For this particular scheme, a woman was hired by the security company to call sales representatives at the client's company and pretend to be interested in buying its product. Part of the conversation went something like this:Social engineer:"My kids will love this product. I have a two-year-old named Fred and an eight-year old named Beth. Do you have any kids?"User:" Yes, I have a four-year-old son named Shawn."This is seemingly innocent chitchat, but in organizations that don't enforce a strict password policy employees often use their kid's name as password. In this particular case, the employee had one son named Shawn, which was the employee's password. Of course, that was a lucky guess, but the security company's social engineer was able to worm other personal information out of the employee as well. 這個特別的計劃,一個女人就被保安公司打電話給銷售代表在客戶的公司,假裝有興趣購買其產(chǎn)品。對話的一部分就像這樣: 社會工程師說:“我的孩子們會喜歡這種產(chǎn)品的。我有一個兩歲的名叫弗雷德和八年的老名叫貝絲。你有孩子嗎?” 用戶:“是的,我有一個四歲的兒子名叫肖恩。” 這看似無辜的閑聊,但在組織,不實行嚴格的密碼政策雇員經(jīng)常使用他們的孩子的名字作為密碼。在這個特殊的情況下,員工有一個兒子、名叫尚偉,員工的密碼。當然,這是一個僥幸的猜測,但安全公司的社會工程師能夠蠕蟲其它個人信息的員工。