Case Study: Titanic 2 - The SurfaceLink: http://www.youtube.com/watch?v=vD4OnHCRd_4&feature=fvst Quick facts: • A movie trailer that was and is so popular that many people still “swear” to have seen it if it had been made into a movie. • 8 months after launching the trailer, 100% people in comments believed it was “real” •2 years after it was launched, still 70 % people furiously believed that it was real deal and refused to accept it was a fake trailer. • It took the original author to accept the fact publically on 2010 by updating video on Youtube that it was indeed a fake “trailer”
Case Study: Analysis • Why the trailer became so popular? • Why did people refuse to accept the fact for so long that it was a fake trailer ? • What made people change their mind? • Why trailer is fake or not is still debatable among the “first time viewers” ? • Why makes people who know it is a fake trailer still want to see it again ?
Agenda for Social Engineering: • What is Social Engineering (SE) ? • Fundamental principals guiding the success of SE • Case Study Demonstration • Macro-expressions • Micro-expressions • Techniques used during Audit or SE Testing • Counter Measures for SE
What is Social Engineering? Act of influencing a person to take action that may or may not be in target’s interest. Good Social Engineers: Bad Social Engineers: Parents, Fraudsters, Doctors, Confidence tricksters Criminal Psychologists Malicious Insiders, Negotiators Espionage Agents, Salespersons Double-Agents, Diplomats Blackmailers, Whistle-blowers Human Traffickers, Magicians Terrorists
Fundamental principals guiding the success of SEReciprocation: We are hard-wired to respond to a favour, often not in direct proportion to the size of the favour done to us.Commitment and Consistency: Once we have made a choice or taken a stand, we will encounter personal and inter-personal pressures to behave consistently with that commitment.Social Proof: One means we use to determine what is correct is to find out what other people think is correct. The principle applies especially to the way we decide what constitutes correct behaviour. Liking: As a rule, we prefer to say yes to the requests of someone we know and likeAuthority: The real culprit is our inability to resist the psychological power wielded by the person in authority. Scarcity: The influence of the scarcity principle in determining the worth of an item.
Case Study: Reliance Canteen episodeObjective During our graduation days, we planned have food from the canteen without paying huge bills when our friend group grew large in size.The Opportunity Those days, Reliance had launched an offer that enabled you to talk free between 2 sims if you buy them. The SE Attack We gave the 2 sims to canteen serving boy for having him to talk “as much as he desires” to his village. We made an understanding that whenever our friend circle was visiting canteen, he will bring extra samosas or cold drinks without charging us extra on them. The Effect We used to get almost double the food for the price of few items or the half of the price. This went on un-noticed for 7-8 months.
Case Study: Analysis• Why did the plan work?• What could have caused failure of plan after 7-8 months? • What could have happened if we were caught earlier ?
Macro-expressions / Body languageMacro-expression / Body language is a form of mental and physical ability of humannon-verbal communication, which consists of body posture, gestures, facial expressions,and eye movements. Humans send and interpret such signals almost entirelysubconsciously.Communication consists of : • 7% of what we say • 38% vocal(tone, accent, dialect) • 55% Non VerbalNon Verbal behaviour is depicted fundamentally by some body parts and howthey act: • Feet/Legs (Most Accurate) • Torso • Hands • Neck • Mouth • Face (Least Accurate)
Micro-expressionsA micro-expression is a brief, involuntary facial expression shown on the face of humansaccording to emotions experienced. Characteristics of micro-expressions: • They are very brief in duration, lasting only 1/25 to 1/15 of a second. • Highly Accurate in depicting the "actual" thought of the person. • Almost involuntary reflexes barely felt by the subject • Express the seven universal emotions: disgust, anger, fear, sadness, happiness, surprise, and contempt • It is difficult to hide micro-expression reactions
Techniques for controlling Micro & Macro expressions If you are stuck during conducting a social engineering exercise, the following tips might help for successfully carrying out testing: • On confronting an anti social or angry person; frown a bit and tilt your head by relaxing your shoulders. This indicates you are interested to hear him/her out and are not confronting directly. • Enter with a sad expression, the subject will involuntary feel sympathetic for you and will offer to help in most cases. • A friendly and warm reception always has higher chances of information retrieval than a rash or unfriendly behavior • Do everything in confidence even you know you are trapped. • Dress up nicely and walk in short sure steps. It gives an impression of authority and people are much likely to yield under this charismatic effect.
Counter Measures for Social Engineering Source: www.hackers5.com
Must Have Resources• Social Engineering: The Art of Human Hacking by Christopher Hadnagy• The Art of Deception: Controlling the Human Element of Security by Kevin Mitnick• Influence: The Psychology of Persuasion by Robert B. CialdiniLinks• Video: Nonverbal Human Hacking Derbycon 2012http://www.irongeek.com/i.php?page=videos/derbycon2/2-1-2-chris-hadnagy-nonverbal-human-hacking• Body Language – Expressions on Google Android App Store:https://play.google.com/store/apps/details?id=com.Mazuzu.ExpressionTraining&hl=en
Agenda for Jugaad: • Introduction to Jugaad • The Indian Advantage • Effects of Jugaad and Hacks • Examples of Jugaad • Can Jugaad change lives?
Introduction to Jugaad Clever, creative and smart manuovore or workarounds to get the job done often by multipurpose or removing non-essential parts of a given tool.Jugaad also frequently refers to: • An innovative fix or a simple work-around used for solutions that bend rules or conventional approach • A person who can solve a complicated issue. Basically Jugaad signifies creativity to make existing things work or to create new things with “meagre" resources.
The Indian Advantage • Large educated population • Unemployment issues • Young dynamic work force raring to think “out of the box” ideas • Popularity of the social networking tools spreads ideas faster • Strong family ties and relations helps nurturing social cause • Heavy political influence and the thirst for power / influence • Competitive spirit due to large educated population Because of the above factors, India is uniquely positioned to take advantage of Jugaad and to play a pioneering role in it.
Effects of Jugaad• Increasingly being accepted as a management technique (in recession times )• Recognized worldwide as a form of frugal engineering pioneered in India.• A practice to reduce research and development costs by companies in IndiaJugaad and Hacks Similarity Both concepts express a need to do what needs to be done, without regard to what is conventionally supposed to be possible. Difference • An Indian pioneered concept vs a western intellectual term for applied innovation to get things done when required. • A jugaad can be thought of more as a survival tactic, whereas a hack is used in context of intellectual form.
Examples of Jugaad / HacksPopular examples • What an idea, Sirji !! (idea Cellular Ad concepts) • “Lassi” churners used in washing machines • Bisleri 600 ml lead shot filled bottle used as dumbels • Disha maidan purpose bisleri half cut bottle In Movies • “Ergo” film concept diagrams for convincing airport security Iranian officers • “Lord of War” flag sideway swap (from France to Dutch) • “Catch me if you can” various fraud scenes Personal Jugaad(s) • Hotmail Junk Filter manipulation to keep account activated • Cassette player song transfer to MP3 files • Admission form of UCER, UCEM • 8 marks increase by changing - to + signs in maths paper Personal hacks • Hutch multiple group mail at same rate (security misconfiguration) • BSNL UP(W) range swap to UP(E) • Telephone line detector to notify the free Internet line availability
Examples of Jugaad / HacksCommercially Accepted Jugaad(s)• Tata Nano• Jaipur Foot• Aakash Tablet & Simputer• Radio Tuk Tuk (Gurgaon)• EcoCabs (Punjab)• Android, iOS, Windows Apps for locating restaurants & text translators by camera scan,• Cooperative bank working (for vegetable, fish vendors)• QR code scanner for buying grocery (South Korea)
Can a Jugaad change a life ? Sudha Chandran Jaipur FootSudha Chandran, an Indian actress and dancer, lost her limb in an accident in 1982.She subsequently overcame her disability with the help of a prosthetic Jaipur foot, becomingone of the most highly acclaimed dancers of the Indian subcontinent.Soon after she garnered fame and recognition by venturing into the world of films andtelevision notable being “Kaahin Kissii Roz”, with her character of Ramola Sikand.