And then, I would try to, you know, in other words, do intelligence gaps, try to find out if it is that I, you know, possibly can, and then, if possible,
[31:26.060 --> 31:29.540]  what facts have existed in what location.
[31:29.840 --> 31:36.920]  And that way, I could, if I wanted to, I could have set up prior some sort of, you know, false authentication, if you will.
[31:40.970 --> 31:51.190]  If there was a question of who I really was, that that could be verified either by fax, telephone, or email, or voicemail.
[31:51.410 --> 32:05.090]  And what I used to be able to do is infiltrate these systems and establish, you know, a valid callback, you know, a valid fax number, have somebody create me a voicemail box off their PBX.
[32:05.710 --> 32:11.170]  And that way, if there was any question, that, you know, they can call back and verify.
[32:12.650 --> 32:15.930]  And I don't know if you're still in the line, Eric, but,
[32:27.490 --> 32:37.450]  you know, I think that was, like, over ten years ago, with Airtouch, which is a cellular provider in Los Angeles.
[32:37.710 --> 32:41.450]  I think that Verizon, we don't need to talk about.
[32:41.770 --> 32:46.810]  But, in any event, when I'm
[33:01.480 --> 33:19.820]  watching one of their other markets, because they have other markets like San Francisco or Atlanta, and I've convinced the person, you know, usually, like, there was improvised ruse that received voicemail at the local office, so I would have to make a toll call back to my office in Atlanta or something like that.
[33:20.440 --> 33:27.880]  And what they would usually do is they'd be trained because they're trained to be helpful and really not trained to really question them.
[33:28.280 --> 33:32.680]  So what they would do is they would go ahead and set up a voicemail box and then turn a voicemail box.
[33:32.880 --> 33:34.000]  So any time...
[33:35.520 --> 33:38.100]  ...any time you call anybody to come
[33:44.590 --> 33:59.350]  back to the airport's mailbox, and they would simply really believe that you are what you say you are, it was really, you know, it was really easy to be able to do this type of stuff.
[34:00.130 --> 34:03.470]  And then, you know, when I was hacking with
[34:09.780 --> 34:22.740]  any suspicion, and the only social engineering I would do would be to get information, you know, some of them would not really call up anybody and have them do anything that they're really going to remember.
[34:23.180 --> 34:32.580]  Because the media, pretty much, you know, when I read reports about social engineering, they, you know, they characterize it as simply calling up and talking to somebody after their password.
[34:32.780 --> 34:40.260]  And I don't think I've ever, maybe on one or two occasions, actually asked somebody for their password, because that's a huge direct line.
[34:41.360 --> 34:44.080]  There are some corporate memos going around saying the same thing, too.
[34:44.160 --> 34:45.120]  Yeah, that's a huge direct line.
[34:45.520 --> 35:01.260]  Like one of the methods that would be the closest to that that was successful was, you know, when you call somebody up and you're interacting with them, you can really determine how knowledgeable they are about the computer system that you're using.
[35:01.260 --> 35:02.430]  you can kind of get it
[35:08.100 --> 35:08.500]  legitimate.
[35:09.060 --> 35:29.440]  And really, you're basing, it's very dynamic in the sense that you have to use some sort of people feel to determine if a person you're speaking with would, you know, be suspicious if you ask them to do something with that, you know, would that make them want your
[35:32.520 --> 35:33.120]  sense for it.
[35:33.120 --> 35:36.400]  At least I was able to get a really good sense for when I was speaking with people.
[35:37.060 --> 35:53.940]  And the closest, you know, like if somebody was really gullible, they didn't have, their computer knowledge was limited, then you, you know, like some rules would be, hey, you know, I'm from the help desk, you know, somebody reported a problem, can you,
[35:54.000 --> 35:58.500]  you know, can you work with me over the phone, but I'd like you to tell me everything that you're typing as you're doing it.
[35:58.780 --> 36:11.540]  And you have the person go through a whole bunch of stuff where they're getting tired of it, and then you have them, then I would have them either log off the system and log back on, but as they're doing that, they'd be, you know, telling me every keystroke that they're entering into the system,
[36:11.600 --> 36:12.720]  which would include their password.
[36:13.060 --> 36:16.900]  But I'd never be in a position where I would actually say, hey, what is your password?
[36:17.060 --> 36:30.400]  Because that's, that's like a big threat slash, and the type of, you know, techniques that were used, I'd never do anything that would, you know, be questionable.
[36:31.140 --> 36:32.360]  And I hear about the feedback.
[36:32.680 --> 36:35.120]  Yeah, it's a mystery to us too.
[36:35.940 --> 36:38.400]  But, Kevin, we only have about ten minutes left.
[36:38.600 --> 36:42.160]  That was basically, you know, there was a couple of stories that was interesting.
[36:42.620 --> 36:45.380]  What we'd like to do is, we'd like to open up to questions.
[36:45.540 --> 36:46.920]  I don't know if there's a microphone out there.
[36:47.520 --> 36:50.400]  It's not, people can come up here, we can get the mic, and come
[36:54.050 --> 36:54.770]  up to the stage.
[36:54.950 --> 36:56.850]  Yeah, come up to the stage so you can get on the microphone.
[36:57.310 --> 37:00.050]  And then hopefully Kevin will give an answer.
[37:01.250 --> 37:04.330]  If you have a question, come up to the stage, speak on the microphone.
[37:05.090 --> 37:05.770]  I can't hear.
[37:05.850 --> 37:06.210]  Anybody?
[37:06.770 --> 37:06.910]  Anybody?
[37:10.920 --> 37:15.140]  How do you remember this so clearly after all the years you've been locked up?
[37:15.620 --> 37:15.980]  Documented.
[37:18.200 --> 37:19.180]  Can you, can you hear that?
[37:19.620 --> 37:19.720]  Yeah.
[37:20.860 --> 37:21.360]  Do you have an answer?
[37:22.120 --> 37:22.920]  I couldn't hear everything.
[37:23.100 --> 37:23.660]  Well, you didn't hear the question.
[37:23.740 --> 37:26.940]  Okay, how do you remember this so clearly after so many years?
[37:27.820 --> 37:29.060]  I just have a good memory.
[37:29.400 --> 37:31.520]  Just like telling us, like, step by step how to do it.
[37:31.640 --> 37:32.200]  I was just wondering.
[37:33.060 --> 37:36.100]  Well, once you develop a process, you just keep using the same process.
[37:36.640 --> 37:39.080]  So, it's not like, hey, I only did it one time and...
[37:39.080 --> 37:40.920]  I can't hear anything on your phone.
[37:41.200 --> 37:41.460]  Sorry.
[37:42.940 --> 37:44.940]  Okay, I'll try to relay as much as I can.
[37:45.080 --> 37:45.820]  We have another question.
[37:46.340 --> 37:47.200]  Hey Kevin, how are you?
[37:47.580 --> 37:48.240]  Welcome back.
[37:48.700 --> 37:52.180]  My first question is, how do you control your emotions?
[37:52.380 --> 37:56.440]  I think that's the hardest part of social engineering is to control your emotions.
[37:56.440 --> 38:00.820]  Okay, the question was, how do you control your emotions while social engineering?
[38:02.940 --> 38:03.420]  Um...
[38:03.420 --> 38:04.700]  Your emotions...
[38:04.700 --> 38:11.420]  Well, you try to make an emotional connection with the person on the other side, so you'll develop a...
[38:11.420 --> 38:12.920]  You'll develop a trust.
[38:13.260 --> 38:14.600]  Because that's the whole idea.
[38:14.800 --> 38:15.700]  People want to...
[38:16.380 --> 38:20.360]  You want to create a sense of trust between you and the other person, so they're more...
[38:21.500 --> 38:21.900]  Um...
[38:22.440 --> 38:22.840]  Um...
[38:22.840 --> 38:22.960]  Um...
[38:22.960 --> 38:28.880]  They're more apt to give you some information, so they're going to really go through some sort of a verification process.
[38:29.760 --> 38:30.840]  And that's what...
[38:30.840 --> 38:31.600]  That's what...
[38:34.560 --> 38:36.740]  That's what I'm looking for this degree of trust and an exploitation.
[38:39.840 --> 38:41.160]  Also, a point on...
[38:41.160 --> 38:43.060]  On that also is, uh...
[38:43.060 --> 38:43.500]  If you just...
[38:43.960 --> 38:48.020]  Back to where I stayed before, you really need to believe, you know, what you're doing.
[38:48.300 --> 38:50.020]  You need to, you know, be convinced yourself.
[38:50.760 --> 38:52.980]  Um, if you don't know if you can do that, uh...
[38:52.980 --> 38:55.720]  Do what a lot of us do is just go out and take an acting class.
[38:56.280 --> 38:59.280]  You know, because that's all you're doing is you're acting, but you've got to make it believable.
[38:59.740 --> 39:00.040]  We...
[39:00.040 --> 39:03.000]  We have a second room filled with people that also, uh...
[39:03.000 --> 39:06.420]  Want to ask questions, so we're relaying them via radio, uh...
[39:06.420 --> 39:06.940]  To us.
[39:07.360 --> 39:07.760]  So, uh...
[39:07.760 --> 39:08.920]  We have a question from the other room.
[39:10.140 --> 39:10.500]  Um...
[39:10.500 --> 39:11.500]  Okay, let's go to this room.
[39:11.580 --> 39:12.700]  How much, uh...
[39:12.700 --> 39:13.540]  Research do you have to...
[39:13.540 --> 39:17.000]  How much research do you have to do into the role that you're playing, uh...
[39:17.000 --> 39:18.120]  As you're social engineering?
[39:18.420 --> 39:22.560]  The question is, how much research do you have to do into the role you're playing while social engineering?
[39:23.280 --> 39:29.280]  Well, pretty much, when I used to do this stuff, there was a lot of it was just improvising improv.
[39:29.900 --> 39:32.800]  And it was just being in the moment, so to speak.
[39:33.000 --> 39:39.280]  But if I really wanted to get some information, then I'd do my homework.
[39:39.600 --> 39:42.300]  First of all, the company, I really understood their lingo.
[39:43.660 --> 39:46.840]  So I tried to, you know, the organization was being targeted.
[39:47.020 --> 39:48.440]  I tried to learn the internal lingo.
[39:48.440 --> 39:55.280]  I tried to learn tidbits of information that employees would only know.
[39:55.500 --> 39:58.720]  Try to have other names, so those names could be dropped.
[39:59.480 --> 40:06.120]  Now, for instance, when 60 Minutes profile me on your show was just in January.
[40:06.880 --> 40:09.540]  One of the examples I gave them was with Motorola.
[40:09.880 --> 40:25.060]  How I called up the engineering department and tried to find out who was the project manager, who were the people that had access to the development of the micro-tax series of cell phones, because I was interested in getting the source code.
[40:26.700 --> 40:33.280]  And I was transferred to a manager who told me that the project leader was on vacation.
[40:33.680 --> 40:37.760]  And that person also needed the name of the project leader.
[40:37.900 --> 40:49.940]  So I was able to use that information when talking to people that worked for that person to convince them to do things that they wouldn't have ordinarily done if they knew that it wasn't as good as they can.
[40:51.380 --> 41:05.260]  And, you know, what seems like the bottom line here is if you really don't know the person and recognize their voice, if you're really relying on some sort of, you know, sense of trust.
[41:05.760 --> 41:23.120]  And, you know, what I would suggest is if you're concerned about your employees or, you know, social engineers, there should be some sort of verification mechanism in place to really verify who you are if they don't really recognize the person.
[41:24.120 --> 41:25.400]  And a lot of people
[41:31.870 --> 41:39.350]  are not trying to question, maybe in the military level, you know, or anything that's going to be interested in self-incorporate America.
[41:39.590 --> 41:45.230]  People, you know, are just interested in doing their job and, you know, doing things for productivity.
[41:46.370 --> 41:51.390]  And I don't know if things have changed nowadays, five years later, because, you know, it's closed on the internet.
[41:55.430 --> 41:59.390]  We're trying to take as many questions as we can in the couple of minutes we have left.
[41:59.470 --> 42:00.610]  We have a question from the other room.
[42:00.710 --> 42:00.870]  Go ahead.
[42:00.870 --> 42:02.750]  From the other room, the radio came through.
[42:03.010 --> 42:08.510]  What advice would Kevin give to corporate types who need to avoid being social engineered themselves?
[42:08.870 --> 42:09.750]  Yeah, we're talking on the phone.
[42:10.010 --> 42:10.030]  Okay.
[42:10.030 --> 42:14.390]  The question is, what advice would you give to corporate types to avoid being social engineered themselves?
[42:15.170 --> 42:27.970]  Well, I would, well, corporate types, or I guess their employees, I guess, all kinds of sound, user awareness and education, you know, kind of,
[42:33.200 --> 42:46.260]  or any type of, you know, audio visual could be shown of, you know, how this is done, how you could potentially be a mark, a mark as, you know, a person that is a victim of a crime.
[42:47.440 --> 42:54.920]  And if you, if they can see a demonstration and, you know, it's all about raising their level of awareness.
[42:55.400 --> 43:03.860]  If their level of awareness is high, that there's people out there that would get to do this type of thing, and how easy it is, you know, how easy it is done.
[43:04.600 --> 43:10.360]  And about really, really questioning anyone that they don't really personally know when they get phone calls.
[43:10.360 --> 43:25.980]  One thing that kind of, kind of, was a deterrent for me if I was calling this company and then they would say in their, you know, announcement that, you know, that, you know, sure that police, uh, or, you know, something about their monitoring, you know,
[43:26.060 --> 43:26.940]  for quality assurance.
[43:51.040 --> 43:53.360]  Kevin, we only have time for one more question.
[43:53.560 --> 43:56.500]  It's my solemn duty to inform you that that question comes from Rebel.
[43:59.700 --> 44:00.700]  So, take it away.
[44:01.140 --> 44:02.640]  Please don't give us an email address.
[44:03.020 --> 44:07.700]  The question is that, I notice that you are trying to get unlisted numbers.
[44:07.860 --> 44:09.680]  A lot of people ask me how to get unlisted numbers.
[44:09.800 --> 44:11.700]  I notice you have to go through a lot of steps.
[44:12.480 --> 44:24.220]  Is there any way to go through less steps to do certain things, or does more tasks take more steps to do, like getting an unlisted number, or getting into a building, or things like that?
[44:24.220 --> 44:26.580]  Rebel wants to know how to get unlisted numbers.
[44:27.980 --> 44:28.460]  Great.
[44:28.960 --> 44:29.780]  We try to do.
[44:30.440 --> 44:33.000]  I'm going to have the FBI doctor in my door.
[44:33.160 --> 44:33.440]  Come on.
[44:35.020 --> 44:38.220]  How you get unlisted numbers, go hire a private eye.
[44:38.360 --> 44:45.680]  I'm sure, you know, there's a lot of private eyes out there that hire people that are information brokers that basically can get anything.
[44:46.700 --> 44:54.300]  And that's how private investigators kind of instillate themselves from breaking the law because of all these new federal laws being passed about motor vehicle records.
[44:54.820 --> 45:00.100]  They just harm it out to information brokers that, you know, charge high fees so they get the information.
[45:01.200 --> 45:04.120]  Obviously, everybody in the audience knows nobody has any privacy.
[45:04.120 --> 45:15.460]  You know, any information about, you know, you personally made a database that's accessible by any government or federal or state employee is pretty much an open book to anybody else.
[45:16.140 --> 45:18.940]  Okay, Kim, I want to thank you very much for being part of this.
[45:19.180 --> 45:20.440]  Sorry you can't be here.
[45:29.020 --> 45:32.560]  I'm glad you could be here telephonically.
[45:32.860 --> 45:37.080]  And I just want to, you know, thank everybody out there for all the support they've shown me over the years.
[45:37.080 --> 45:48.180]  And hopefully at the next, you know, hope, maybe whenever that is, maybe next year or whenever, then I, you know, hopefully I'll be able to have the honor of meeting everybody.
[45:48.800 --> 45:51.900]  Okay, and we'll get that filmed to you one way or another so you can finally see it.
[45:52.160 --> 45:53.000]  Yeah, great.
[45:53.140 --> 45:53.740]  I'd love to see it.
[45:53.860 --> 45:54.240]  All right.
[45:54.400 --> 45:55.040]  Thanks for the benefit.
[45:55.040 --> 45:58.000]  Have a great time, and I'll talk to you soon.
[45:58.220 --> 45:58.920]  All right, thank
[46:04.460 --> 46:04.580]  you.
[46:08.360 --> 46:17.160]  In closing here, if you really, really want something, one of the recommendations I can make to you guys is, play on other people's emotions.
[46:17.440 --> 46:19.080]  And it sounds really horrible, but it's true.
[46:19.240 --> 46:23.460]  If you call up the operator and you need an unlisted number, you know, there's things you can do.
[46:23.540 --> 46:32.600]  I've gotten unlisted numbers on people, you know, that I really needed to contact for legitimate reasons, but I knew AT&T or whoever wasn't going to give you those numbers and say, hey, look, man, his grandmother just died.
[46:32.640 --> 46:34.720]  I need to get a hold of him, like, right now.
[46:35.160 --> 46:37.320]  You know, it's like, boom, number, you know.
[46:37.740 --> 46:40.900]  And I mean, it's like, just be cool about it.
[46:40.900 --> 46:41.300]  You know.
[46:44.220 --> 46:45.060]  Any final remarks?
[46:45.180 --> 46:50.260]  Actually, you know, we could call AT&T and say, hey, you know, we're John from Security, and we want...
[46:50.260 --> 46:51.100]  John from Security.
[46:51.200 --> 46:52.300]  Was that the guy's name, John?
[46:52.440 --> 46:53.280]  He's John from Security.
[46:54.120 --> 46:54.440]  Jim.
[46:54.600 --> 46:55.120]  Jim from Security.
[46:55.460 --> 46:56.720]  Yeah, this is Jim from Security.
[46:57.260 --> 46:58.380]  Jim from Security is going to have an interesting report.
[46:58.500 --> 47:00.260]  You have a phone number, it has a callback number.
[47:01.940 --> 47:02.620]  Yeah, that's true.
[47:02.920 --> 47:04.120]  Can we remember that for the rest of the slides?
[47:06.780 --> 47:10.320]  If you walk across the street and go to a newsstand, you'll get today's copy of Newsday.
[47:10.320 --> 47:12.680]  There's a huge article in it about the whole DVD case.
[47:12.940 --> 47:14.340]  And it mentions the conference as well.
[47:14.740 --> 47:19.100]  And the amazing thing about this article, I can't find a single factual error.
[47:19.600 --> 47:21.000]  I mean, they're getting the story right.
[47:21.400 --> 47:21.480]  Wow.
[47:21.760 --> 47:22.240]  Right on.
[47:27.460 --> 47:32.160]  They've got this David takes on Goliath thing, and they've got, you know, Goliath's picture over there, Jack Valenti.
[47:33.160 --> 47:34.660]  And they really did a good job.
[47:34.840 --> 47:38.920]  So, if you can find copies of Newsday over there, by all means, pick one up.
[47:39.060 --> 47:40.420]  This comes out the day before the trial.
[47:40.560 --> 47:40.940]  It's a good thing.
[47:41.540 --> 47:41.820]  Okay.
[47:42.160 --> 47:46.080]  We've got some catching up to do, so I think Jonathan Hanson and his dad are going to be in the main stage.
[47:46.740 --> 47:48.440]  And the rest of track two will be in here.
[47:48.900 --> 47:49.340]  All right?
[47:49.600 --> 47:49.820]  Okay.
[47:50.700 --> 47:51.020]  Thanks.
[47:51.720 --> 47:52.120]  All right.
[47:52.180 --> 47:53.060]  We'll figure it all out.
[47:53.060 --> 47:53.780]  Thank you.
[47:53.780 --> 47:54.100]  Thank you.