Presentation -- Social Engineering a Better World

ah thank you guys for getting out here so early on Saturday really appreciate it like I said this is the first time I'll be getting an apology at a security conference and you could have volunteers yourself from paid social engineering a better world fair warning and I bounced a lot and I don't have a presenter so I'm gonna have to jump back before it's spacewalk this is going to be a little bit of a different talk it's not technical in nature but it is geared and specifically focused on human interaction and human health so let's go ahead and start off by introducing yourself hi yeah depends on the time of day I'm Brian the information security researcher and

analyst with dipole security I work with the visa as well as work with our threat intelligence strenght Mohicans I am now where analyst on the team I wear a lot of different hats were a small group so I did see basically freedom a lot of different tools and a lot of different toys it's really good fun I am a professional nice leader so be warned my job right now is I am explicitly a blue Timur so I can entirely focus on something that guys rather than actually being a guy although I have worked as in just over the past that joke maker I have three young children and I have had the mantle of dad jokes casted from my father and a

huge coffee addict so you don't see me with topkapi there's a fair chance and suppose one not if you want to catch me and my rants and raves on a train managers for a patent Twitter quick disclaimer standard one the information being presented to you Bennet is not a symbol of what the opinions of my for sure really not even my opinions so all stuff from the internet and we all live you can trust what you see let's start out with social engineering I before I get into this I know he said be respectful I move quickly and I bounce and a jump I talk fast if you've got questions if you've got concerns if

you're like hey that's spelled wrong let me know I don't care I like feedback it makes me feel like I'm interacting with you otherwise I feel like you're you see let's talk about this for a second how many of you guys have ever done social engineering really back to you how many of you interact a few movies there were a few kids that are actually yeah I feel you my server brethren social engineering is there's a lot of different definitions but essentially what social engineering is is communicating with a purpose right in the context of red TV when you are communicating someone you're actually attempting to achieve of gold so this is just Webster's dictionary so you didn't

look that up basically is indicating with a goal and using psychological principles to lead the person who's interacting with to a course of action or inaction that you want right so in case of security I worked as a social engineering folks pen tester so wat fun we did and almost exclusively fishing fishing spear fishing we o scented targets and you very good I believe when I left money the people I actually spoke to during boat calling Asians I had successfully in fishing general fishing I sent out

almost a hundred thousand emails a month out of that I had about 42 percent success rate spearfishing spearfishing would up too so these principles are foundational and we were very very good at getting people to give us information they want suppose yes so inside of the context of intestate and security testing you are attempting to get someone to compromise their company they are resources to give you what you want it is focus on these it elicitation of information we are supposed to have you ever had that you know with like security man walk you into a date this is a it's employ your feeling right so the other versions is social engineering and this is what

we're going to really focus on something very cost efficient sales and marketing the same principle we used to get people to walk us into a daisy on the same person that we can use healthy local applications the same principles that we used to work with as kids imprisonment needs to communicate or responses so group wavelets let's do another quick survey maybe knitting with a purpose with that definition in mind how many of you are social engineers everybody knows we have all eight years of how we interact socially is focused on behavior change and leading to a choice so you getting to the point I don't know I might eventually get to a couple of points from on accident the old saying

just a quick reference I'm actually from the Asheville area so the old colloquialism is very true even likes more than that every once in a while so I'll hit a couple points I promise it'll be on accident though so let's talk about this for a second the FBI uses this behavioral stairway model specifically focusing on Shh Oh take a look at these right how many of you have been through any kind of a socially here in horse this look familiar this is the exact same principles that we use in counseling say the exact same principles in use and hostage negotiation which is what it was many more also the same principles as social engineers you begin with active

listening and got start up here what your target is saying right we're going to go into more depth here but everything focuses in a social engineering engagement counseling engagement or your spouse investment loss it starts out with listening so let's talk about for a second active listening this is really profound definition ready

alright anybody here speak another language to me give me hello how are you good talks for usually the gates need so Bob it all fits you take it I know you're gonna try and push it out my for Appalachian slang but so we're all saying the same thing but how many of you understood everything that was just said kind of a small number because everybody's communicating is different man well the thing is even though as security professionals we won't communicate in English people aren't really understanding it so let's start out with listen number one thing you have to do to understand someone is so listen right to understand the language that they're using it learn to

communicate with them so the golden rule is do one to others as you would happen to do in two year the Platinum rule is do unto others as they would like them to have to start that with listening the way that you listen about this particular character because you can see it's got none here it's not your eyes your undivided attention to your heart so the main point of active listening is that everything you are taking in you were taking it in with your ears you're taking it in with your eyes but you're also taking it in with your personality your heart has it what you're listening to someone in your safe okay so I'm

going to hear what you have to say not just what you're saying I'm gonna also try to hear what you're saying and where you're saying it wrong we'll get into this more in just a little bit but some techniques right and these are outlined in a number of different places you just google active listening and you're gonna find some stuff I helped write a newsletter about active listening and these are some of the tips that has social engineers this is what we came up with listen shocking Wow acknowledge what's being said right so as someone's talking to you you can generally tell what they've shut it off right yeah yeah sure oh yeah I'm totally

with you at that point my wife listen to this do you even know what you just volunteered their son for hey you know it's what is being said restating the points we thought we sarcastic I'll be caustic about it but restate the points to make sure the processing everything correctly repeated deep back what you can hold reframe it say so i understanding you my wife's name carrot so I'm understanding what you're saying is there you really really need me to go to the kitchen take the trash put it in check in and to make sure that I put back back in right yeah sure what you say the courtney of your roles empty all three of them again

we'll see movie or he asked questions active listening is actively interacting with another person talking with them to say hey so how did that make you feel where were you when this happened did some context also watch the body later so as you guys can see i'm moving around anybody do anybody alright so what does my yeah what's it going to do the rich do we need a sacrifice who's volunteer go to literally the live stream in your slides to oh really you try this so i don't know do you guys cook slide these up we had our density okay sweet I would get I'll have my slides out I'll tweet them from my Twitter account you can download them if

you've got any questions hit me up my hands are open but watch my language so those of you that can kind of read body language what does my body language so I

[Laughter] thought you like to be I did why would you cuss me like that man

yeah like so the story behind the shoes is I these were like the cheapest shoes ever and I grew up on a farm so we did have cash so I grew up where and shut tailors and now they're like it's three and fifty dollars that's it come on I need somebody's classes about laziness hurry I gotta look like I know what I'm talking about but my body language is open I'm trying to be very honest and trying to express myself in a way that opens from what hands I don't want you to either meatballs don't pull you off assault but they lost it right so if you saying would watch in trying to detect it there certain points

you're going to see me conceal some I'm going to pull back just a little bit because let's face it you really don't know how many times as a dad though that's something that I think about don't get lost in that initial start to detect phase that might not importance in the discussion ahead he your mind engage say focus on what's going on beep in the present so like I said if you allow yourself to get distracted and start to wander it's going to cause you to lose track of the conversation not only that but it's very positive so lose the ability to develop or it's you can help with something chef it just like my luncheon table shut her

down on the discussion about tax no biggest thing that don't interrupt everybody is the hero of their own story your job as a social engineer counselor at pentester is to find a place to develop yourself into their story right

okay that was weird so this whole moves into helping us to develop empathy I'm only insane two deployments perfect but I really like this helmet we were driving up here of my house and my sister volunteer she was helping me put the slide she identified this is beautiful empathy behold the mirror and asking for a handout what better way but just look at this real quick what's Tiger so this is considered the universal face of pain doesn't matter what culture you're in the face of pain is in if I remember it correctly at this point in his career he had a serious back injury so when he took the swing and actually tore his spine and ruptured discs they continued

to plan this was years ago before all the fun stuff came out about him and other personal issues but developing empathy is specifically moving to the Greek workers and come in or inside pothos feet so employed or attending to do when you work to come and empathy with the person who are attempting to feel what the other person is feeling so we're trying to literally walk my little purses shoes

her thing Italian food flip breakfast was not a good picture but passing was suffering passe for those of you they can't endure what you say he said that he thinks populace is suffering I'm totally honest I'm not 100% sure but you know what now you said it I'm going to look it up really they're suffering you're enjoy so but the goal with empathy development is either feeling within the suffering or feeling what they're feeling it's kind of I don't want you are it's tempting to experience what the other person is experienced so let's start out though and find a few things that what empathy is not it is not cultural appropriation you're not going to be able to develop empathy

necessary to actually experience life as someone you're not right I am a middle class white male from Appalachian I have no clue what the african-american community is experiencing in Harlem I can't fully understand that and if I trying to immerse myself in the culture it's gonna look weird but what I can do is say okay so here's what I know here's how I've been potentially feeling this situation it's not going to be investing but it will help me to better tailor my communication someone who is culture someone who is from a different pathway right I got in trouble when I was doing some training as a certain linear because I was extremely effective at playing the country bumpkin who was

out of places they say it works it worked like a charm and ended up getting in trouble and they said well let's see who's out of their comfort zone and I knew too long I move into the realm of cultural appropriation and actually had quite the perkins anymore that was starting to get into the level of Vincent I had one guy said that was just flat-out and that stuff involving you should never ever ever do that again you you were bad and you should do that so suppose that I had to make something just a quick side note saying sorry right there no two words in the English language that are more powerful and more

disarming and say you know what I mean Hopa I'm sorry my bad but not just that learn so also this is not developing Italy is not an excuse of bad behavior you're not saying someone you know might so I understand that you shouldn't want to prolong it's not that there are certain realms you can understand with something field you still have to keep it within evaluation combination there are other things that if they smell but what about this and I put in a tumbler and forgot to remove it real professional Slimer right here okay the practice of empathy it's considering others experience trying to experience another culture study someone else's belief you're not going to figure this

out just on a whim it'll fly we're all very very smart people but gotten developments this is not something that naturally comes to office I don't know about most you guys but I'm naturally very antisocial I'm an introvert I don't like very much so this isn't practice for me but most critically shut up and listen you got something great to say Sharon sort of it and the point of developing at least here but they have some rapport so this photo was taken in my kitchen that is my two-year-old father eat before is the practice of developing trust using integrity punchy mushy analog trust that chair that chair had developed her trust music its integrity and I'm not kidding she sound like that

I pulled her off three times and she's getting out finally I was like you know what forget it you're gonna fall you alert she doesn't look cheap yes repeatedly did not determine so in report development you're actually trying to develop a relationship you're developing behavioral equity to speak to someone so these are main methods of reportedly right the great thing is there's actually story pop injury former FBI behavioral profile and we'll talk a little bit more back and later but he was asked to write a useless newspaper article about her home so once again okay well one sitting tomorrow got nothing better to do uh give me a napkin he's her left top ten these are the

methods that he uses to develop rapport so ego suspension in my experience is by pardon with powerful ego suspension is on short it's not about you validating others right so when we express how we feel about husband as it counts you're trained you say how'd that mean because it sounds trite but the goal is actually to develop or with this project to validate them and to listen express themselves so another program ask open-ended question if you are not asking a little bit into question you are closing the conversation yes/no answer will kill period be it nothing give people a chance to talk in a row a Dipper tap is something with something right so if I expect for you to give me

something I'm going to walk up to you during vision engagements this is a really critical thing or just started out me neither good afternoon this is Jim Johnson with I see how best we recently seen so it calls about a hot piece of malware and I just need to verify north computers not on the list I know I just run through some technical details make sure that I've got the record life and it should read me off the serial so immediately I have given them a few pieces of information given them my name anyway a Morpho what are they going to do you want me to hang up that's funding I also give it to my

department I've given the wild calling I've hidden the information than long if I hold the bottom or the top then I tell them they'd head there's no they have received something very like this moves into the realm behavioral economics dan Ariely did an extensive amount of research and he found that during Woody's experiments they were giving a set amount of money on participating in the study 200 participants and they were testing to see what was the proper motivation for people to save the money so what they would do is try a control and give him the money in single era result for about 10% then they said okay this didn't work out so well so let's go mine so they gave the

money and said and remember if you say we will match you and they motivated and then like okay well let's see how social pressure was they gave them the money and then they had their participants children Colin and Ryan in the same money so they weren't for generally about the teens and 25% uptake rate and then shut up about before wasn't it Nathan with scratch offs in scratched off every time we save money all of that they're not a shot up the middle 50% so he had both work in the realm of behavioral economics if you notice a lot of times and also well again discuss it later there's a bit of extensive research done

by ramen shop to meet who said when you're walking up to someone get them something he repeating hold this for a second you're handing them something as we as humans innately take something into our hand we begin to component to the desires of others even if we're about to get it back it's instinctive dudes survive for millennium because we are so temper juice and that is the instincts interest as a social engineer or leveraging noona artificial plants insurance it doesn't even have to be specific hi but I have a moment of your hub and you guys walk the mall or the survey guys hi just a moment of your time go go away what thing is that is a

personal Ashley's function it works by language since and hope reports I just watching their mama keep watching your on the message you want to portray is going to be pivotal and it's going to be expressed through your body so great examples are great contrast Bill Clinton and George W Bush right Bill Clinton that's they had had to have coach he was just beautiful communicator whatever you think politically the guy was a communication genius he could look at you who's the comedian Frank Caliendo jokes Clinton was an amazing liar this was a reason to be there I'm not here a liar what is the definition of his but it raised questions and just that that Jean Lee

openness that wonderful ancient song named us think you can trust that the George W Bush then again it doesn't matter which is big politically his body language with all over the place it was the swagger he carried himself wave was very typical in Texan but it didn't really apply very well to other Erebus right you go up into the Northeast where spaces one constraint whiny language tends to be a little bit more close in versus Texas is wide open in Texas everything's bigger in Texas so you've got that dissonant speak slowly the reason that this one works is a human brain comprehends things a certain way and you speak faster than someone is going to understand you're

going to do one of two things you are either going to make this vicious or you're going to be pinning it on - I think I'm protecting here and talk so enunciate see slowly up high owl are you today the swamp is utopia pokey back bet that's what settings but

to go back and watch this and ask for help again we are social creatures near built around our mentality asking for help trigger something instinctive in us we want to help we need help that's how we survive it I help you I'm hoping the whole right critical main is your expectations you learned this a lot when you deal with vision council and somebody's problem attempted correctly on the stats on this but if I'm remembering correctly a person tries to beat in addition on average 13 times before they're successful as a pen tester as a social engineering engagement your success rate is not going to be a hundred listen it may be hot you may be spectacular you may be

the Bill Clinton of pin testers and it will walk in like Jason Street I just need to plug this rubber ducky engineer here here where Darth Vader slippers in your professionally evil lanyard I'm not my success rate is decent but it's not perfect manage your expectations expect plan for the months mostly the best influence I love this picture so influence literally works like this right where you're influencing somebody you are causing them to move in a direction that you wanted to move it whether it is I want you to know datacenter I want you to give me your password or I want you get up in poverty to know that you can choose anything this is something it is

hope I work in my kids I was a nervous kid and actually not their call you out club one including guys that I've worked with over the last few years is actually here today now I'm super excited to introduce into the community influence is a magnificent play because you have the ability to change the pathless or else not just for your benefit or submit the ability to communicate higher with your boss better with your targets better get any more hungry come to understand it I promise we talk a little bit more about Tommy so just it a little bit of digging tell me right now I was rated number the most influential psychologist Illinois he literally wrote

the book on influence of influence who's here and by the title but it's spectacular look the way about all of this information is he actually during seventies went through all these other companies sales piece of their sales training and tried to active salesman and he collected data from them and he used that as his son who's amazing and then he'd go might be able to stun and say hey I'm actually you know proper Robin shall be here the salesman I'm a psychologist studying in for and what I'm doing is looking at how you're setting your influence up and if it's alright with you for me to use raw material and the data I pulled from here I will give you

more time complete the full spectrum down from everybody and he said I gave them that option and to an individual company none of them said no detainees aren't that in fact most of them were excited during you the doctors come in to us to ask us or while we did oh yeah you got but this is a similar one if you were doing any kind of social engineering even reading this book he's got three others pre suasion influence and I cannot remember off the top of my head the other title I'll include it in the end slide share oh when I posted on to its with the techniques of influence are pretty similar system reciprocity consistency

social proof like accordion seriously what's the profit II mean is said that if attacked I do a good turn for you you lose in terms of it later right consider follow-through don't flake don't whatsapp girls be consistent in your actions over speech and what you do the social proof you guys all seem to put quit baby yeah we've done it in your area seventy five percent these really like this X props well that's fantastic I don't I don't speak Danish but whitening we're more apt to work with somebody to be responsive to their request if we like them and how do we like someone generally with their in among us so watch your body endures no fever

your target language but you know taking on some of the things like if your target is making those small gestures and you're those big ones all packet control your communication style authority this is not a call to Authority so even assistance through this this is being is speaking you can't take some money somewhere that you've never met sorry it was I guess it not want to just throw find this little hippo is that telephone exactly how [Laughter] scarcely seriously is limited supply only only part of these items left soon so that once I seen that if it was out that past I really don't need it but leveraging these you can change its constant to change the direction that

were traveling tightly it results in behavior change this is the involved whether it is the security guard at the security desk of an April changing morning and put down this footboard Colonel basketball gaming take me to CEOs us so that I can drink this option well my photos myself kickback on this chair for and it's not it doesn't really do it I wanted know that there's more to life you want to see oh my wife to know that I care

point is communicate with the purpose I'm do it understand what's with goals and understand how the person is responding how many of you guys do change management I worked in DevOps for a while and we did a lot of change management and it made me cry so on so but the point to Native communities so something grace you can all the back you can see what changes and make sure that everything works that's a great thing about getting up right not only that do you track who made change track your changes with the person they're interacting adjust your technique based on them but close with two little things one is for compromise dream the only goal I have for either

myself or the individuals I teach is that in every interaction the other person should walk away feeling much better for having met the goal of social sharing is to make a change in someone else the social here has this great line in iterative lead people feeling better for having met you it's easy to manipulate it's easy to blackmail is easy to pull on us and threatened to get compliance is so much harder to use people wanting to help you and in the case of one thing with that was kids status endodermis those aren't really going to work you do that and you just show through did influence evident reporting to develop that person make them to benefit how to menu the last one

we were here in the world all the tendencies present in the owner alone are to be found in the world of Allah if we can change ourselves the tendencies of the world would also change to some extent we both others the first place that the change spark is you are that is sort of change you are the thing that makes the world different so after this today go out the side were changing what's in the world be that change

[Applause]