21
The other day I was at a friend's. She was house-sitting, and we were going to watch TV on the owner's very nice home entertainment system (DirectTV, many components, etc). However, when we turned the television on, the screen was grey. I immediately started pressing buttons on the DirectTV remote to no avail. Then I went to the TV remote, went into video settings, and tried every video channel, made sure it was on channel 3, turned it on, off, on, off, etc. Now the settings were no longer the same, I didn't write the previous settings down, and the TV was still not working. Although extremely frustrated, before giving in to the oddly strong urge to start unplugging cables, I took a deep breath and, using what I've learned from my many years of debugging experience, worked my way through the flow chart in my head of how the system worked. In less than 30 seconds, I realized that the DirectTV receiver wasn't on, fixed the video settings, and had channels that I had never even heard of before at my disposal.
I may not know much, but I do know technology. And I know how to efficiently debug systems. I don't have a very well connected entertainment system, but I've worked with pretty advanced audio setups. The problem was, however, that I've never had DirectTV, and I gave in to the cultured response of flailing about without direction when technology appears to be broken.
Now, think about what people who have very little experience with technology would do in this situation. Think about what people do when their computer freezes: they press a bunch of buttons, move the mouse incessantly, tap on the monitor, etc. Or what happens when they take a computer to a repair center and hear that they have a virus: they buy everything the repair person is willing to sell them, from virus-protection to firewall software to the new, "clean" $300 hard-drive to giving up completely and buying a new computer (I've heard this more than once)!
In the latter example, people are probably getting ripped off, but it's not really a "crime". However, modern criminals can use the broken technology response to their benefit. This is an example of social-hacking at it's finest: everyone "knows" not to give out their pin, but immediately when confronted with the "broken technology", their common sense goes into the fetal position.
There was a study performed in London in 2004, at an information security trade show, where 70% of people revealed computer passwords when bribed with a chocolate bar, 34% of which needed no bribe at all. 79% gave away information that could be used to steal one's identity. If people are so lax with this sort of information at the promise of chocolate, just imagine the kind of damage a smart criminal could do by exploiting the broken technology response, especially in today's world of open wireless networks.
Here's a simple example:
If you go to type in your password, and after typing the first character, you don't see any indication that a password is being typed (*s perhaps), don't continue typing the password. Type some other characters, move the mouse, see if the computer is frozen, etc. In high school, ten years ago now, someone I knew *ahem* would mess with his friend by taking two computers (in a lab), and swapping their keyboard inputs. One computer was opened to notepad, and the other was sitting at the login prompt with the username of the victim already typed. Then, when the victim would sit down, they would either start typing their password (as the password prompt was already selected), or mouse to it, and type their password. That keyboard would be typing to the other computer (where the keystrokes were being collected into notepad), and the victim would think his computer wasn't working. The victim of course would give in to the broken technology response, sometimes repeating the password, sometimes just banging on the keyboard, etc., instead of checking the keyboard connection like he should have done. The other guy would then come around, and say, "Hey, is something wrong" and proceed to "check the keyboard connection", correcting the crossed cables, and magically making the keyboard work again. "Oh, the keyboard was loose."
In that example, the worst that ever happened with the password was an embarrassing mp3 being played as a Startup Item, but you get the picture. Fortunately, as children are growing up with technology, we might assume that they're learning how to fix things at an early age, and that the broken technology response might not be so strong in the next generation. However, I have a feeling that no matter how far into the future we imagine, there will always be an ample audience for the smart social hacker to exploit. Now, will you lose your identity because you pressed every button on the remote when the satellite isn't working? No, probably not. But we need to be aware that this response exists and that it can be taken advantage of under the right circumstances.