- In this lesson, we are going to look
at one of the most vulnerable threat vectors,
which is the human threat vector.
And in particular, we're gonna look at the impact
of social engineering.
Now social engineering, succinctly, is the action
of exploiting human nature, you and me, right,
rather than technical hacking techniques,
to gain access to mines, to systems, to data,
or to buildings.
Now social engineering is very often considered the path
of lease resistance.
If you're looking to get an answer,
if you're looking to get credentials,
if you're looking to get access
into maybe a data center or into a building,
social engineering is often the best way to do it.
Why?
Because we're exploiting human beings
and the best of human nature in many cases,
and because most of us are so busy just doing our job,
we're focused on whatever we're doing,
that we're not always cognizant
or paying attention or have our antenna up
to the fact that we're being social engineered.
Now a significant number of security incidents
and data breaches have started with
or have included a social engineering component.
I don't have any hard numbers, but you know,
if I said 98 or 99%
of all significant security incidents started
with social engineering,
and I had to prove that number, I bet I could.
I mean, it's just that pervasive.
So social engineering is a critical training topic
for everybody in your organization, not just, you know,
for folks on, you know, at the teller line
or on the factory floor.
Everybody up to and including your board of directors.
Let's look at social engineering tactics.
Social engineers,
and that's really just a very nice name we're giving
to our attackers,
so our social engineer attackers, use psychology
to take advantage of some basic human instincts
and responses.
Now, their two primary tactics are going
to be pretexting and impersonation.
Now, pretexts are fabricated scenarios.
Think of them as a story used to conceal the true purpose
of an activity.
Now pretexts generally include just enough truth
to make them appear plausible.
So let me give you an example.
So here in the US, April 15th, we have to file our taxes.
So let's say around May 1st, I get an email
or a phone call or a text saying they're from the IRS
and my taxes are late.
I'm like, no, I know I filed them.
It's like, uh-oh, maybe they didn't go through
or maybe there's a problem
or maybe the mail didn't make it.
So now, there's just enough truth, right?
I had to file my taxes.
Maybe they're not there.
I don't know if they're there or not
'cause I haven't gotten any confirmation.
So there's enough going on to make me start saying, okay,
I need to pay attention to this.
The second is impersonation,
which is just the act of pretending to be someone else.
Our social engineer can't say, "Hey I'm a bad guy,
"I'm the social engineer,"
so they have to be, right, take on the personality
of someone else, the IRS agent or FBI agent,
or, you know, your friend in the PTA,
but they need to pretend to be someone else.
Social engineering
really exploits our human cognition functions,
and that's one of the reasons why it is so hard
to get people to really, you know,
recognize that they're being social engineered.
And it's why social engineering simulations
are such a useful tool.
So what are the human cognition functions
that social engineers exploit?
Authority, trust, responsiveness, fear, urgency,
a threat, reward, and curiosity.
Let's talk through those.
We all have the instinct to respond to authority.
"This is your boss calling."
Or, you know, "This is chief so-and-so from," you know,
"X, Y, Z agency," right?
Start with authority and we're like, okay, yep.
We have that instinct to respond.
We have the tendency to trust.
It's human nature to be trusting.
We don't wanna walk around our whole lives saying,
"Oh I don't believe anything that person says,
"I don't believe anything that person says," right?
So we tend to trust.
Responsiveness, we all like to be responsive.
You ask me to do something,
our natural tendency is to be responsive,
to want to do whatever I'm being asked to do.
We have fear of doing the wrong thing.
Nobody likes to do the wrong thing,
nobody likes to be embarrassed,
nobody wants to get in trouble.
We have urgency, which is a need to act quickly.
If someone says, "This has to happen right away,"
boy, it causes some anxiety and angst and we're like,
"Okay, okay, I gotta do it.
"Gotta do it right away."
A threat, the threat of harm to oneself or to someone else,
our colleague or our family member, right,
that's enough to get us to take an action.
The promise of a reward, right?
Who doesn't wanna like, win the lottery,
or even get 10 bucks for filling out a survey?
How cool to get a reward.
And we're all innately curious, right?
We have the desire to be in the know.
We wanna know what's going on.
And particularly things that maybe we shouldn't even know,
like, I wonder what my boss makes.
So authority, trust, responsiveness, fear,
urgency, threat, reward, and curiosity.
And these are all our human cognition functions
that our social engineers know how to exploit.
So let's talk about some social engineering techniques.
First, remote ones,
meaning that the social engineer doesn't have
to physically be close to you at all.
Phishing, SMSishing, vishing and watering hole.
Now I know you're all familiar with phishing.
Phishing is pretexting an impersonation using email.
Now the origin of the term phishing really came
from like casting a wide net.
Spear phishing is targeting a specific group or individual,
and whaling is when we target a high profile individual,
like a CEO or a CFO.
S-M-S-ishing, or SMSishing,
is pretexting and impersonating using text.
Now this one's really interesting
because we tend to respond to text.
While pretty much we don't respond to phishing emails,
and a lot of our email programs are really good
at filtering those out,
when we get a text, when your phone buzzes
and you get a text, you pick it up, right?
And you look at it and you read it,
because text opposed to email still feels very personal,
right?
"If they're texting me, they must know me.
"I probably have to respond to it."
Then we have vishing.
Vishing is pretexting impersonation using voice,
someone calling you.
Now what's so interesting
with vishing now is that there's a whole host
of programs that I'll talk about in just a few moments
that allow voices to be changed,
male to female or female to be male,
to be given an accent, and to have background noises.
So phishing, SMSishing, and vishing,
all direct communication.
A watering hole describes the exploitation of a website
or a social media application
that is frequented by the target.
So let's say you're on LinkedIn a lot
or you're on Facebook a lot and you're the target.
Well, the social engineer is going to create a profile.
I'm going to maybe comment, you know,
on some of your publications,
maybe become friends with you, strike up a relationship,
maybe eventually send you a link or send you a picture,
and there you go.
Now we're down the path of social engineering.
Now social engineers may also decide to come right on site,
and we refer to that as local social engineering techniques.
Shoulder surfing is covert observation.
It used to really mean literally standing
over somebody's shoulders
so you can see what their typing, what their password is.
But now, it could be covert observation,
whether nearby or remote, right?
I could have, easily, right, a camera in a lapel pin
or I could have it in my notebook
or I could have it in a pen,
or I could just drop a little device, you know,
somewhere on a crezenda, and that's actually recording.
So shoulder surfing being covert observation.
Piggybacking, which is sometimes called tailgating,
is when an unauthorized person enters a checkpoint
close behind or in concert with authorized personnel.
So maybe you need to swipe a badge to get in.
So I'm the social engineer, I come in and I may be dressed
as a UPS driver and I'm carrying a heavy package,
and you're like, "Oh, let me open the door for you."
And there I go.
Or maybe I go out to where all the cigarette smokers are
and I make friends with the cigarette smokers,
we all complain about the fact that we can't smoke, right,
close in on the campus.
I'm not a smoker by the way.
And then we all kinda walk in
as this jovial, you know, cohesive group
and somebody opens the door and in we all go.
Dumpster diving is the act
of rummaging through trash, which sounds pretty disgusting,
and recycling in search of information.
And lastly, we have baiting.
And baiting is a really, really successful technique.
Baiting is the use of a gift, for example,
a USB drive, for infiltration.
So maybe you go to a trade show
and you get to pick up a USB drive,
and in fact, the USB drive has malware
or instructions to phone home.
I did a number
of social engineering simulations over my career,
and one of the most successful was when we sent bracelets.
So these kind of rubbery bracelets
that the clasp was actually a USB device,
and it had a little marketing name on it and said, you know,
isn't this a cool marketing tool?
You know, wanna see our whole catalog?
Just, you know, insert the USB.
And then it was just designed to phone home
so we knew that they had done it.
And it was incredibly, extraordinarily successful.
So baiting is a really good technique
that social engineers use.
Another set of techniques
that are really up and coming
are called synthetic content techniques.
And we're seeing these in the political arena
and we're seeing these in social engineering,
the use of disinformation, shallow fakes, and deep fakes.
Disinformation is false or misleading information
that is spread deliberately to deceive.
So in a social engineering scenario,
there would be some disinformation sort of spread
to set the groundwork.
Now there is a difference between disinformation
and misinformation.
Misinformation is when false
or misleading information is spread,
but it doesn't have the deception component, right?
It's not being done deliberately.
When we talk about disinformation,
we're talking about false or misleading information
that is spread deliberately to deceive.
And then we have shallow fakes and deep fakes.
Shallow fakes is the alteration
of media content using simple video editing software,
where deep fakes is the use of machine learning
and/or artificial intelligence to manipulate
or generate deceptive audio or video content.
And shallow fakes
and deep fakes really are starting to be used
in social engineering scenarios.
Matter of fact, back a couple years ago,
the FBI issued a private industry notification
about leveraging synthetic content with the headline
that malicious actors will, almost certainly,
will leverage synthetic content
for cyber and for foreign influence operations.
So what are some of the tools that our social engineers use?
Well, they may have a website,
create social profiles, have a phishing toolkit,
a phone spoofing service, an audio recorder, spy cams,
a programed USB, or even clothing and collateral,
a website to establish legitimacy,
so you say, "I wanna know more about them."
Oh, I go out to www dot whatever,
"Wow, they're right there."
Social profiles in social media, right,
in Facebook, in LinkedIn, in Instagram, right,
to establish trust and relationships.
A phishing toolkit,
if the social engineer wants to do a phishing attack,
they don't even have to know anything
about how to do it, right?
They can actually just go out to the dark web
and buy a phishing toolkit.
And that can be used to create, send,
and track phishing emails,
to gather information, and to destroy malware.
Phone spoofing services can be used to manipulate caller ID,
disguise a voice, turn a male voice into a female voice
or a female voice into a male voice
or add some accents, and change the surroundings.
It can sound like you're in a call center.
It can sound like you're on a busy street.
It can sound like you're out in nature
with some birds chirping in the background.
Often a social engineer will use an audio recorder
to record a conversation.
They'll use spy cams to capture live feeds,
or we can have these little cameras now in pins, pens,
notebooks in our glasses,
having programmed USBs to initiate commands on a device
or as a way to spread malware,
and to have clothing or collateral,
to really establish legitimacy and authorization.
So coming in dressed in a uniform, having a clipboard,
having the hat, having a work order, right?
All of those things can be used
to really establish legitimacy and authorization.
So let's just quickly go through the anatomy
of a social engineering attack.
The first thing the social engineer is gonna do
is establish their objective.
What are they trying to accomplish?
They will then determine the target.
Who are they going to go after?
They'll then do some reconnaissance.
Reconnaissance, sometimes called footprinting,
is gathering information about the target.
Maybe, you know, do they have children?
What social channels are they on, right?
Do they drive to work or take public transportation?
All of those type of things, are they a sports fan?
And if they are, what teams do they follow?
Wouldn't they love to get some free tickets?
So based on what they've learned, right,
they'll do the pretext development,
they'll create the auxiliary tools and collateral
that's needed, and then they'll launch their attack.
But generally, they'll launch it in a relatively small scale
to test it out to see how it's doing.
In the marketing world, they call it A/B testing.
Well, our social engineers really do the same thing.
They'll evaluate how well it's going,
they may revise it, and then ultimately,
they will be able to accomplish their exploit.
So how do we counteract social engineering?
The key
to counteracting social engineering is user awareness,
but not user awareness alone.
We have to support it by technical and physical controls.
So user awareness techniques include training
to recognize signs of manipulation
and participation in social engineering simulations.
Technical controls include email and attachment filtering,
browser security settings, sandboxing, and patch management.
And physical controls include surveillance, access controls,
and removable media controls.
One of the best ways to train our user community
to recognize social engineering is to do simulations.
Simulations are really social engineering attacks,
if you will, but it's social engineering for good, right?
We hire someone to do the social engineering
as a way to teach our users, you know,
what they might experience.
So they actually go through the process of experiencing it,
and then we can use those examples
in our training and provide feedback.
How did we do?
Did we do good?
Did we do bad?
Did we respond right?
What didn't we notice?
Now it's really important,
if you're gonna do a social engineering simulation,
that you get buy-in, right?
You get buy-in from your organization.
Yes, this is what we wanna do.
So how do you get buy-in?
Well, go right to the top, right?
Go up to the CEO or COO, go to the board of directors,
go as high as an organization as you can.
We're gonna start with briefing them
on the impact of social engineering,
why social engineering is so dangerous to our organization,
giving examples of like ransomware
or disclosure of information.
We can provide examples and statistics to them.
Include respected source materials.
If applicable, invoke some regulatory expectations.
And then you wanna assure them of confidentiality.
Because one of the roadblocks
of doing a simulation is people say,
"Oh, what if we don't do well?
"Who's gonna know about that?"
Or, "I don't wanna embarrass anybody."
So assure them of confidentiality and stress
that positive organizational improvement is really the goal,
opposed to disciplinary action.
We're not looking to embarrass anybody, right,
we're not looking to say, "Oh, you did that wrong,
"you know, it's gonna go on your record."
What we're really looking for
is positive organizational improvement.
And once you've done that, find a champion who says,
"Yes, we should do this,"
and then capitalize on the momentum.
Go and do your social engineering simulations,
and then have it followed up by really good training
and positive, positive feedback.
Doing that really can make a difference
in your organization.
All right, my friends,
that brings us to a 3-Second Challenge.
You know how to do it.
Let's go.
Tactics and techniques used to manipulate people
by deception.
One, two, three.
That's social engineering.
Question two, a fabricated scenario.
One, two, three.
That's pretexting.
Number three, false or misleading information
that is spread deliberately to deceive.
One, two, three.
Disinformation.
Number four, using machine learning and/or AI,
artificial intelligence,
to manipulate or generate deceptive audio or video content.
One, two, three.
That's a deep fake.
And lastly, exploiting a website
or social media application that is frequented
by the target.
One, two, three.
And that's a watering hole.
I hope you did well on those.
All right, let's do a Security-in-Action
on the social engineering assault.
A few days ago, a pop-up appeared
on your uncle's computer telling him
to call the Microsoft helpline immediately,
as his computer was infected
and being used to distribute child pornography.
He called the number display
and reached what sounded like a very,
very legitimate call center.
They told him that to clear up the issue,
he needed to upgrade his operating system at a minimal cost.
So he provided his bank account information
and followed the remote access instructions.
So my question to you is,
what social engineering psychology did the criminals employ?
Go ahead and put me on pause, read through that again,
and jot down, what social engineering psychology
did those criminals employ?
Well, let's talk through this human cognition exploit.
The tendency to trust, right?
It was Microsoft, he said, "Okay, it's Microsoft.
"I must trust them."
The need to act fast, right?
His machine has child pornography.
We gotta do something about that right away.
It's not legal, you can get in trouble.
There's urgency there.
The instinct to respond to authority,
again, he called the helpline.
The helpline, you know,
is someone who should know what they're talking about.
The fear of getting into trouble.
Oh my god, what if I find,
what if the police find I have child pornography, right?
Or I'm distributing child pornography on my system,
I could go to jail for years and years.
And the desire to be responsive, to do the right thing.
Of course I have to fix this problem.
Of course.
Yes, I'm willing to pay.
Let's make this happen.
Let's fix this situation.
So trust, urgency, authority,
fear, and responsiveness.
All of these were at play in this situation.
So being able to explain this,
to talk about this, to train your users
to have them engage in simulations
so they feel these different things
and understand how the social engineers
or how our attackers, our criminals, work,
that my friends, is definitely security in action.
There's your word cloud.
You know what to do.
When you're ready, we're gonna do a deep dive quiz.
See you there.