Kevin Mitnick was a famous hacker who was convicted of computer crimes and theft of intellectual property. He began hacking at age 12 and used social engineering to steal passwords from company systems. Social engineering involves manipulating people to gain access to information through deception. Mitnick advocates for security policies and personnel training to reduce the vulnerability of the human element, as social engineering is difficult to defend against through technical measures alone.

1. The Art of Deception

2. Kevin Mitnick
Famous Social Engineer Hacker
• Went to prison for hacking
• Became ethical hacker
"People are generally helpful, especially to
someone who is nice, knowledgeable or
insistent."

3. Kevin Mitnick
 Arrested and convicted on several counts of computer crime,
including hacking and theft of intellectual property

4. Kevin Mitnick
 Arrested and convicted on several counts of computer crime,
including hacking and theft of intellectual property
 Began at age 12 with faking punch cards for the bus system to
gain free rides and continued on to phone phreaking.

5. Kevin Mitnick
 Arrested and convicted on several counts of computer crime,
including hacking and theft of intellectual property
 Began at age 12 with faking punch cards for the bus system to
gain free rides and continued on to phone phreaking.
 Used social engineering to steal passwords to company systems.

6. Kevin Mitnick
 Arrested and convicted on several counts of computer crime,
including hacking and theft of intellectual property
 Began at age 12 with faking punch cards for the bus system to
gain free rides and continued on to phone phreaking.
 Used social engineering to steal passwords to company systems
 He still believes this is far easier to do, even today, than hacking
into a system.

7. Kevin Mitnick
 Arrested and convicted on several counts of computer crime,
including hacking and theft of intellectual property
 Began at age 12 with faking punch cards for the bus system to
gain free rides and continued on to phone phreaking.
 Used social engineering to steal passwords to company systems
 He still believes this is far easier to do, even today, than hacking
into a system.
 Since his release from prison, Kevin has started his own computer
security company and gives talks around the country about social
engineering and other security topics.

9. What is Social Engineering?

10. What is Social Engineering?
• Attacker uses human interaction to obtain or compromise
information

11. What is Social Engineering?
• Attacker uses human interaction to obtain or compromise
information
• Attacker my appear unassuming or respectable
o Pretend to be a new employee, repair man, etc.
o May even offer credentials

12. What is Social Engineering?
• Attacker uses human interaction to obtain or compromise
information
• Attacker my appear unassuming or respectable
o Pretend to be a new employee, repair man, etc.
o May even offer credentials
• By asking questions, the attacker may piece enough
information together to infiltrate a companies network
o May attempt to get information from many sources

13. Kevin Mitnick - Art of Deception:

14. Kevin Mitnick - Art of Deception:
• "People inherently want to be helpful and therefore are easily
duped"

15. Kevin Mitnick - Art of Deception:
• "People inherently want to be helpful and therefore are easily
duped"
• "They assume a level of trust in order to avoid conflict"

16. Kevin Mitnick - Art of Deception:
• "People inherently want to be helpful and therefore are easily
duped"
• "They assume a level of trust in order to avoid conflict"
• "It's all about gaining access to information that people think
is innocuous when it isn't"

17. Kevin Mitnick - Art of Deception:
• "People inherently want to be helpful and therefore are easily
duped"
• "They assume a level of trust in order to avoid conflict"
• "It's all about gaining access to information that people think
is innocuous when it isn't"
• Here a nice voice on the phone, we want to be helpful

18. Kevin Mitnick - Art of Deception:
• "People inherently want to be helpful and therefore are easily
duped"
• "They assume a level of trust in order to avoid conflict"
• "It's all about gaining access to information that people think
is innocuous when it isn't"
• Here a nice voice on the phone, we want to be helpful
• Social engineering cannot be blocked by technology alone

19. Examples of Social Engineering

20. Examples of Social Engineering
• Kevin Mitnick talks his way into central Telco office

21. Examples of Social Engineering
• Kevin Mitnick talks his way into central Telco office
o Tells guard he will get a new badge

22. Examples of Social Engineering
• Kevin Mitnick talks his way into central Telco office
o Tells guard he will get a new badge
o Pretend to work there, give manager name from another
branch

23. Examples of Social Engineering
• Kevin Mitnick talks his way into central Telco office
o Tells guard he will get a new badge
o Pretend to work there, give manager name from another
branch
o Fakes a phone conversation when caught

24. Examples of Social Engineering
• Kevin Mitnick talks his way into central Telco office
o Tells guard he will get a new badge
o Pretend to work there, give manager name from another
branch
o Fakes a phone conversation when caught
• Free food at McDonalds

25. Examples of Social Engineering
• Kevin Mitnick talks his way into central Telco office
o Tells guard he will get a new badge
o Pretend to work there, give manager name from another
branch
o Fakes a phone conversation when caught
• Free food at McDonalds

26. Live Example

27. Live Example
• Convinced friend that I would help fix their
computer

28. Live Example
• Convinced friend that I would help fix their
computer
• People inherently want to trust and will believe
someone when they want to be helpful

29. Live Example
• Convinced friend that I would help fix their
computer
• People inherently want to trust and will believe
someone when they want to be helpful
• Fixed minor problems on the computer and
secretly installed remote control software

30. Live Example
• Convinced friend that I would help fix their
computer
• People inherently want to trust and will believe
someone when they want to be helpful
• Fixed minor problems on the computer and
secretly installed remote control software
• Now I have total access to their computer through
ultravnc viewer

31. Weakest Link?

32. Weakest Link?
• No matter how strong your:
o Firewalls
o Intrusion Detection Systems
o Cryptography
o Anti-virus software

33. Weakest Link?
• No matter how strong your:
o Firewalls
o Intrusion Detection Systems
o Cryptography
o Anti-virus software
• You are the weakest link in computer security!
o People are more vulnerable than computers

34. Weakest Link?
• No matter how strong your:
o Firewalls
o Intrusion Detection Systems
o Cryptography
o Anti-virus software
• You are the weakest link in computer security!
o People are more vulnerable than computers
• "The weakest link in the security chain is the
human element" -Kevin Mitnick

35. Conclusion
 Social Engineering will always exist, and it is
extremely difficult to defend against, but the
success of such attacks can be decreased
substantially with proper policy and personnel
training

36. Policy from a Social Engineer
“The Art of Deception” – K. Mitnick

37. Policy from a Social Engineer
“The Art of Deception” – K. Mitnick
Kevin Mitnick outlines an excellent security policy at
the end of the book with detailed reasoning at every
level to defend against Social Engineering Attacks.

38. Policy from a Social Engineer
“The Art of Deception” – K. Mitnick
Kevin Mitnick outlines an excellent security policy at
the end of the book with detailed reasoning at every
level to defend against Social Engineering Attacks.
This book teaches you the tricks of deception so that
you can learn how to protect against them.

39. Policy from a Social Engineer
“The Art of Deception” – K. Mitnick
Kevin Mitnick outlines an excellent security policy at
the end of the book with detailed reasoning at every
level to defend against Social Engineering Attacks.
This book teaches you the tricks of deception so that
you can learn how to protect against them.
This is a must read for all security professionals.

40. Questions?