How I attacked a fellow student (opens in new tab)

Not at all. When we have an opening I get dozens of those a day. I honestly skim them to see if there is any relevant information (there usually isn't)... and then go straight to the resume. So the language just doesn't register with me, at least not consciously.

Well done versions include a couple of nuggets of information telling me why I should open that resume, but that's surprisingly rare.

I am guessing that the student in question was from India. That's how many Indians write official/business letters; likely a relic of the colonial times.

The other student was an international student, his English overall was quite formal. Really lovely guy though :)

Y'know what, I disagree. It's not misleading. Social Engineering _is_ an attack, as far as I am concerned, and honestly when he mentions that it's Social Engineering in the third sentence of the article itself, I don't find it misleading at all.

To the guy who did it: Bloody well done. I agree with guyhelm, it's overkill, and we all know that's the best kind of kill ;)

Social engineering is actually quite scary, especially when put together with targeted attacks against the individual. It's a one-two punch that is very hard to defend against.

I wish the Uni's here in Brisbane would do stuff like that! Well done again, and I'm quite jealous!

thanks!

I meant that with that level of trust it wouldn't be too hard to adapt the attack to shift to gaining that sort of information. ie; We are adding you to our employee database but we need your SSN last 4.

My impression was that he meant that at that point it was potentially viable to scam some financial information out of the target.

"indormation protecting online accounts" makes me think of password reset questions.

You can quite cheaply (for around $3 depending on the registrar) opt into Whois privacy protection.

It would've given me away. I wasn't super concerned that it would be looked up though. If this was a real attack and not just a demo for class, it would've been a better idea to fake the whois info.

I just posted the targets response when he found out. He was very gracious.

it's a redacted version of the full link.

It's an interesting time now. It used to frustrate me how I couldn't find an address with just the phone number - despite having a white pages that contained the info. I know this was buy design, for privacy. Now if you search for a number, your bound to get a hit for it, and can work out who it belongs to. I'm sure this will fail me one day, but it hasn't yet.

That's very true, but it was just a class project, and wouldn't have been the end of the world.

There's a great quote by Teller on that:

"You will be fooled by a trick if it involves more time, money and practice than you (or any other sane onlooker) would be willing to invest. My partner, Penn, and I once produced 500 live cockroaches from a top hat on the desk of talk-show host David Letterman. To prepare this took weeks. We hired an entomologist who provided slow-moving, camera-friendly cockroaches (the kind from under your stove don’t hang around for close-ups) and taught us to pick the bugs up without screaming like preadolescent girls. Then we built a secret compartment out of foam-core (one of the few materials cockroaches can’t cling to) and worked out a devious routine for sneaking the compartment into the hat. More trouble than the trick was worth? To you, probably. But not to magicians."

From: http://www.smithsonianmag.com/arts-culture/Teller-Reveals-Hi...

could you link me to where the original is?