[48: Sadistic]
So, what have I been doing this summer? To be honest, I've been a shut-in. Since no one was kidnapped in the forest, there's no need for some big rescue operation or All Might having to retire, so there's not much stuff to do besides vacation stuff and train. And I've already trained to the point of boredom. Like, the only thing I can think of doing is somehow summoning a giant warship like the shipgirls in Azur Lane do. I wonder what that would look like? A massive super battle-carrier hybrid thing mix. Where would I even use such a thing, let alone dock it? That thing would only be useful at sea or in an operation where naval ships have to be used.
It'd be super cool, but…man, it's not really practical when I can already do all that stuff. Like, precision railgun strike at a target? Done that already. Drone strike? Not done, but it's really easy. An airstrike? Again, really easy to do. Any kind of aerial warfare is easy. Information warfare? Well…I haven't been able to think of an opportunity for such a thing yet. Hacking is nowhere near as easy as movies make it out to be. Trust me on that one. There's no progress bar about breaking into a firewall. And definitely no sudden "I'm in" moments. You know what? Let me show you to really hack a system. And no, I'm not talking about the little thing I did early on with the drone when I first got here. That thing is still active, by the way.
What I am going to do is something called social engineering. Or what I call, "taking advantage of stupid people." Let me show you. In this dorm, there's a phone I can use to call people, whether it's staff, faculty, or other people. So, the first part is reconnaissance; you have to know your target. And since my target is a gullible member in this school, I can easily find that on public sources, or what is called Open Source Intelligence, or OSINT. Hmm… who's a good target that'd probably believe most things and still doesn't have the hang of stuff around here? Oh, I know.
Let's see. Since this is a faculty member, I can look up the necessary information on the school site. Ah hah, there we are. Toshinori Yagi. There's his picture, email, office number, job position, and phone number for the school. Yeah, there are already different ways to go about this attack I'm going to do and show you how to do. Let's go with a phone call.
So before we do this. I'm going to combine a few tactics and human vectors. The main attack is a variation of a phishing attack called "vishing." This is just a phishing attack done with voice or voicemail. The other ones are called "pretexting" and "impersonation." Pretexting is just making up a scenario to justify why I'm approaching someone, and impersonation is obvious; it's just pretending to be someone else, fake or real. The vectors I'm going for are authority and urgency. Let's put it to the test.
I picked up the phone and dialed the phone number for All Might. Let's do this.
The phone rang for a bit before it was picked up. "This is Toshinori. Who am I speaking with?"
I cleared my throat. "Hi, yes, my name is Sakura, and I'm calling from the IT department about something I'm seeing from my end about your computer." Yeah, "Sakura." Very normal and original.
"Is something wrong? I didn't click on anything bad, did I?" Perfect, I could hear a bit of nervousness already. And if he's that nervous already, this guy would probably fall for a Prince of Nigeria email scam. Nah, he can't be that bad with technology.
"No, no, you didn't click on anything wrong. If you did, you'd probably be having an in-person conversation with my boss." I laughed a little to lighten the mood. "It's just a little thing. I want to tell you that we're working on new changes and updates to the system for the upcoming semester. Because of the recent string of attacks on the school, we're implementing new security measures to hopefully make sure an attack like the one on the USJ doesn't happen again, where we lost communications." I think that one was good. It'll play on his heroic and justice stuff, or whatever.
"Oh, I see. So, is there anything I need to do from here?"
"Not really, I'm just letting you know, so it doesn't interrupt any work you're doing, and to also confirm if the new system works properly as intended." What I said should be a red flag. Any competent IT department or security professional should've already tested things using a method called "sandboxing." It means testing out new stuff in an environment away from the main system, so it doesn't interrupt normal operations, especially when I say something like making changes to a system.
"I see. Will you do the thing where you take over my mouse and screen?"
"Yes, that's right. Just give me a moment, don't hang up." A few seconds of silence and pretending later. "Just hold on." I pretended to type. "Oh no." There, the bait. He'll hear me in trouble and…
"Is everything okay? Are you having an issue?" There it is. I can feel his desire to help even from the phone.
I put on a nervous and anxious voice, "Just a little one. I'm having trouble getting access to your computer."
"It shouldn't be too hard, right?"
I put on a more anxious tone to it. And did some more pretexting. "I'm still learning this stuff. I'm a new hire here at the school for the summer, and these new updates and changes are giving me experience, but it also makes me nervous to mess up. I don't want to look bad in front of my boss."
"Ah, I see. That's a common feeling, young lady. You're not alone in it, especially for a new job."
"Thank you. This nervousness makes me forget a few things I thought were supposed to be simple. Like, right now. I'm trying to get access to push the new changes, but I can't get access to your account; the username and password I'm trying to use that is stored on the systems here seem to be outdated." Another red flag, and probably the biggest. I can't explain how much of a red flag I just gave him.
"Do you need my password for this?"
Oh, come on, man. No! What are you doing‽ All Might, stop it! No! "Yes, I do. It's strange, if you changed your password, it should've automatically updated and been accessible from my end. I think the new changes and updates might have caused a few bugs."
"Oh, well, I can give it to you, and the little code that gets sent to my phone as well. It's…"
And there it is. I just successfully got the username and password of a faculty member of this school. And here I was saying that hacking isn't as easy as depicted in the movies. Come on, All Might, you should've known better. Well, in his defence, I singled him out and took advantage of how he is as a person.
"Thank you so much!" And I hung up on the spot.
/\\//\\//\
(Faculty office)
"Hello? Hello?" Toshinori put the phone back. "Huh, that was a weird way to end the call, didn't she need me on the phone?"
"Hey, is everything okay, Toshinori?" One of the other faculty members asked him.
"I just got a call from someone in IT. Her name was Sakura. She said she was a new hire," Toshinori said.
"What? Sakura? I haven't heard of anyone named Sakura as a new hire in the IT department. I know some people there, and they would've said something."
Toshinori had a bad feeling. "Uh…I told her my password to my computer."
"Okay, we need to talk to IT now."
/\\//\\//\
I dialed Nezu after
"This is principal Nezu. Who is this?"
"Hey, Nezu! What's up‽ It's me Eleanor. So, I'm calling you because you may or may not be receiving a call or some kind of notification from Toshinori, one of the faculty here, or from someone in the IT department."
"Eleanor…what did you do?"
"I may, or may have not, conducted a penetration test on your school by using a social engineering attack known as vishing and combining other tactics and principles of social engineering attacks to obtain access to one of the faculty accounts. And it may, or may not have been done in a short amount of time, which would be concerning."
There was a bit of silence. You know, I may have been using a phone in the school system, and if that was a concern of mine, I would've done a bunch of extra stuff like spoofing and whatnot. But this could've been done using any phone.
"Eleanor…can you come to my office, so we can discuss this in person?"
"I'm not in trouble, am I?"
"More like…I'm giving you an opportunity."
"Alright, that's good for me. I'll head on over."
/\\//\\//\
(Nezu's Office)
"Eleanor, how do you feel about working in our IT department?" Nezu asked Eleanor.
"You serious?"
After Eleanor went to Nezu's office, she was half-expecting to be in trouble. But this was something unexpected for her.
"You want me to work in IT for the school? Seriously?"
Nezu was looking at his computer at some of the logs sent by the IT department. "Yes. If what I'm seeing here is right, and it is, then what you did was a bit too good for someone who is supposed to be a regular student of the school. And you are right, you achieved access to a faculty account in too little time."
"Will I get paid more? And is this a permanent thing, or just for the summer? I still have the thing with Recovery Girl."
"It'll just be a part-time thing. Actually, we'll frame it as an on-hands summer class experience, and the pay you'll receive will be a part of the money you get as part of being an exchange student."
"I like how you think, Nezu. Yeah, I'll do it for this summer."
"Alright, I'll set everything up."
Just as Eleanor was about to leave, Nezu told her something else. "Eleanor, just a heads up, your class will most likely take the provisional hero license exam in the upcoming semester. Personally, while I wouldn't have it done this early, there are concerns about needing to further prepare our students for their paths as heroes. And given the attacks that have happened, despite no student being taken, your class still has experience fighting villains hardly anyone gets so early on."
"So…are we, or are we not?"
"I don't think it's something that has to be necessary or forced upon you. I think it'd be fair to let your class choose if they want to do it."
"You know everyone would probably still do it, right?"
"I have no doubt they will."
"Yeah, me neither. See ya, Nezu." Eleanor left the office.
/\\//\\//\
The Provisional Hero License Exam. I thought this was Japan, not England. I could stab someone on England and I could just be like "Oh, don't worry mate, I got me stabbin' loicense here." Or whatever.
Why in the world do I need a license to help out in a disaster‽ If there's an earthquake or tsunami, and we all know Japan gets a lot of those, I'd get in trouble for using my quirk to assist‽ Make the make sense. I could save 100 people, and I'd get in the most trouble. I almost had to laugh at this. Am I expected to just stand by while I watch someone suffer and struggle when I can easily help them or take decisive and instant action? Is that what this stupid license is implying?
Screw that. I'll go along. For now, that is.