Confessions of a social engineer who ripped off world’s biggest tech companies

HE WAS able to quit school, travel the globe and earn hundreds of thousands of dollars from swindling some of the world’s largest tech companies. This is his story.

Actor Leonardo DiCaprio in scene from film 'Catch Me if you Can'. /Films/Titles/Catch/Me/If/You/Can

HE WAS able to quit school, travel the globe and earn hundreds of thousands of dollars — all from swindling some of the world’s largest tech companies.

What makes this more impressive is he did it with nothing more than a mobile and laptop computer.

As one of many hackers in the world preying on vulnerabilities in the human psyche, self-described social engineering expert Jonah* has opened up on the sinister world.

It is a world that security expert Professor Matthew Warren warns could be putting all Australians at risk.

The process, known as social engineering, involves hackers using human interaction to trick people into breaking normal security procedures.

And when done correctly, it can be very lucrative for those involved.

Jonah claims to have made a living stealing from home entertainment companies using the controversial technique.

As a teenager, Jonah’s room was filled with stacks of unopened packages that were the result of his well-orchestrated swindles.

Jonah said after researching social engineering on online forums, he was able to complete his first scam, which exploited a universally flawed warranty system.

“All the big companies — Apple, Microsoft, Razor, HP, Sony, Phillips, Casio, Rolex, Samsung — they’re all vulnerable to warranty exploitation,” he told The Kernel.

Jonah would got to Wal-Mart and steal the barcode numbers on TVs, computers and other electrical goods.

Jonah would call customer service reps and read out a script to convince them to send him a “replacement” for a device he did not own.

“The problem is pretty big,” he said.

“It costs nothing to provide no security, so the companies just ignore it.”

After seeing he could cheat the system in a matter of minutes, Jonah continued to run his scams without a hitch.

He quit school and was had multiple products delivered to an empty house for sale in his neighbourhood.

Initially, he would collect the goods and sell them to buyers via ads he had placed on the internet.

However, Jonah quickly learnt he could diminish his risk by removing himself from the transaction completely.

He achieved this by having the companies send the “replacement” items directly to the buyers.

“I made thousands, money whenever I needed it,” he told The Kernel.

“I could social engineer anything. Anything I wanted.”

Jonah was now making hundreds of thousands of dollars ripping off some of the world’s biggest tech companies, all while working to improve his trade.

“There are hundreds of thousands of people doing this, but the way they do it is by following someone else’s guide,” he said.

“I started learning and putting my own ideas into it, my own twists on the companies and the exploits.”

By using his extensive maths and programming knowledge, Jonah was able discover a number of companies generated product serial codes by a static algorithms.

After cracking the formula, he created his own program to generate in-warranty serial numbers he could use to swindle goods.

Jonah said he also created his own phone script, which he updated regularly and kept confidential for his exclusive use.

“When you use the same trick over and over or too many other people get a hold of it, the technique becomes saturated,” he said.

With his shady deals earning him a small fortune, Jonah was able to travel the world, while still swindling companies out of money.

However, sometime on his travels he became paranoid someone he’d ripped off was hunting for him.

The fear eventually got too much for Jonah and he returned home and got rid of all the merchandise still lining his house.

“I was going to get caught eventually,” he said.

“You can’t get away with it forever.”

Today, Jonah works for a security research firm helping companies protect against the scams he used to run.

Prof Warren said while Jonah’s case pointed out how social engineering could affect companies, individuals were also at risk.

“It’s becoming worse because of the amount of information we share online without thinking of the consequences,” he told news.com.au.

“These social engineers are using a number of sources to gain access to your personal information so they can build a profile on you.

“They then use this profile to build a narrative to force you into a situation where they plan to exploit your kindness.”

Mr Warren’s advice for protecting yourself against social engineering is to apply common sense.

“If something seems off to you, that should be a fair indication to be extra cautious.”

* Name changed to protect identity