Recommended
More Related Content
Similar to Social engineering is bull, call it what it is
Similar to Social engineering is bull, call it what it is (20)
Recently uploaded
Recently uploaded (20)
Social engineering is bull, call it what it is
- 1. -surpherdave
- 2. Disclaimer • The information discussed are my views and opinions and mine alone. • Much like the title of this talk, citations are needed and provided at the end of this deck.
- 3. This talk may contain the following:
- 4. Drink if you hear or see:
- 5. About me
- 6. Talk introduction • Attempt to define “social engineer” • What we really mean when we hear the term “social engineer” • History of manipulation and deception • Persuasion techniques that work • Neuro Linguistic Programming
- 7. so·cial adjective ˈsō-shəl: relating to or involving activities in which people spend time talking to each other or doing enjoyable things with each other : liking to be with and talk to people : happy to be with people : of or relating to people or society in general Definition of “social” and “engineer”
- 8. Definition of “social” and “engineer” en·gi·neer noun ˌen-jə-ˈnir: a person who has scientific training and who designs and builds complicated products, machines, systems, or structures : a person who specializes in a branch of engineering : a person who runs or is in charge of an engine in an airplane, a ship, etc. : a person who runs a train
- 9. engineering noun (Concise Encyclopedia) Professional art of applying science to the optimum conversion of the resources of nature to the uses of humankind. Engineering is based principally on physics, chemistry, and mathematics and their extensions into materials science, solid and fluid mechanics, thermodynamics, transfer and rate processes, and systems analysis. A great body of special knowledge is associated with engineering; preparation for professional practice involves extensive training in the application of that knowledge. Definition of “social” and “engineer”
- 10. How does it happen in information security? • Phishing • Phone calls • Dumpster Diving • Doxxing • OSINT Call it what it is… manipulation
- 11. history of manipulation and deception • Adam and Eve • False weights • Clothing, make-up, smells
- 12. history of manipulation and deception • We are told to tell the truth at a young age, yet told to be polite, have manners, feign respect for elderly, refrain from telling someone their breath stinks, if you have nothing good to say about a person…it is mandatory in society to be deceptive as to our true feelings and nature • Santa Claus and Easter Bunny
- 13. techniques that work • Reciprocation • Golden rule • Hare Krishna • Street performers asking for donations • Free samples, instead of a person giving them samples invited them to take as much as they wanted • -olive bar in NYC • Failed reciprocity
- 14. techniques that work Commitment and consistency • Race track betters more likely to stand by their horse after they bet • Abused spouses • Sales of toys during Christmas are in short supply in order to keep sales going afterwards • Parents want to show children consistency
- 15. nlp Pacing and Matching • Similar to method acting • Matching another person’s body language and speech in order to build rapport • Not mirroring, rather integrate elements of their personality into your own • Bring vocabulary in line with the other person
- 16. nlp Mirroring • Behavioral Mirroring • Symbolic Mirroring • Exchanged matches • Not mirroring exactly, but substituting part of the body for another • Using hands to control breathing
- 17. nlp Building and Maintaining Rapport • Positive connection between you and another person or group • Conscious application not a gift • Use sensory acuity to find out about a persons disposition
- 18. speech • Pause or delay • Stress level of voice • Dry mouth can show anxiety or alarm • Accent • Not only where they are from, but also their vocabulary tells the educational level
- 19. body language Notice body changes for clues as to how to proceed • Stress levels can change in an instant, facial expressions, tension, rigid body language, withdrawing in apprehension • Look for signs of change in sympathetic nervous system • Pupil dilation, thinning lips
- 20. body language Calibration • Using sensory acuity to gauge the state the person is in, this allows you to understand more about their inner state • Once you understand their state, you cultivate the state in yourself
- 21. body language Posture • Adopt the other person’s stance or sitting position Movement • Gesturing, how fast or slow, how often, and how open or closed are the movements Breathing • Harder to master, but matched breathing is used in hypnosis. Helps to match the timing of your verbal statements
- 22. Wrap Up • Mindset of “social engineering” needs to change • Learn what to look for in the human element, not the technical • Understanding these tenets will assist us in protecting all aspects of our lives Questions?
- 23. References Philip Houston, Michael Floyd, Susan Carnicero, DonTennant - Spy the Lie: Former CIA OfficersTeachYou How to Detect Deception Published: 2012-07-17 | ISBN: 125000585X | EPUB Influence:The Psychology of Persuasion, Revised Edition Paperback – December 26, 2006 Robert B. Cialdini (Author) ISBN-13: 978-0061241895 ISBN-10: 006124189X Edition: Revised The Big Book of NLP, Expanded: 350+Techniques, Patterns & Strategies of Neuro Linguistic Programming Paperback – August 2, 2010 ShlomoVaknin (Author), Marina Schwarts (Contributor) ISBN-10: 9657489083 ISBN-13: 978-965748908 http://www.slideshare.net/surferdave71/social-engineering-is-bull
Editor's Notes
- Contents include: Triggers Kittens Memes Pugs Corgis Cues to take a shot
- so·cial adjective \ˈsō-shəl\: relating to or involving activities in which people spend time talking to each other or doing enjoyable things with each other : liking to be with and talk to people : happy to be with people : of or relating to people or society in general Beat your friends at SCRABBLE® with our official Word Finder Tool » Full Definition of SOCIAL 1 : involving allies or confederates <the Social War between the Athenians and their allies> 2 a : marked by or passed in pleasant companionship with friends or associates <an active social life> b : sociable c : of, relating to, or designed for sociability <a socialclub> 3 : of or relating to human society, the interaction of the individual and the group, or the welfare of human beings as members of society <social institutions> 4 a : tending to form cooperative and interdependent relationships with others b : living and breeding in more or less organized communities <social insects> c of a plant : tending to grow in groups or masses so as to form a pure stand 5 a : of, relating to, or based on rank or status in a particular society <a member of our social set> b : of, relating to, or characteristic of the upper classes c : formal 6 : being such in social situations <a social drinker> See social defined for English-language learners » See social defined for kids » engineering noun (Concise Encyclopedia) Professional art of applying science to the optimum conversion of the resources of nature to the uses of humankind. Engineering is based principally on physics, chemistry, and mathematics and their extensions into materials science, solid and fluid mechanics, thermodynamics, transfer and rate processes, and systems analysis. A great body of special knowledge is associated with engineering; preparation for professional practice involves extensive training in the application of that knowledge. Engineers employ two types of natural resources, materials and energy. Materials acquire uses that reflect their properties: their strength, ease of fabrication, lightness, or durability; their ability to insulate or conduct; and their chemical, electrical, or acoustical properties. Important sources of energy include fossil fuels (coal, petroleum, gas), wind, sunlight, falling water, and nuclear fission. See also aerospace engineering, civil engineering, chemical engineering. genetic engineering, mechanical engineering, military engineering. http://www.merriam-webster.com/dictionary/engineering 1en·gi·neer noun \ˌen-jə-ˈnir\: a person who has scientific training and who designs and builds complicated products, machines, systems, or structures : a person who specializes in a branch of engineering : a person who runs or is in charge of an engine in an airplane, a ship, etc. : a person who runs a train Indulge your inner kid: strange words for body functions » Full Definition of ENGINEER 1 : a member of a military group devoted to engineering work 2 obsolete : a crafty schemer : plotter 3 a : a designer or builder of engines b : a person who is trained in or follows as a profession a branch of engineering c : a person who carries through an enterprise by skillful or artful contrivance 4 : a person who runs or supervises an engine or an apparatus See engineer defined for English-language learners » See engineer defined for kids » Examples of ENGINEER Design engineers are working on ways to make the cars run more efficiently. The engineer stopped the train. Army engineers were called in to construct the canal. http://www.merriam-webster.com/dictionary/engineering
- Much the same can be said of blatantly deceptive cosmetic devices such as hairpieces and dyes, age-concealing makeup, and hair removal, all of which are used to falsely suggest the promise and excitement of youth. The magic of cosmetics and dress is no modern innovation. Archeological evidence reveals that at least 70,000 years ago our ancestors adorned their bodies with ochre, a red powder which has been used continuously for that purpose ever since. Pleistocene women may have initially used this forerunner of rouge to deceive males by simulating menstruation, or perhaps to simulate the subtle blush that accompanies ovulation.12 Ancient Egyptian women applied a green paste, rather like modern-day eye shadow, to define their features, darkened their eyebrows with kohl, colored their eyelids to make their eyes appear larger, and bedecked their heads with elaborate wigs. Their Mesopotamian sisters adorned themselves with paint to exaggerate the color and fullness of their lips, while fashionable Greek and Roman ladies dyed their hair blond, applied makeup to cover blemishes, lightened their skin, and used pumice to remove unwanted body hair.13
- We have to go back a bit find the pagan legend and myth associated with Santa. One of the first places to start is with the Germanic people and the Norse God Odin. At Yule, Odin leads a great hunting party through the sky in celebration. This story gives rise to comparisons of Santa and his 8 reindeer flying through the sky. Ancient pagan deities such as Befana (a gift-giving Roman goddess); the Holly King (a Celtic Winter god); and Thor and Tomte (Norse gods who, respectively, rode across the sky in a chariots drawn by goats and gave presents to children at the end of the year) have all fed into the Santa legend Ēostre or Ostara (Old English: Ēastre, Northumbrian dialect Ēostre; Old High German: *Ôstara) is a Germanic divinity who, by way of the Germanic month bearing her name (Northumbrian: Ēosturmōnaþ; West Saxon:Ēastermōnaþ; Old High German: Ôstarmânoth), is the namesake of the festival of Easter. Ostara, Eástre seems therefore to have been the divinity of the radiant dawn, of upspringing light, a spectacle that brings joy and blessing, whose meaning could be easily adapted by the resurrection-day of the Christian's God. Bonfires were lighted at Easter and according to popular belief of long standing, the moment the sun rises on Easter Sunday morning, he gives three joyful leaps, he dances for joy ... Water drawn on the Easter morning is, like that at Christmas, holy and healing ... here also heathen notions seems to have grafted themselves on great Christian festivals. Maidens clothed in white, who at Easter, at the season of returning spring, show themselves in clefts of the rock and on mountains, are suggestive of the ancient goddess.[8]
- Pacing is not mirroring, which we will talk about next. You are integrating parts of their style into your own. Example of doctor who spoke gibberish to autistic girl and she only wanted to speak to him afterwards.
- Behavioral Match behaviors that have a symbolic meaning. For example when a man talks to a women many tend to use a higher voice? Many people mirror without realizing it. Mirroring is engraned since it contributes to building relationships that have assisted in survival. Symbolic Wardrobe. For example when I moved to Texas I never thought I would wear a stetson hat and boots for any reason. They I found wearing clothes similar to the people I was working with did wonders for not only my career but my friendships. I had never owned a gun before Texas, now I enjoy the several that I have. Writing. For a liberal person to be able to become more persuasive to conservatives, he wrote a piece that expressed his liberal ideas but used the same language as conservatives. The result was some angry liberals, because the conservative language was more powerful than the words themselves. Drug commercials. Notice how the section of the commercial they mention the side effects, the music, acting, body language, colors, and other aspects change to make them less memorable. Exchanged matches Motion, instead of matching breathing as we will talk about is a more difficult technique to master, we can use finger taps to match the other persons breath rhythm. In this case you are exchanging body parts, bit you are matching rythem or other mirroring aspects. Have you ever seen someone approach an angry person and motion with their hands to calm down, it is okay, we will find a solution to the problem.
- Showing interest in the other persons doesn’t nessasarly build rapport. If a person is shy and reserved they would be overwhelmed. If you think speaking your heart and vison builds rapport, think of those that defend with sarcasm and cynism. Bulding rapport is not something that is a natural gift, you have to practice and work at it to be good. Why do you think recluse people have a harder time communicating, or that isolated home school kids have a hard time in college and the real world? You start building this skill by using sensory acuity. This includes watching body language, eyes, and some of the other aspects we have discussed. Everything a person does is a message we can use to build rapport. Have you ever been in a room and felt immediately unconfortable with another person but didn’t know why? Using sensory acuity you can pick up and describe what signals were being telegraphed. A good cardiolgoist will tell you when they started listening to peoples hearts it was a basic lub dub but with practice they were able to hear other things like prolapsed valves, heart murmers, and much more. It takes practice to hone your senses to pick up on those things.
- BEHAVIORAL PAUSE OR DELAY. You ask a person a question and you initially get nothing. After a delay, he begins to respond. How long does a delay have to be before it’s meaningful, before you would consider it a deceptive indicator? Well, it depends. Try this exercise on a friend: Ask her the question, “On this date seven years ago, what were you doing that day?” The person will invariably pause before responding, because it’s not a question that naturally evokes an immediately response—the person has to think about it, and likely still won’t be able to offer a meaningful response. Now ask her, “On this date seven years ago, did you rob a gas station?” If your friend pauses before responding, you probably need to choose your friends more carefully. Much more likely, there will be no pause—your friend will immediately respond, “No!” or “Of course not!” It’s a simple exercise, but it drives home the point that the delay needs to be considered in the context of whether it’s appropriate for the question. A second variable is whether the delay is appropriate for the person. In the course of an interview, for example, a pattern will naturally develop that gives you a sense of how much time elapses before the person responds to your questions. If we see something that falls outside of that established pattern, then we have a concern.
- A final way of throwing a predator into a tizzy is to behave in a bizarre, erratic, or seemingly random manner. VERBAL/NONVERBAL DISCONNECT. Our brains are wired in a way that causes our verbal and nonverbal behaviors to naturally match up. So when there’s a disconnect, we consider that a potential deceptive indicator. A common verbal/nonverbal disconnect to watch out for occurs when a person nods affirmatively while saying, “No,” or turns his head from side to side while saying, “Yes.” As an exercise, if you were to perform that mismatch in response to a question, you’d find that you really have to force yourself through the motion. Yet, a deceptive person will potentially do it without even thinking about it. There are a couple of caveats associated with this particular indicator. First, this indicator is only applicable in a narrative response, not in a one-word or short-phrase response. Consider, for example, that a person’s head might make a sharp nodding motion when he says “No!” That’s not a disconnect; it’s simple emphasis. Second, it’s important to keep in mind that in some cultures, a nodding motion doesn’t mean “yes,” and a side-to-side head motion doesn’t mean “no.” So, you need to ensure you’re familiar with the cultural patterns of the person who’s being questioned. HIDING THE MOUTH OR EYES. A deceptive person will often hide her mouth or eyes when she’s being untruthful. There is a natural tendency to want to cover over a lie, so if a person’s hand goes in front of her mouth while she’s responding to a question, that’s significant. Similarly, there’s a natural inclination to shield oneself from the reaction of those who are being lied to. If a person shields her eyes while she’s responding to a question, what she might well be indicating, on a subconscious level, is that she can’t bear to see the reaction to the whopper she’s telling. This shielding may be accomplished with a hand, or the person might even close her eyes. We’re not referring to blinking here, but if a person closes her eyes while responding to a question that does not require reflection to answer, we consider that a means of hiding the eyes, and a likely deceptive indicator.
- A final way of throwing a predator into a tizzy is to behave in a bizarre, erratic, or seemingly random manner. VERBAL/NONVERBAL DISCONNECT. Our brains are wired in a way that causes our verbal and nonverbal behaviors to naturally match up. So when there’s a disconnect, we consider that a potential deceptive indicator. A common verbal/nonverbal disconnect to watch out for occurs when a person nods affirmatively while saying, “No,” or turns his head from side to side while saying, “Yes.” As an exercise, if you were to perform that mismatch in response to a question, you’d find that you really have to force yourself through the motion. Yet, a deceptive person will potentially do it without even thinking about it. There are a couple of caveats associated with this particular indicator. First, this indicator is only applicable in a narrative response, not in a one-word or short-phrase response. Consider, for example, that a person’s head might make a sharp nodding motion when he says “No!” That’s not a disconnect; it’s simple emphasis. Second, it’s important to keep in mind that in some cultures, a nodding motion doesn’t mean “yes,” and a side-to-side head motion doesn’t mean “no.” So, you need to ensure you’re familiar with the cultural patterns of the person who’s being questioned. HIDING THE MOUTH OR EYES. A deceptive person will often hide her mouth or eyes when she’s being untruthful. There is a natural tendency to want to cover over a lie, so if a person’s hand goes in front of her mouth while she’s responding to a question, that’s significant. Similarly, there’s a natural inclination to shield oneself from the reaction of those who are being lied to. If a person shields her eyes while she’s responding to a question, what she might well be indicating, on a subconscious level, is that she can’t bear to see the reaction to the whopper she’s telling. This shielding may be accomplished with a hand, or the person might even close her eyes. We’re not referring to blinking here, but if a person closes her eyes while responding to a question that does not require reflection to answer, we consider that a means of hiding the eyes, and a likely deceptive indicator.
- We need to change the way we think of using manipulation and deception in information security since we are missing other opportunities to protect ourselves, customers, companies, etc. from not only cyber criminals but sales people, vendors, douche bags, and dare I say executives. People give away information everyday about themselves, understanding manipulation helps us know who and what information to disclose and who to walk away from (or call the authorities). Questions?