Social Engineering Can Start With a Simple Phone Call

You might have heard about an incident involving Tesla Motors recently referred to as a hack. Well, it wasn't truly a hack, but more of an attack or prank. While it did involve breaches of security, it was not because someone penetrated the network of the company. Instead, it involved social engineering tactics by the attackers and the good faith of a phone support representative.

Essentially, the attackers wanted to cause trouble for someone. It may not even have been Tesla or its CEO, Elon Musk. It may have been intended to frustrate those who answer the phone for a computer repair shop in Illinois. Their phone number was tweeted out on Musk's account as the one to call for a supposed free car

Essentially, someone was able to convince a customer support representative at AT&T that he or she was an employee of Tesla and to forward calls to a non-Tesla phone number; the repair shop in Illinois. In addition, the attackers were able to redirect the IP address of the Tesla Motors website to a fake one and send out the fake tweets.

The details of the incident are not the point of this story. What is significant here is that the attackers used social engineering and simply convinced someone to perform a task that was not authorized. Smooth talking can do that. Anyone working as an interface to the public should be aware that these scams exist. Procedures are put into place for a reason and should not be bypassed, no matter how suave and convincing the person on the other end of the phone line may be. The priority for customer support is certainly to help customers, which is part of the problem; they want to help and be polite in doing so. And it is difficult to say no when you are there to please. However, it is also the responsibility of those people to protect their customers.

Fortunately, it does not appear that more damage to Tesla was done other than some humiliation and some time spent reversing the damage. The repair shop was probably frustrated as well. Just remember that while many social engineering attempts involve phishing via email, sometimes it can be just as effective with a simple phone call.