Social engineering
- Social engineering
- How to get what you want.
- Phishing and Social Media
Social Engineering
§
§
§
§
§
§
§
§
Psychological manipulation
Espionage
Confidence trick (con)
Scam
Swindle
Fraud
Lie
“Using cheap dirty psychological tricks to get
people to do what you want.” - Brian Brushwood
WARNING!
§
§
§
§
§
Pseudoscience and BS abounds in SE literature
Neurolinguistic programming (NLP) - BS
Using “microexpressions” - BS
“Pick up artist” (PUA) – BS
This stuff becomes very illegal very fast
Illusion of Transparency
§
§
§
§
§
Cognitive bias
Overestimate what people can tell about our
thoughts
Overestimate what we know about other
people’s thoughts
Dr. Elizabeth Newton tapping out songs
It’s easier to lie than you think it is
Information Gathering
§
Like any exploit, start with info on target
Information Gathering (Go deeper!)
§
§
§
§
§
§
§
§
Employee social media
Public records data
Maps
Local newspapers
Technical documents, academic papers
Training documents
Dumpster diving
http://inteltechniques.com/links.html
Elicitation
§
Getting a target to do what you want them to do
HOW TO GET WHAT YOU WANT
Slide 9
Just Ask For It
§
§
§
§
§
§
Dr. Ellen Langer at Harvard
The mindlessness of ostensibly thoughtful action: The role
of “placebic” information in interpersonal interaction
“Excuse me, I have 5 pages. May I use the Xerox
machine?” 60% compliance
“Excuse me, I have 5 pages. May I use the Xerox machine,
because I’m in a rush?” 94% compliance
“Excuse me, I have 5 pages. May I use the Xerox machine,
because I have to make some copies?” 93% compliance
Get comfortable making people uncomfortable
Pretexting
§
§
Use an invented scenario and/or identity
Impersonate
§ coworkers
§ boss
§ customers
§ law enforcement
§ IT department
Get It Wrong
§
§
“You guys use extension 5231, right?”
“No, we use 1212.”
Make Them Like You
§
§
§
§
§
§
Make them laugh
Let them to talk about themselves
Call them back
Elicit sympathy
Use the Ben Franklin effect, “Can you do me a favor?”
If not liked, at least seem transparent
Reciprocity
§
§
§
§
§
§
Give a gift
Best if it doesn’t look like a bribe, time delay
Dr. Dennis Regan of Cornell
Effects of a favor and liking on compliance
Subjects who got soda bought twice as many raffle tickets
Even if they reported disliking the assistant
Distraction
§
§
§
Misdirection
Multitasking is an illusion
Make them process information so they go on autopilot
Authority
§
§
§
§
§
§
Business card
Credential badges work
Internal lingo
Fake IDs/Badges
Send a legal or policy document
Or … just wear a suit
Ask Questions
§
§
Drive the conversation
Appear to be the receiver when you’re actually the
feeder
Tailgating/Piggybacking
§
Follow someone with access
Social engineering is an indirect process
§
§
§
§
§
§
§
§
Use elicitation to get an employee ID number
to pretext as a company employee
to gain information about management structure
to pretext as an authority in the company
to gain access to internal IT training documents
to pretext as technical support
to elicit access to an HR document
just to learn who knows the information you need about
your real target
Combined Attacks
§
§
§
§
§
§
The real threat: combine social and technical exploits
Spoof caller ID for elicitation
Use SE to clone SIM card to bypass 2FA
Hack a machine, “fix it”, then ask for information
Tell them you are IT, give them your number to call
Phishing/Vishing/Smishing
Baiting
§
§
§
Drop physical media with malware in parking lot
Tailor a personal gift
”Leak” documents
Social Engineering Mitigation
§
§
§
§
§
§
Be skeptical
Ask for call back numbers
Make sure employees understand sensitivity of data
Have explicit, clear security policies
Encourage employees to challenge authority and
requests
Audit employees by social engineering
your own organization
Phishing, Social Engineering, and
Social Media
What is Phishing?
• Phishing is a type of cyberattack which involves contacting
someone through email, phone, websites, or text message.
• The victim is then asked to click or do something that the
attacker wants, such as:
• Clicking a link
• Opening a document
• Sending money
Personal Account Phishing
• When you get a phishing email on a personal email, or your
personal phone, there are a few things it could be after:
• Money or financial information.
• Personal information.
• Account information.
• They are often widespread attacks after smaller amounts of
money or passwords.
Identify Phishing
• Look at the source of the email or text message.
• These two emails look similar:
• donotreply@mohawkcollege.ca
• donotreply@mohawkcollege.ca.scm.com
• Only the first email would be from Mohawk College, while
the other is from scm.com.
Social Engineering (1 of 2)
• This is a technique used to manipulate people into giving up
information or access through human error.
• It can be done on a computer through means such as phishing
or off a computer with methods such as spam phone calls.
• Criminals use Social Engineering to gain access to sensitive
information.
Social Engineering (2 of 2)
• Criminals will often claim to be someone who should have
access, without being checked for proper authorization.
• Social media websites are often filled with alleged games or
quizzes that will not allow a user to “play” them until they
authorize giving access to personal information.
Examples of Social Engineering (1/2)
• Quizzes and games trying to elicit personal information.
• “Want to find out your superhero name? The first half
corresponds with your birth day and the second half
corresponds with your birth month”.
• “Enter your first crush, full name, mother’s name, home
city…. Tag 10 of your friends”.
Examples of Social Engineering (2/2)
How Social Engineering Impacts
Social Media (1/2)
• Social media networks contain a ton of information about
users and have wide user bases.
• Everyone who uses any social media service has information
about them, potentially including:
• Email addresses, phone numbers, photographs, ages,
birthdays, friends/followers, geographical locations.
How Social Engineering Impacts
Social Media (2/2)
• Some may not be aware of what they are sharing, who they are
sharing it with, or how the information could be used against
them.
• By default, social media platforms have very minimal security
and privacy settings enabled.
• Most platforms do not tell you who is looking at your profile
or what they are accessing on it.
Tips to Avoid Social Engineering (1/2)
• Don’t share personal information.
• Even if it seems unimportant. Your dog’s name,
hometown or favourite movie; these are common
security questions.
• If you get a suspicious message or see a suspicious post from
someone you know, do not click it. Verify they sent it using
an alternative contact method.
Tips to Avoid Social Engineering (2/2)
• Be careful with the applications you install on your devices and social
media platforms.
• Avoid putting financial information on social media.
• Do not post anything online that you would not be okay with anyone in the
world seeing.
• Edit your security and privacy settings.
• See our Improve Social Media Security module for more detailed
information.
Stalking and Cyberbullying
• Previous coworkers, friends, partners, and random people and groups
can use social media to find out information about you and find your
location.
• Your personal information could be used to bully, harass or threaten
you.
• Social media can provide stalkers with a ton of information including
your location, common places you go, your network, and how to get a
hold of you.
0
