Setting the Scene

Trust is central to the workings of a vibrant modern society.Without trust, you wind up in a cabin in the woods, with three years of supplies and a rifle, incase anybody gets too close. Admittedly, more people err on the side of too much trust, which canbe far more dangerous (though considerably less entertaining). With the specter of identity theftlooming large in the public consciousness, steps are being taken in the consumer sphere to helpremedy this situation.

Trust but verify is a maxim we should all be familiar with. Too many forget, however, whenthey are overworked, underpaid, or, less charitably, less than competent. Even when we operate ingood faith, the methods of verification available to us can be subverted by a skilled attacker.Misdirection, spoofing, social engineering these are all tools available to those who would abusesociety s trust.

This chapter seeks to illustrate some of the issues relating to trust that arise in the fieldof information security: users trusting their equipment to be secure; organizations trusting theiremployees or contractors to be competent and loyal; companies trusting that the person on the otherend of the phone really is their customer. Verification is used at various stages in some of thesetransactions, but with the proper information or skills, an attacker can steal the trust they couldnot normally garner.

Mr. Torrence s Virus

I stumbled off the elevator on the third floor, eyes squeezing shutreflexively from the early morning sunlight creeping through the east-facing windows...