Social Engineering Challenge 3: Smile!

My task for this week: Get a stranger to let you take a picture of them.

My original plan was to pose as a photography student downtown and ask people to be subjects for a project. Unfortunately, time (and life) were not on my side. My last chance was this afternoon, so I had to come up with something. Even worse? I had to work for the rest of the day.

But wait...a new employee started today, and I hadn't met them yet. So to me, they're a stranger. I went down to the front desk and she happened to be entering some information into the office manager's computer. The OM was nowhere in sight, so I seized this opportunity.

"Excuse me, today is your first day, right?"

"Yes! I'm--"

"Great. I'm from the IT department and I need your picture for the directory. Would you mind if I snapped one right here?"

"Sure! No problem."

Face and corporate identifying information redacted.

While I believe my original plan would have also been effective, likely multiple times, I believe my on-the-spot plan worked just as well. I had a plausible reason for needing a picture, and I just had to assume my target would be trusting enough.

With the information I gained (in this case, a picture), I could run a reverse image search on Google, which might yield other pictures. I could also print it on false identification or other documents.

The real challenge will come later when she figures out that while I actually do work in IT, the picture I took won't appear in the directory. In fact, the IT department doesn't even have the ability to change someone's photo--only they can do that! So, how did I feel while I was doing this? Fine. How will I feel when I run into this person again? Well, I just hope they don't ask about the picture. I'll have to come up with another story.

I still don't know her name.

- The Admiral