The second hand on the clock is broken. I am staring
at the hand incessantly as it is spinning out of
control. My heart is racing and beads of sweat are
collecting on my brow. I have never really dealt with
law enforcement before. Well, once when I was a
little kid and I stole a pack of chewing gum from a
store. The officer gave a stern "if you ever do this
again I will have to take you in" warning and sent me
on my way. The wrath I received from my Mother was
far worse than any juvenile hall I could have been
sent to.
But this time, however, the situation is a little bit
different. What was I caught doing, you ask? Well, I
was found red-handed in a dumpster. Not just any
dumpster, mind you. This gold mine happened to be
behind a Fortune 100 company. How was I discovered?
By sheer stupidity, that's how. Here is my story and
recommendations on how not to end up in my situation.
I actually started dumpster diving after hearing
several guys discussing the topic at a local 2600
meeting. One kid bragged about how much information
he found at a local electronics store. Granted, he
also found other cool stuff in the garbage (hard
drives, CD-ROMs, software), but what he really wanted
was the information. This included telephone
directories, lists of user ID's and passwords,
invoices, etc. I became even more intrigued with
diving after learning this was a method Kevin Mitnick
utilized to gain a great deal of his knowledge about
companies. So, this is where my dumpster diving
career took off.
In the beginning, I practiced in my own neighborhood.
It was easy and no one cared if their garbage was
missing-they would just blame a raccoon or the
neighbor's dog. I would sprint over in the middle of
the night and grab just a couple of bags (using gloves
of course-safety first!). Sneaking back into the
night with the stash, I dove into my garage to inspect
the contents.
It is truly amazing what people will throw away
without shredding first. I now know my neighbor's
credit card, checking account, and social security
numbers, as well as what medications they are taking.
If I wanted to, I could have had a lot of fun
impersonating my new buddies next door. Shopping
spree, here I come! Of course, I did not do that.
Tempting maybe, but not a good idea. This was just a
practice run for the bigger prey, the local retailer.
I began by watching what activities occurred behind
the store late at night. I noted when deliveries were
made and how often garbage was retrieved from the
dumpsters. The information was gathered over a
seven-day period to determine any patterns. With this
knowledge in hand, I felt confident to make my move.
This time, however, I changed my appearance from
amateur cat burglar to "yuppie suburban woman." The
attire consisted of a nice dress, high-heeled shoes,
and a large, fancy purse. Why would I wear that
outfit, you say? Well, who is a cop more likely to
believe – a well dressed, attractive woman or someone
with pink hair wearing a "got root?" shirt. Give me a
break.
Anyway, my first mission was a success. I was able to
get some user ID's and passwords, along with a company
phone book (and some missing inventory items someone
"left" behind the dumpster). All of the loot fit very
nicely into my large designer handbag. Now I was
pumped and ready to continue my conquest. I set my
sights on another local retailer - a competitor of the
first store.
The setting was similar, except this time Officer
Barbrady, from the local police department, was on a
donut run in the neighborhood. He came around the
back of the building and shone his spotlight in my
direction. I froze like a deer in headlights. Now what
do I do?
I am not sure if this was my incredible acting ability
or sheer fright, but I started sobbing hysterically.
The cop came over and asked what I was doing in the
dumpster. Breathlessly, I told him I was in the store
earlier in the day and happened to use the restroom.
I was recently engaged and had not gone to the
jewelers to have my ring sized yet. As I was drying
my hands, the ring must have fallen in the trash with
the paper towels. I had not noticed it was missing
until an hour ago. I called the store and they told
me to stop by. When I arrived, no one inside was able
to help me but said I was more than welcome to search
the trash myself. The cop at that point felt so bad
about the incident he then proceeded to help me dig
through the garbage! I could not believe he bought my
story!
By now, I am feeling indestructible: Queen of the
World! It was at this moment when I decided a large
company would be the ultimate target. However, this
bright idea proved to be my downfall. I was becoming
too greedy and confident. The one minor detail I
overlooked about big companies is they tend to spend a
little more on physical security than your local "Mom
and Pop" store. Granted, most companies do have 24x7
guards and security cameras, but unfortunately I found
the one rare company where the guards actually watched
the monitors (and not through their eyelids).
As I was happily digging through the dumpster, a guard
with a flashlight approached. I confidently used the
same story from my last successful mission, but
somehow it did not work as well with this fine
gentleman. So, he brought me in for further
questioning. He also played back the tape from the
security camera strategically located over the
dumpster. At that point, I knew my number was up. I
confessed I was looking for information about the
company. The guard smiled with glee and ran to call
the police.
Now, as I wait for the executioner to sharpen his
blade, I will pass along a couple recommendations to
you:
1) Carefully stake out your intended target. Note all
activity around the dumpster for several days.
2) Have a good disguise and somewhat believable alibi.
Social engineering skills are a plus for this step.
Also, if you cannot cry on command, either bring
pliers to pinch yourself or take acting lessons at the
local community college.
All right, you might not like the next list of
recommendations, but cut me some slack. The crowd is
shouting for my head as the executioner moves toward
the stage, so I am not in the best frame of mind. The
items below are for our dear, dumpster diving victims:
1) Have shredders in all office areas where they are
easy to access and use them! You might not think the
documents are sensitive or important, but we do.
2) Empty recycle bins on a daily basis. Cleaning
people are paid to take documents out of bins and
trashcans by competitors, investigators, etc.
3) General office security: lock desk drawers, laptops
and computer desktop when away from your office, even
if it is only for a few minutes.
4) Above all, protect yourself at home! Shred
everything, no matter how trivial the items may seem.
You are very naïve if you think someone is not sifting
through your garbage looking for valuable information.
Note: After all the sweat I lost over the police
interrogation, absolutely nothing happened. The way
the cop and security guard were treating me, I figured
a priest would be stopping by to deliver my last
rites. What a joke! All the cop did was have me sign
some type of no trespassing form. He then said to
never return to the property or I could be charged
with (gasp!) a misdemeanor.
Since I am not an idiot, I realize the system is
working in my favor. To beat the system, I just move
from one company to another. You won't be charged and
will get tons of great information. Goodbye jail
time, hello companies!
|