Social Engineering Task #9

Execution:

My task was to research a person online and then call them and start a conversation with them using information I learned.  I accomplished this task using Facebook by finding a person who lives in my town whose profile was not set to private:

 

 
 

Narrative/method:

I am a member of my town’s community Facebook page.  There is currently an initiative for the beautification of downtown so I thought I would go to the community page and see who was talking about it and try to use that as my conversation starter.  Instead I found a different opportunity.  Someone had posted a picture of a white bunny in their yard with the concern that a family pet had escaped.  I starting reading the comments and found the above post where the writer shared a considerable amount of information in a single sentence.  I clicked on her profile and found that it was not set to private.  She seemed to have filled out all the “About” information including birthdate, marital status, places she has lived, and the quotes “Love my pug.  So homely that he’s cute” and “The more I know people the more I like dogs”.  I used the information from these quotes to start the conversation by saying I was a member of a Pug Rescue of New England, a non-profit group based in Somerville.

Application:

This woman’s Facebook profile has a lot of information in it that anyone could see, including the about information and all photos and posts.  She seemed lonely when we spoke and eager to chat rather than skeptical of a cold call.  I believe she would have agreed to donate money to me and that is a scary thought.  After we chatted about our dogs, the new dog park in town, the renovation of the downtown area, and our desire for a few more good restaurants, I asked if she was interested in supporting the rescue.  She said she was so I told her to visit the website at www.pugrescueofnewengland.org.  I told her that a legitimate charity should ever ask for payment information over the phone and that she should always go to a valid website and check into an organization before giving a donation.  I warned her that online criminals were very good at tricking people and that she should be careful about what she posts online and what links she clicks.  That eased my conscience a bit as I felt awful about having targeted this sweet woman for this task.  I think an online predator could easily have befriended her and taken advantage of this lonely widow for financial gain.

Ethical reflection:

This woman was very trusting.  I think providing her the advice I did was a morally correct action but had I asked her for credit card information over the phone that would have been morally wrong.  Elder fraud is a huge issue in this country.  Many elders are online in order to keep in touch with loved ones.  Recently my friend’s grandmother got a call from someone pretending to be her grandson asking for bail money because he was too embarrassed to call his parents.  The caller knew that her grandchildren call her Gama and she was convinced it was her grandson and would have sent the money had the call not disconnected.  This is a frightening story that demonstrates how easy it is to take advantage of the elderly.