Simon Willison’s Weblog

“I’m Brian and so’s my wife”

24th February 2004

I’m subscribed to a whole bunch of mailing lists, mostly as a lurker as I have a hard enough time just keeping up with some of them. One of those lists is Bugtraq, which is pretty much required reading for anyone with sysadmin responsibilities for a server connected to the public internet. Bugtraq is the central hub of the “public disclosure” security community and is actually surprisingly low traffic with only twenty or so messages a day. It’s fascinating to watch the latest exploits for all manner of popular software packages tick by on an hourly basis.

Last week, someone posted to the list asking if anyone knew of a contact address for the security team at Bank of America. Today, they posted a follow-up which included the following gem:

I’d also like to thank the 0-day social engineers for their variety of approaches used to attempt to gain access to this exploit. We received responses ranging from fraudulent “Bank of America” employees to phone calls from people claiming to be from Bank of America’s IT Security. (One caller claimed to be from Bank of America’s IT Security but didn’t know what PGP is and then said he couldn’t give his PGP key due to security restrictions. And when we asked him to provide information so we could verify the contact, he said he would call back but never did. To this caller: Yes, your social engineering failed and your caller-id spoofing was almost perfect. Emphasis on “almost”.)

For some reason, I’m reminded of a classic scene from Monty Python’s Life of Brian.