The backbone of social engineering
is being able to trick a user into doing something for you.
So the question is what really motivates a user
to fall for your tricks?
Well, that is what this lesson is all about.
And we're going to cover the
six different methods of influence
that you can use as a penetration tester to get people
to trust you and to do what you want them to do.
This includes things like authority, urgency, social proof,
scarcity, likeness, and fear.
First, we have authority.
Now people are much more willing to comply
and do what you tell them to do if they think it's coming
from somebody who's in the position of authority.
So pretending to be the boss, the boss's boss,
or some other high level manager
could get some lower level employee
to do what you need them to do.
You might also pretend to be from an important client
or potential client to get somebody to do what you want.
Other things that work well are trying to pretend
that you're a government agency.
I get voicemails all the time from scammers
who are pretending to be the IRS saying,
"If you don't call us back in the next 24 hours,
we're going to come and arrest you."
That's using the governmental authority
and that governmental agency's position to try
to get me to do what they want.
Now, realize that the IRS never really calls
and leaves you a voicemail that way, so we know right away
that's a scam attempt,
but it is a form of social engineering.
Another thing that tends to work really well
is phishing emails that come from something like a bank
or financial institution.
Why?
Because they're in a position of authority
and they control your money.
You might get an email
that says, "Your account has been hacked.
Click here to reset your password."
And then when you click it,
you're actually letting the bad guy into your system.
All of that is using the authority of somebody in power,
whether that's somebody who's a boss in your company,
an important client, a governmental agency,
or a financial institution.
All of that are going to be things
that fall into this authority category.
The next one we have is called urgency.
Now, urgency is all about the fact
that people know we're in a rush most of the time.
We are all so busy these days
and people want to help each other out by nature.
That is human nature.
That's what we want to do.
So if I'm walking up
and you're going to hold the door open for me,
that's being nice, right?
Well, if somebody's busy and their hands are all full,
you want to help them get through quickly,
and that is the idea here with urgency.
I've seen urgency work really well,
especially when you're doing in-person social engineering.
For example, I might walk up to an employee in the hall
and say, "I'm running late for this meeting.
I really need to get this printed out.
I couldn't print it out.
Can you print it out for me?"
And hand them a thumb drive.
Maybe they're going to take that thumb drive
and go print out that PowerPoint for me.
Now, on that thumb drive is a bunch of malware,
and they don't know that, but I'm using urgency to get them
to bypass the normal security procedures
and do this thing for me right now.
That's the idea with urgency.
If I call up the help desk and I say, "Hey, this is John
and my account's locked out, I really need you
to reset my password right now,"
and the person at the help desk says, "No, I can't do that.
You've got to come in and show me your ID.
That's company policy."
And I start going, "No, no, no, no, no.
I've got a meeting in three minutes.
I got to get this done.
The boss needs it.
Please help me out right now.
I really need your help."
They're forcing that sense of urgency and trying to tell you
that there's this upcoming deadline
and we have to take action right now,
and when people start rushing, people start making mistakes.
So that becomes a great motivation factor
that you can use in your social engineering attacks.
The next one we have is known as social proof.
Let's say I put up a website
and I was trying to do a watering hole attack
or something like that.
Now, if I did that and that website looked fake and scammy
and I was trying to phish people to get them to go there,
that's probably not going to be very effective.
But if I can get some social proof through either Facebook
or Twitter or Instagram
or something else to get people to start liking the site
and talking about the site and saying all the great things
that you can do at this site, that starts showing
that social proof and people are more likely to click on it
and follow in to go into that attack.
Now, people are always much more likely to click on things
that have more likes, shares,
and other friends that they see doing it.
This is the idea of social proof.
So, if I'm targeting a company
and I'm not able to trick their users, maybe I can go
after their second level connections, maybe their spouses
or their friends and get them to say,
"Hey, there's this awesome site.
You should go check it out."
And then when they do that, they're clicking the link
and they're now using that social proof against them,
and now I'm getting them to go to my site.
This is some of the things you can do
when you start using social proof as part of this.
Anytime you're trying to get people to crave,
to be a part of a social group,
or a social experience,
or a social interaction,
you can rely on social proof to get that done.
For example, I might create a Facebook group
and say, "Hey, join this Facebook group
and be a part of this thing."
And then I can start building trust with that person
and the other people in that group.
Maybe I create an affinity group that has to do
with something for people who used
to work at a particular company who's the focus
of my penetration test.
Well, if I can get people to come in there
and tell me all the bad things they hated
about this company,
I now can find ways to get into that building.
That's going to be things that I can use,
and again, social proof, getting more people in
that group is going to add additional value.
That's going to get more people to join that group
and becomes this perpetual growth thing that happens.
Have you ever seen social proof used against you?
Have you ever gotten one of those direct messages
on Facebook from one of your friends
and you're like, "Man, that is a scam?
Why did they even fall for that?"
Well, because of social proof!
They saw 10,000 other people
who liked that post or shared that post,
and so they did it, too.
Some of these things can be good,
some of these things can be bad, but either way,
there was social proof behind it that got built up
because so many people liked it.
For example, when you decided to buy this course,
you probably looked at the landing page
and you tried to decide: is this the course for you?
One of the things you may have looked
at was how many people were already enrolled in this course
and how many good reviews this course already had.
Now, if there were zero people in the course already,
you probably would not want to buy it
because you think, "Man, this is horrible."
But if you see there's a 100,000 people in this course,
you might go, "Wow, this course must be pretty good."
That is social proof and we use it in selling all the time,
but you can also use it in your penetration test.
The next technique we have is known as scarcity.
Now, scarcity is all about trying
to get people to act quick.
Now, this is often confused with urgency by a lot of people,
but it's a little bit different.
With urgency, you're really talking about the fact
that it needs to get done now because you're at a deadline,
but when you're dealing with scarcity,
there's only so much of something.
For example, I might create a phishing campaign
against my target organization
that is all about how people need
to sign up right now because supplies are limited.
There's only five spots left,
you've got to sign up right now if you want to be a part
of this webinar that's coming up.
Now, some people are going to act on that for fear
of missing out, so they're going to click on that link
and sign up. Or maybe I do something
that's a really good deal.
Hey, there's this $2,000 MacBook Pro computer,
but we're selling it for just 999 for the next 20 minutes.
You better click here because there's only three left.
All of that is the sense of urgency.
It's about how much is left of something.
That is the idea here.
Now, if I'm a bad guy, I might be trying
to collect your credit card information to be able
to charge you and take your money
and never give you that MacBook,
but in the case of a penetration tester,
I might be doing that
just trying to get your personal details.
Maybe, you're going to give me your email address,
which is the same as your login for your company's account,
or I make you create an account
to be able to buy this thing.
Now I have to have your email and a password,
and a lot of people do password reuse.
And so maybe the same password you're using
on your company computer too.
And so I can collect that now using this idea of scarcity.
The idea here with scarcity is you're trying to get somebody
to act really quickly
because there's a limited quantity of something.
With urgency, it's more about the time.
With scarcity, it's more about the quantity.
The next one we have is known as likeness.
Now, likeness is a term
that they use in your exam objectives,
but I personally like the term likability a lot better.
The idea is the same.
People want to interact and be with people
that they know, they like, and they trust.
Now, if you don't know somebody or trust them yet,
you at least want to like them.
And social engineers are some of the most friendly
and likable people that you will ever meet.
Most people who are old, crusty,
angry people just don't make good social engineers.
It doesn't happen that way.
You need people who are friendly.
You need people who are pretty.
You need people that people want to be around.
And that's the idea when you start dealing
with likability or likeness.
Now, one of the things that a lot
of pentesting teams do is they'll actually
include very attractive people on their team
and they make the best social engineers.
For example, in the old days, a lot of IT
and cybersecurity professionals were men,
and so a lot of pentesting teams would actually
have a very pretty woman on the team
that would then flirt with the men
to get their way and have them open the door for them,
be able to steal their badges,
and all sorts of other things like that.
That's the idea here with likability and likeness.
Now, remember, when it comes to likability,
it doesn't have to be sexual in nature.
It doesn't have to be based on attraction or looks.
It can also be based on finding a common interest.
For example, maybe you find out that
that person who's your target likes football.
Maybe as you're walking by their desk, you see some kind
of sports memorabilia for the Denver Broncos.
If you know about football, you can go up
and start talking to that person
about how you like the Denver Broncos too,
and that now creates a shared interest
that you can leverage into some way
to gain information from them or get them to like you more.
Now, for me, that wouldn't really work
because I really don't like football,
but I like video games,
and so maybe if I found somebody else who liked video games,
I could say, "Oh, you like to play X, Y, Z game as well.
Well, so do I.
Hey, I've got this great new skin
or bonus feature for your character.
Let me go ahead and email that over to you."
Now, I email them a file, they open it
because they want to be able to access that new skin,
or character, or whatever, and guess what?
I'm now in the system because I embedded malware into that.
That's the idea of using likability
and making that friendship
and then using that as a way to get in.
Now, again, this is going to depend on the scope
of your engagement
of which of these factors you're going to be able to use
and how you're going to be able to play them out.
Another one we have is known as fear.
Now, when we talk about fear,
it really is a great motivator if you properly use it.
In fact, ransomware authors are really good at using fear.
Oftentimes, you'll see something
that pops up on your screen.
It's a threat or a demand.
For example, you might see a popup
that says, "Your computer's been locked.
You've been found guilty of the FBI of piracy.
Click here to pay your fine of $200."
Now, if you go and click there,
they're going to actually take your money, right?
And if you don't click there,
no one's going to come and arrest you
because it really isn't the FBI.
This is a scam.
They're using fear,
or in ransomware, they're going to encrypt all your files
and hold that key for ransom until you pay up.
Again, this is something that's done in a fearful way.
So, remember your methods of influence.
There are six different ways to get people to do
what you want when you're doing a social engineering
or physical attack.
This includes authority, urgency, social proof, scarcity,
likeness or likability, and fear.
Now, in this lesson, I talked about each
of these factors individually,
but as a penetration tester, you might find it
to be more effective to combine multiple of these together.
For example, you might combine social proof, scarcity,
and urgency, and it might look something like this:
"Click on this email right now
because we only have three things left.
This is all going to be on sale for the next 30 minutes,
and we had 100 people who already bought."
Something like this combines all three
of these factors together,
and you'll see often that
when you combine things together like this,
they become more effective
than if you use them individually.