Download as PDF, PPTX
![TrueSec
$ man 3 human
• People aren’t stupid (…well, only some :-])
• But they are…
• Kind
• Naive
• Trustful
• Voluntary
• Scared
11](https://image.slidesharecdn.com/keynote-se-140404152453-phpapp02/85/Because-we-are-just-humans-11-320.jpg)
Uploaded byXavier Mertens
Because we are just humans
This document discusses social engineering and how humans can be manipulated to gain access to information. It provides historical examples of social engineering attacks and explains that social engineering works because people are kind, naive, trusting and scared. The document outlines the social engineering process of identifying a target, determining the objective, and creating a plan to manipulate the target into divulging information. It argues that in today's digital world, people leave extensive online footprints that can be used against them in social engineering attacks.
More Related Content
Similar to Because we are just humans
![5G Explained! A High Level Overview [Introduction]](https://cdn.slidesharecdn.com/ss_thumbnails/5gexplainedahighleveloverview-260119165306-cc137a3e-thumbnail.jpg?width=640&height=640&fit=bounds)
Because we are just humans
- 1. Because We AreJust Humans EHB Keynote - April 2014 - Xavier Mertens
- 2. TrueSec $ whoami • XavierMertens (@xme) ! • Consultant @ day ! • Blogger, Hacker @ night ! • BruCON co-organizer 2
- 3.
- 4. TrueSec $ cat disclaimer.txt “Theopinions expressed in this presentation are those of the speaker and do not necessarily reflect those of past, present employers, partners or customers.” 4
- 5. TrueSec Agenda 5 • Introduction • Historicalexamples • Why and how? • In our digital world • Conclusion
- 6. TrueSec “Social What?” 6 “Social engineering(SE) is the use of techniques to manipulate people into performing actions or divulging confidential information, rather than by breaking in or using technical hacking techniques” ! OR ! “A fancier way of lying”
- 7. TrueSec Attackers Are Lazy! 7 Whymake it complicated?
- 8. TrueSec First in theanalog life 8 Vendors: “It’s the last one, hurry up!” ! Headhunters: “I’m Alice from Marketing, May I speak to Bob, please?” ! Kids: “May I go to this party?” ! … Women of course! (Maybe the wickests! ;-)
- 9. TrueSec Sand in thegears 9
- 10.
- 11. TrueSec $ man 3human • People aren’t stupid (…well, only some :-]) • But they are… • Kind • Naive • Trustful • Voluntary • Scared 11
- 12.
- 13. TrueSec Agenda 13 • Introduction • Historicalexamples • Why and how? • In our digital world • Conclusion
- 14.
- 15.
- 16.
- 17.
- 18. TrueSec Agenda 18 • Introduction • Historicalexamples • Why and how? • In our digital world • Conclusion
- 19.
- 20. TrueSec How? 20 … Sometimes beinga good guy, sometimes being evil!
- 21.
- 22. TrueSec A nice target •People know useful information (passwords, procedures, paths, phone numbers) • People have access to • Files • Papers • Badges 22
- 23. TrueSec A “Swiss ArmyKnife” • People can interact with systems or people • Download a file • Disconnect a system • Introduce to someone else • Send a mail or fax • Get personal info 23
- 24. TrueSec Attacks • Physical • Tailgating •Shoulder surfing • Trashing 24 • Technical • Phishing • XSS • Human DoS
- 25. TrueSec Our toolbox • Mail→ Easy, anonymous and free • Phone → Quick and direct access to the target • Fax → Don’t under estimate the power of a fax in 2014! • Snail mail → A stamp or nothing… 25
- 26. TrueSec Psychology • Fear • Credulity •Desire • Solidarity 26
- 27. TrueSec The Process • Thetarget • The objective • The plan 27
- 28. TrueSec The Target • People •Age, sex, social status, studies, … • Company • Open hours • Jargon • Procedures • “Names” 28
- 29. TrueSec The Objective • Whichinfo are we looking for? • Which questions to ask? • Cross-check 29
- 30. TrueSec The Plan • Writedown a scenario • Work below the radar • Reminders, lexique, … • Path • “B” Plan! 30
- 31. TrueSec TrainYourself • Challenge yourfriends! • It’s a game! 31
- 32. TrueSec Agenda 32 • Introduction • Historicalexamples • Why and how? • In our digital world • Conclusion
- 33. TrueSec A fact… 33 “We locatedthe problem: It is located between the keyboard and the chair”
- 34. TrueSec Pwn3d! 34 This is amass-pwnage device!
- 35. TrueSec The new OSI-model 35 Layer1 - 6 Layer 7 Layer 8 (“user” or “political”) Over used Getting better defended Can’t be patched! ;-) (Source: @jaysonstreet)
- 36.
- 37. TrueSec Your Footprint • Inour modern life, we are 24x7 online • We like to share • We like to contribute • Want an example? 37
- 38.
- 39.
- 40.
- 41. TrueSec B.Van Rillaer 41 • bert.van.rillaer(at)ehb(dot)be •vanrillaer(at)gmail(dot)com • +32 2 559 15 xx • +32 486 33 xx xx • Study @ KUL 1999-2003 (License in Computer Science) • Clarinet player?
- 42. TrueSec B.Van Rillaer 42 • Twitter:@bvanrillaer • 72 followers, last tweet 22/03 • Tweet most between 11:00 - 17:00 • Tablet Acer A200 • Mobile Samsung Galaxy S3 (GT-I9300) • Active on G+, sell/buy on Kapaza
- 43.
- 44. TrueSec Classic IT requests •Could you give me the password? • Could you power on/off this device • Could you “put your idea here” 44
- 45.
- 46. TrueSec Interested? 46 • SET (https://www.trustedsec.com/ downloads/social-engineer-toolkit/) •Maltego (https://www.paterva.com/) • Your own toolbox!
- 47.
- 48.
- 49. TrueSec Conclusions 49 “You don’t knowwhat you can get away with until you try.” ! - Colin Powell
- 50. TrueSec Thank you! Moreinfo? @xme xavier@truesec.be http://blog.rootshell.be https://www.truesec.be 50