Social engineering: why the easiest system to hack is a person

The bots now find every way into Miva's shop locked. But the shop does not run on her laptop. It runs on a server at a web host, a company that keeps shops online for their owners. When an owner is locked out, its help desk lets them back in: that is its job.

Rono calls that help desk and says he is Miva. He sounds warm, a little lost, and in a hurry: the big sale of the shop starts in an hour, he says.

The help desk asks a few questions to be sure. Every answer is right, because every answer was on Miva's own page. A kind voice, a real problem, a clock that runs: the worker wants to help.

So the worker changes the login email of the shop to the one "Miva" gives, and sends a new password there. Rono logs in as Miva. No lock was broken: the door was opened from the inside, by the person who holds the key.

Rono's bot found every lock shut. One call did what it could not. Tricking a person into opening the door is called social engineering, and the made-up story it rides on ("I am Miva, my sale starts soon") is called a pretext.

It works on giants too. In September 2023, attackers knocked out many computer systems of MGM Resorts, the Las Vegas hotel and casino group. The attackers later said it began with one call to its IT help desk, and MGM put the cost at about $100 million.

Miva gets her shop back, and the help desk changes one habit: before it opens a door, it calls the owner back on the number it already has. Rono's voice no longer works. So he writes to Miva herself, and this time the trap is in the file attached.