Social engineering and time

No, I'm not going to give you tips on time-managment (I suck at it big time), nor will I try to tell you that things will improve over time: things change, but do not always improve! If you don't believe me, just leave your BLT sandwich on your porch for a week. See?

What I'm talking about is abusing time in the processes of authentication and verification. It is often an easy way to deflect annoying questions and nosy people. Let's look at a situation I run into during an assignment a couple of months ago:


I am walking around in a no-go area. I simply tailgated another employee through the "high security" gate, and am now trying to find a place to plug in my laptop, so I can take a look at the internal network. Suddenly, an voice behind me asks me: "what the hell are you doing here?".

I turn around to see a red-faced floormanager walking my way. I smile, shake his hand, and introduce myself. I tell him I'm with a consultant firm called Jackson, and we're here for the transaction systems. Somehow, my smart business suit and suitcase do not convince him.

"who sent you here? "
"My manager did, mister de Vries. This project has been approved by your CFO, mister Willekens"
"Mister Willekens is on vacation right now!"
(of course he was, I'd already figured that out by calling his secretary)
"Well, if it makes you feel more at ease, I can fax the contract to you. What's the number of you fax machine?"
"It's 024-2023043"

I pull out my mobile and call my own office:
"Hello, Carla? Hi, Hans here. "
The people at my office know to play along when I use the name "Hans".

"Would you do me a favour, and fax the contract for the Astropol transaction project to 024-2023043? Ah, I see. Sure, sure, I understand, well do it as soon as it is fixed, ok? This is rather urgent."

I turn to the floor manager and explain that our fax machine is paperjammed, but that they'll fax the contract as soon as possible. He slowly calms down, and even starts to apologize:
"Look, sorry if I was a bit hard on you, but we have very strict rules around here, so you see...Would you like some coffee?"
"Yes please, and while we're at it, can I ask you a couple of questions about the transaction system we're supposed to help you guys with? There's a couple of things that are still a bit vague to me.."

I continue to milk the manager for all the information I need. He is quite content to help me, because, in his mind, everything is OK. The written contract is on it's way, right? Riiight.. I even convice him to let me plug my laptop into the network.
"To check my e-mail".
Just before I leave, he tells me that I better call my office again: "because they still haven't sent me that fax". I assure him I will get right on it, and leave the building with a big smile.

Did the manager do anything wrong?
Well, not according to the policies of that company. The policy stated that visitors should carry visitors' passes. It did not mention consultants or temps.
The manager asked me for my credentials. However, he couldn't decide what to do next when these credentials would be delivered in the near future. The policy was specific on what he should do, but the policy did not take into account exeptions: delayed credentials.

Should he stand next to me, waiting for the fax?
That would be a waste of time.
Should he send me outside, until the fax had arrived?
That would be impolite.

So, while trying to figure out what to do, he was extremely open for suggestions.
And that's what I gave him..