Social Engineering is Bullsh*t call it what it is - Dave Kreen

since it opened up at one so cha ha is a small little group that we get together in Charlotte so if you live in the Charlotte area we meet a Saturday a month to get together in HACC and then we go drink beer afterwards so if anyone's interested us that's cha ha so I figure that's a little pitch for our group so standard disclaimers the information here are my views and the just like the title of this talk citations are needed but I do have a slide deck with some of the books that I use for reference and for researching this talk and I have to tell you this is one of the most difficult ones I've done

it's just a little history behind this I was working with a social engineer professional I had a very frustrating day working with them and came home slammed down a bunch of Bourbons and then wasn't yeah don't maybe ya know me to disclose exactly who it was but anyway there was a CFP open for Carolina con and they're like it's not gonna happen Carolina clones it's not gonna happen if we don't get enough speakers so I'm like alright I'm gonna have this talk and I'm gonna throw it out there and I get a acceptance letter back a couple months later had to email him back but what exactly did I submit for this talk and you please refresh my memory

so exactly well in Gmail it doesn't work like for me doesn't anyway because I don't know how to use Gmail I'm doing it wrong alright alright so I thought like who to introduce me might better than my 14 year old self so so where we at what are we doing what are we doing we're recording okay my name is dick my alias name when I anarchist all right 14 years old already committed to anarchy so now now I wasn't conceived in one either so that came that Vanagon came later in life but so my nickname kind of got is a pH in it instead of f4 surfer Dave that's a throwback to some of the stuff that I was doing back then

phone phreaking because my cousin's lives in Philadelphia and I was in Virginia cost way too much money to call found something on a BBS it said if you make this noise in this phone it will give you a long distance I'm like sweet so that was my first introduction kind of into the world of hacking and things like that so let's jump into this topic why I think social engineering is [ __ ] and let's call it what it is [Music]

so what's social engineering social engineer love games social engineering socially engineered this is all right so yeah yeah so the theme for Carolina con a lot of us submit it as I didn't submit but I found out later David submitted as old Greg there's like 15 people submitted his all Greg so that was the running joke there and just thought it was great to leave it in there so congrats if you actually recognize that and we trolled Kelly for a long time with that with that name there so I really wanted to kind of look at the definitions of what a social engineer so the way that this talk is structure we're going to kind of look at the

definition of it we're gonna actually understand what it is what we're really doing at people we're looking at a history of what has happened throughout our lives why we're so susceptible to these things look at some techniques that kind of work from a sociology perspective and then look at some neuro linguistic programming so let's just jump right in so social engineers so the definition is social is relating to our involving activities where people like to hang out and do things together just like us or if you're in the lockpick village it's something fun to do you get together and you're enjoy spending time with each other you're happy to be with each other and sometimes this doesn't

work for all of us because relating to people or society in general a lot of us have some social phobias and things like that so maybe that doesn't apply to all of us the definition of an engineer now this is one of my biggest pet peeves because I'm my title is actually an information security engineer but I never went to school to have a degree or license as an engineer we're all called engineers in some form or fashion I mean who's gotta MCSE here are you an engineer you know anyone can have that so right so the definition of an engineer is a person a scientific training he does all these complicated things it's a person who specializes in

it now this slide was probably the different most difficult one of my deck to find because Google woman female engineer and the internet thinks you're joking and it's like you mean you want a scantily clad engineer or you want to engineer's costume but no I mean men and women both are equally capable of being engineers so this this ladies working on a looks like to be a power planner or oil refinery another definition is someone who's in charge of an airplane airship like these guys all right guy he runs a train like that guy so engineering now when we actually look at the actual practice of what on engineer applies it's a it describes you

now I won't read the whole thing but it's a special body of knowledge pressure professional practice involves extensive training in that application of knowledge so when we use the word social engineer how many times are we using this incorrectly like in our field what are we doing what are we really doing so I I the whole thing was like this is not really social engineering we're manipulating people in the tech industry this is how we do it in tech we use phishing we use phone calls we use dumpster diving we docks people we use Oh sent like this is a screenshot of multigo and it's a great tool pulls from multiple different resources on the web open source

intelligence and find out a lot about people but it's all really manipulation it's not necessarily anything that has to do with social or engineering so let's look at some of them the history of manipulation and deception and really how we did it come about that we were so susceptible as a society as as humans it doesn't matter it's a universal thing around the earth as humans that we can be manipulated and deceived so some of the stories so that the story of Adam and Eve just to recap they were put in the garden they and told to serve God and that they could eat of any tree except for this one tree Satan who was

an angel and the vicinity earth saw that that worship he wanted him for himself he transformed himself into a snake went down he told Eve that if she ate of this tree she'd be like God knowing good and bad she was deceived ate this now the interesting thing about that no she was deceived she's kind of new to the earth she's you know kind of young compared to Adam what she actually took the Apple and brought it back to him and said hey guess what I found out and he's you know supposed to be a lot wiser because he's been there a lot longer he's easily deceived by this as well so the history deception is a very

powerful thing especially when he's been like millennia by himself and he's got a chick and he's like I believe this chick if I don't accept this I just guess I'll go ahead and do that he's like I'm not going back I'm not going back by myself at least in my mind that's what I think of so another practice that is even it even happens today is that of using false weight so you would go and you think you're buying a unit of grain you might get half a unit or 3/4 of a unit of grain to the point where it had to be legislated like in the in the Roman times they had tax collectors who are

actually in charge of going and checking the weights to make the weights make sure the weights were valid and next time you had a gas pump look there's a sticker on there and it says this year has been certified that this thing is accurate then we're not deceiving people so we actually have to have checks and balances against that clothing makeup and smells for millennia there's been evidence archaeological evidence that have found like 70,000 years ago that our ancestors adorn themselves with a reddish powder called ochre and in doing so this stimulate or stimulating the men into thinking that the women would be ovulating so they would appear more attractive at that time and and and be more attractive

to the men so building on that you had several different other types of eyeshadow green paste that would define their features the Egyptians were well known for that they put wigs on their heads the Mesopotamians would exaggerate their lips and the color of their face and Greeks and Romans would actually dye their hair blond use pumice stone to remove unwanted body hair makeup to cover blemishes and they'd lighten their skin I mean does that sound anything different than kind of what we were used to today

again I really Drive Thru so I apologize if I'm drinking quite a bit it's saving up for tonight so we're told from I think about how you were raised as a person you're told you're not supposed to pick your nose in public you're not supposed to be like this guy you're supposed to be polite even if you know you're not supposed to tell people exactly what you think someone's got stinky breath you don't tell them you go up to your grandfather you sit on his knees smells like he's probably wet himself you don't say anything cuz that's me that's the I mean it it's a polite thing if you think about as a society in

general we all do that because we accept that as being polite it's a type of deception really because we're not telling how we feel outside we keep those things inside we're taught to if you don't have something nice don't say it at all so it's easy to understand that certain things that we don't say can be portrayed to other people and other means through body language and other forms of speech one thing that we teach our children is tell them the stories about Santa Claus and Easter Bunny now this is a picture of you'll are Odin I'm sorry and the history of Santa Claus comes from the Germanic people and Norse god Odin and so some of the things that have kind of

led into this Odin leads a hunting party in celebration at Yule time and this kind of gives comparisons of Santa and his eight flying reindeer you have a Celtic Holly King Thor these guys would ride across the sky and chariots and give gifts to children at the end of the year so those types of things have kind of fed into that Santa legend os tree or astara is a Germanic divinity then cheese known as Easter so a lot of the celebrations around Easter she was also a goddess of fertility so that's why some of the symbolism around Easter of Easter bunnies we have chicks we have all these sticks and rabbits and things like that because of the

ability to procreate rapidly they're celebrating the goddess of fertility so we kind of wrapped some of those things around there and just accepted them for what they are as being you know Christian and we teach these things but you know I'm not here to judge anything I'm just here to look at some of the history of you know why some of these things work with our with our generations how it's been passed down through the generations so let's talk about some of the techniques that work so we're going to look at some of the social sociology based works of C aldini Robert C eldini amazing sociologist and I really enjoy his work so I picked a

couple that I really thought kind of applied to manipulation so we talked about the golden rule and that's the rule kind of known as reciprocation or reciprocity that you give somebody and we see you know if what you give you expect to receive in return so everything kind of evens out well that can be abused the Harry Krishna if you're not familiar with the Harry Krishna they are not as evident as they used to be especially I haven't seen they're in Uptown Charlotte quite a bit but I haven't seen him in public places as much but they figured out how to use this rule of reciprocation to their advantage they approach a stranger with a flower and

just walk up and say this is a gift from the Harry Krishna and of course you're taking it back because it's a stranger giving you something you're like what's going on here and so they just politely mentioned if you'd like to make a small donation to our cause we'd appreciate it and try to give it back like no it's yours free of charge so they figured out that that abusing that rule of reciprocity could actually be in their favor street performers asking for donations I thought this was interesting I went to a conference and I was in New Orleans in Jackson Square watching these break dancers and I noticed how this this rule of reciprocity worked and this

is this is actually you know a legitimate way of a minute people and in this case I was happy to pay because I enjoyed their show so he had the guys all lined up in the crew but the guys on the left the first guy would grab the bucket and then the next guy over would take a handful of cash and throw it in the bucket and he'd go around so now it looked like that first guy threw in like five bucks he goes around and now they've got more money because people feel obligated they're standing there now the guys running around quickly before everyone can disperse you feel obligated to give because you you know enjoyed what you

saw I used to live in New York and there is a Olive bar up on the Upper West Side that when people would like to come and visit I take them there because it was one of those weird things in New York and after reading through it kind of thinking through of things I might realize what were they were doing there so these guys were flying in or driving in and they were we were like living in I was living in Brooklyn so we parked the cars in Brooklyn take the trains all the way into the city up in the Upper West Side and if anyone's ever done that it's like an hour and a half two hours

on the train but we'd get these people and we go to this store and there were free samples and it wasn't just like Costco free samples were the ladies there and she gives out a trifle and then you just walk away because you know not interested in talking to her anyway you can eat as much as you want in this store I always thought that was interesting because now I think back on it four out of five people that I take up there would end up buying all kinds of olives like not just one little package of I mean we'd have like pounds of Olives and we'd be carrying these olives around we'd be on the train for

two hours going back we'd be still walking around the city they would do this they would even think of it they thought well I got all the free olives I wanted I really should probably should pay for something to take some with me so that there's a really good interesting technique and one of the few places in New York you can get something for free another method that works is commitment and consistency so racetrack betters are often stand more likely to stand with their horse after they've made a bet so they get in there look at the track record there on indecisive as soon as I pick that horse and put that money down as

soon as that horse is doing anything if it's [ __ ] if it's getting ahead they're cheering if it's falling behind they're trying to coach it if you've seen any if you've been to a racetrack or if you've seen shows where people are coaching and yelling at the horse to go faster really they stand by that they committed to buying that putting money on that horse but and now they stay consistent to that by continuing to cheer that horse on and hope it wins and they continue to I think if you look at track records they'll continue to go back and bet on the same animal that they did the first time through the course of that move

course of that betting day I'm not trying to downplay this issue at all this is actually this is something real it's not just a single gender type problem and I'll explain why so this is actually an from the Australian government of the silent issue and it talks of meaning like the verbal abuses and things that happen that a lot of people don't know about and I'll show you an example of this explain a situation that see all Dini wrote about in his book he spoke about two people a man and woman that were living together for a long time the man was a drunk alcoholic he just didn't want to get married he's just happy with everything she wanted him to

change she wanted to get married she wanted him to stop drinking because used to you know just a lowdown guy he just didn't appreciate her at all one day she said I'm done I'm finished leaving so she did she leaves breaks off the relationship there finds another guy who's exactly what she's looking for he moves in with him they get engaged well this the first guy comes back he's like hey you know what I was thinking about I was thinking about you and our time together I really don't want to lose that I went to rehab I stopped drinking I want you to come move back in with me and I want you to marry me so

now the guy that she really wanted to be with has come back into her life so she splits off she gets out of the marriage or what is it engagement gets out of the engagement moves back in with the first guy what happens after time now of course now she's listening to her family say why are you going back with that no-good guy she's defending him now because that that's the one that she really wants to be with so she goes back and what happens he falls back into his same old patterns weeks go by months ago vibe act being drinking again she you asked when they're gonna get married and he doesn't want to set a

date but what happens now when their family comes back and says why are you still with this guy it's because I love him and he loves me and eventually it's gonna work out she's committed back she's reaffirmed in her mind that she really wanted to be with him she broke off what she had she defended him and now she's staying consistent with with that first guy now another example to illustrate this is that that of Christmastime so I don't know if it's you probably have heard of it before but how the toy companies have figured out how to make money after Christmas so what they do is they short sell the toys during Christmas so say you offer you

know like say Kelly's gonna give us on the super whiz-bang peepee robot and he's promised that to him and his sons like that's the only thing I want that's it that I don't want anything else daddy that's all I want for Christmas Kelly's like absolutely that's that's what you're gonna get what happens this is thing is that it's been mass-marketed bass advertised you go to the store and what happened well we don't have anymore okay so now what do you do well I got to give my my son something for Christmas see you buy them something equivalent or II maybe even more because you promised him that you're going to do that so what happens all of a sudden nears Day rolls

around and all the stores are flooded with these toys again well go back and you buy the toy if you ever think about it the toy companies actually figured this out that they can short supply that and play off this commitment in consistency you know they know that their kids have been promised these toys the parents want to show that you know a promise is a promise they want to stay consistent so they go and buy the toy and now they spend twice as much as they would have before so toy companies they know how to manipulate us as well now we switch to some of the topics of noir linguistic programming and it was brought to my attention at

besides Charlotte that one of the guys was before the talk he was adamant that NLP doesn't work I guess he was thinking of a different context we had one guy at a Carolina con a couple years back talked about you know how he could just read people's minds and how NLP is the most amazing thing I like to talk about it more as a way to evaluate the situation a way to evaluate another person tell if they're lying or allow you to build a rapport that you're needed to to build a to close the gap and be able to either manipulate that person or at least have a conversation with them so it's similar to method

acting the first one is pacing and matching and Johnny Depp here says that it's just like any part that you play if you're not yourself at least part of it it's lying so you're matching another person's body language and speech so this method actor here he's got several different facial you know things so if you look at him you can kind of tell you know what kind of emotions he's really feeling so those things that you can pick up on people those things that you can actually do yourself can change the mood of the entire room in this particular case or interacting with any other person so you're matching that person so this isn't mirroring this is integrating

elements of their personality with your own so you're talking to this girl she's probably from around here North Carolina something like that and you notice her vocabulary you know sir the way she talks he's probably even if she's gone to college she doesn't want to sound pretentious and and belittle people because that's generally speaking that that type of vocabulary and this type of people don't do that whereas that thing is made to be very crass and just I would never want to walk up to a person like that on the street so in pacing and matching you're you're kind of bringing yourself in line with the other person so you can you can not necessarily sort like it's not mirroring

so you wouldn't want to pick up on somebody's accent because that could be construed as just being plain rude or they could recognize that as a technique as mirroring and then you're busted then it makes you look like creep so you're kind of relaxing yourself you're bringing your vocabulary in line with theirs so that they feel comfortable around you and you don't make them feel out of place now mirroring itself is actually broken down into three different types of mirroring behavioral mirroring is a as a matched behavior it's a symbolic meet with the sabalan meeting like a lot of men don't realize when they speak with women that their tone will go up a little bit when they speak to women that

is something that has happened I mean think about it it doesn't work anymore to drag a woman out of a cave by her hair so the evolution of the species has taught us to make the women feel more comfortable all right we adjust without even thinking about it so that's a behavioral mirror we'll talk about that later on we'll swap we'll swap so there's this the second one is symbolic mirroring wardrobe and I'll tell you a story on how this worked for me so I moved to Texas and I'm dressed like I am now this is how I've always dressed I started working with and I Drive all Volkswagen bus to just both full disclosure on that so you can

imagine me rolling up to it so I work for local County Association and I go show up and I go to talk to the sheriff's and the commissioners and all that stuff obviously not like this but still not enclosed that would be considered Texan really had a hard time kind of breaching that gap because Texas is a very special country it's very unique everything everything there is completely different than in here if you've never been there it's a wonderful place to go visit and yeah so when I went there I swore to I was like there's no way I'm gonna have a hat and I'm gonna have a belt buckle and I'm have boots and grinders and all

that stuff but I found that after adapting to how they are and the way that they talk and their mannerisms and things like that just changing my clothes I was immediately accepted yeah that was it just the clothes so it was amazing and actually I still have all that stuff I enjoy wearing it every so often and I never owned a single gun before I went to Texas and I own several and I enjoy shooting them although it's harder to shoot here than it is in Texas by far and you could walk out your back door pretty much and shooting your cut in Texas ooh I do miss that another another form of mirroring symbolic

nearing is that of writing there was in around the the time of the Cuban Missile Crisis and that whole embargo that we put on Cuba there was a liberal person he was trying to persuade conservatives to look more into how Cuba really kind of existed in the like eyes of a liberal to convince them of that so language is very important the way that if someone writes just like our language here as InfoSec people if we go to the bar later on tonight and start dropping you know like zero days and guess how late I am you know and all this stuff to the bartender is not going to know what to do she's not going to speak that

language so the conservative so this liberal needed to write something to conservatives to persuade them but he did it in the same language used by conservatives so it read is something more conservative there well what happened was it angered all the liberals that were used to reading his information they could not believe he was consumed in that position the message was completely liberal but because he had taken that tone he'd he'd done that'sa Maalik mirroring of the conservative people he had actually got been able to get his point across their exchange matches aren't necessarily a mirroring thing it's a substituting another part of the body for another just like I'm tapping my foot now you might you know see

people with with hand gestures the way that they breathe you can actually exchange body parts to kind of mirror somebody else without actually getting busted for doing it and I'll give you a perfect example how many times you've been somewhere with someone super angry you put your hands up and you're like calm down calm down what you're doing is you're trying to manipulate their breath and their breathing and trying to bring them down from that state that's an exchange match so you're using your hands there to control breathing building and maintaining rapport am i doing on time good so this is where we're we're talking about like in jujitsu this is like closing that gap

you always want to get in close so that you can take advantage of that situation so this is building a positive connection between you and another group and speaking to a person doesn't necessarily build rapport it's not like a gift you have to actually practice that to be good so what would you think would happen if we're I say we're there later on tonight and you got this guy what do you think would happen if those two girls went up talked to this guy I mean he's probably not gonna know how to interact you know huh yeah that's probably true but what what just what if I mean what would this guy you know what

would happen right but to so this isn't so this is my target right this is the guy that has all the the keys to the kingdom I need to get and you know become friends with him so there's girls aren't going to work but this guy is definitely not going to work either he's going to freak him out even more so what do you do you become like this guy so that you can have a positive relation with him and like you know hopefully when speaking you have a positive relation with your audience as well you use the term since the term sensory acuity you're finding out more about the person's disposition so you can tell here just by this guy's look on

his face he's obviously had a hard day he's probably got a headache he's got circles under his eyes so you wouldn't want to go up to him and say hey man it looks like you're having a great day so use that sensory acuity we all have it ingrained into us this was he recognized certain social patterns so learning to build on those and understand better patterns excuse me can really help you to to build and maintain that rapport so let's look at some of those things some of these things the sensory acuity pause or delay and voice now here's a perfect example if I ask Joshua did you rob a gas station wait how does it go sorry what

were you doing seven years ago today right you paused you had to like I have no clue but did you rob a gas station seven years ago today okay great so like I'm yeah I guess I am hanging out with but just but just because a person pauses or delays you have to look at the context of it how do you have to look at the context of the question is the person pausing or delaying because of the context of the question or are they doing it because they're being deceptive a great movie that's one of the two movies I had actually in college that we'd watch over and over again so dry mouth can show anxiety or alarm and

allow me to pause for dramatic effect I [Music] do get dry mouth because this is nerve-racking sometimes and we'll go back here to these two so not only can your accent tell you where they're from but their vocabulary levels will tell you their education level so speaking with them generally speaking if you find somebody that has a well I won't generalize so you can understand certain accents when you go in the in some places that are super super heavy they don't use big words you know that you're not gonna go out them with some kind of crazy dictionary and they're not going to understand it because you're never going to be able to to build that

rapport that's it's all about all we're talking about is building that rapport so we don't want to alarm people so when I go into I live in Bessemer City which is outside of Gastonia and it's a very blue-collar town when I go into the restaurants there I don't start dropping all kinds of crazy huge college-level words on people not that I'm that smart to do so but you know you you bring yourself into that situation and you use words and vocabulary they could understand so an accent can't really tell you a lot about a person as far as a starting point to understand kind of who they are and what their background is right you're automatically yeah he

just walked right into it like especially if you more if you're more in tune with yourself and more comfortable with yourself practicing these things will actually help you become more comfortable with yourself even if you don't approach somebody just noticing these small little nuances and things like that can actually help you understand more about yourself and how you're projecting on to to others so that perfect segue body into body language stress levels can change in an instant and this is the sympathetic nervous system or the flight-or-fight response you get nervous you have you your pupils dilate your lips then you've your rigid you're tense although this guy's I think his face is stuck in that

position anyway yeah and he knows like what's going on here's something off-camera Obama was not didn't know what was going on and Michelle's very surprised and maybe it's my time he knows what's going on but those I mean that facial expressions they're are priceless you have no clue what's going on off-camera but Michelle surprised Obama's disgusted you kind of tell that in their face yeah maybe so now this picture was taken this picture was taken during South by Southwest during an interview with Lance Armstrong and this is before it came out that he's actually using drugs so another thing that you can look for in body language is that of shielding where you're hiding your your mouth your eyes

you're deflecting you're looking around you're not making eye contact now a lot of us don't make eye contact because they're a DD but that's you know so in this particular case he was asked about his drug use and so you just kind of thinking about it but that is a sign that there's a possibility of some type of deception happening on that part and of course there's this guy so pupil dilation thinning lips obviously something's wrong here so run if you see that happen now calibration is now we've taken some of these things that we've learned now calibration is actually taking the these things we've learned about the other person gage what state they're in and cultivate that

state in ourselves so if a person's calm then we can become calm and approach that person so that you can build rapport or if we want the opposite effect say we're going after somebody really hard to you know get them in like a manipulation situation where we're trying to get passwords out of them we can start yelling and I'm really quickly and elevate their levels right through the roof but understanding what state they're in allows us to react and change that situation and pretty much an instant that's a pretty good clip demonstrating posture you can actually use this on this each frame he's got a different posture stance and a different facial expression really kind of telling about what he's doing in

this situation so if a person's very comfortable and with you when they when they approach you know then go talk to them you know you're that's open but if generally speaking like the feets closed in a conversation between a person and people who are rigid they're in a conversation they don't want any actual interaction with anyone else but generally speaking if their stance is kind of open they're more relaxed looking you can understand that maybe they would accept somebody else coming and introducing themselves as we've done many times here just in this conference today gesturing is important to understand about body language now if you you know yeah right New York Italian okay or something Italian in general

Jersey Italian but you're not going to approach somebody like that unless you want to turn them off because you want want them to not understand you or if you're speaking to another Italian then that's just the way it happens like my wife she'd have to tire if he tied her hands behind her back she couldn't speak because her gesturing is so articulate that she can't get a thought across with it so if you notice a person if they're gesturing big you can come in big they're gesturing small with your sore hands here if they're crossed arms you kind of understand more about what they're feeling at the time and how to approach them breathing is they kind of

creme de la creme of NLP very hard to master it is proven in hip-hip no hypnosis so you put people in a hypnotic trance the practitioner will actually match his breathing with the other person and in doing so you can actually increase their their breathing rate or decrease their breathing rate depending on how you want to change it now just a tip for you guys breathing obviously happens at the chest so if you're trying to match a female it's probably not the best idea to look at breathing they're the shoulders are perfect to use there so these are some of the things I thought were pretty relevant to this topic and God I got a

chance to share them with you so just to wrap up the mindset of social engineering it really needs to change we throw terms out all over the place we really the media kind of drives these things we drive them because they're sexy we're supposed to be elite hackers and we have all these cool things that we do but in reality it's something that is ingrained in us as humans it's not a technical thing so if we understand all these different tenets all these various aspects we can use them in all aspects of our lives not only protect ourselves and our families but also protect our companies and our businesses by testing our employees by doing these things so

that we can understand more about what attacks might be coming against us so thank you very much anyone have any questions Josh for the stream what term would you use to replace social engineering you you I mean everything you've talked about is part of social engineering as that term is defined today you're not talking about changing the the ways it works you just don't like the term am i right yes and perd that's a pet peeve of mine okay so more it's more of this talk was because obviously in my work as a red teamer I have to do social engineering and really there's not another term that you're going to use and make up that people are

gonna adopt overnight you're gonna be this though your manipulation and deception but you know that doesn't it's not sexy enough it's not sexy yeah your con artist I mean it's not like it seems like social engineering is accepted as that could be a thing that's you know normal whereas if you say I'm a con artist you know instead of a social engineer a con artists or manipulator or deceiver then it's kind of like the the old argument that we've lost about hackers and crackers right you know hackers were the white hats and crackers were the black cats but yeah so you're like well if I call myself a con artist think of like Oh what is he trying to

steal of mine but if I call myself a social engineering Yeah right it becomes like we we've figured out and we let the media run wild with it and now it's stuck and unfortunately we're stuck with it too I try not to use it as much as possible but when I have to speak to executives they understand the term social engineering so I have to use that as well that I really think that we need to focus more on what yes cyber manipulators I have really dip you later somebody whoever is drinking drink we're saying cyber synergist synergistic manipulation and deception of human elements in the attack vector platform framework yeah the 2.0 2.0 C

all we need is like a sexy acronym and whoever does whoever does next-gen he did sexy acronym and whoever does all the artwork for like all the zero days so on the audit way even got it on automated manipulation and deception by reason I mean how do you ever think that uh that some of the people that have made stuff famous like the chemin Nix people like that I think they kind of mess up the game sometimes and everybody wants to be like them and everybody wants to be red teamer nobody wants to defend anything everybody wants to be a social engineer now everybody wants to be a threat Intel it's kind of sad I

hate the way that stuff gets made so sexy and or whatever and nobody wants to do anything else but uh hack stuff and whatever what do you what do you think about that I completely agree I mean our industry like this con just about every con I've been to is all focused on offensive security and guys that have done and kind of you know been like for example Mitnick was a criminal that did this and he wasn't a social engineer back then he was a con man yeah you just don't like the term social engineering because it's too clean to represent that it it is just a con or a lie to get your point across I mean

because what we call social engineering in the security context is one of the biggest things we have to deal with to do the defense so I think I'm missing something that you're trying to get well it really it's it's their misrepresentation of what a social engineer is it's not a defined thing like for example you have to have a license to practice engineering you have to be a licensed engineer and there's actually court cases of people that have said that they are engineers depends on the state correct but there are there are things that have happened out there where people said that there are engineers and certain things and profession you know engineering boards and things like I've gone after and

prosecuted and things like that so just because you want to be an engineer where you necessarily call it that to you know get into systems are not supposed to really hard to be concerned with the fact right that's right then that's kind of that's the kind of thing I'm looking at it's like this is not exactly on point is that we're calling it something that is really is something that's already part of us and we're wanted to be something more than that we're amending to be like like I'm a red team or I'm a social engineer well like exactly politicians the same same thing

it's okay so yeah a problem my problem is this right we have people that's coming up in the game wanna be wanna be in the cybersecurity game first thing they want to do is read a book by kevin Mitnick and in their social engineers as their job titles come on bro nah well that's what it was to me that's it like straight up that's my job I'm a social engineer people but no it's it's people that just do social engineering assessments now like it's a whole thing it's like that's you know it's praising me bro I'm sorry no III agree I think it's important to test our folks against attacks that use manipulation but I don't think I don't

necessarily agree with it being a full-on assessment I mean full-on employment jobs like yeah I mean where we gone off the rails with it right because an engineer is actually something as legislatively like engineering board as Microsoft certified system engineer you're gonna hire me it $190,000 this right but there's a board certified from a legislatively thing you know it's like it's it's like are you a lawyer are you a lawyer because you say your lawyer can you call yourself a lawyer or I guess not a lawyer but an attorney you have to be licensed to do no it's not a good certification right because it's gone through all of the different standard processes that the government

requires right I know that's fine well we'll continue this later out of the bargain right so reference slide I've got it up if anyone's interested some of those books are great all those books are great I had really good time doing this course so I'm thinking so my overarching thing about it's like it's not necessarily an art form that's unique to us it's a it's a complete and total science of sociology and there's degrees and there's doctors and people that study human behaviors and things like that so correct are you licensed as an engineer like if I mean I'll stick on this I'm a computer scientist as well both undergrad and master's degree and it is not engineer even in the startup

circles I still bristle when they want to call everyone software engineers I'm like where we are doing yeah but calling yourself an engineer and not being licensed as an engineer can get you in trouble just as a lawyer practicing as an attorney yes I mean this is this is all just a matter of it's just like the big guilds it's all about guilt professional engineers all right lawyers yeah so let's talk let's let everybody like so let's wrap this up for right now