[MUSIC PLAYING]
Welcome to Social Engineering Fundamentals.
We're going to cover what is social engineering,
some common tactics, and some effective techniques.
So what is social engineering?
I look at it as human manipulation.
You are hacking human beings.
So how do we do this?
The goal of social engineering is either to gain access
or to gather information.
So either we're getting something from the target
or we're getting access via a human being.
There's several different ways of going about this.
So impersonation is huge.
It's a big part of social engineering.
Pretexting, which is setting up a scenario
of already having something in line when you're
dealing with an individual.
An emotional pull is usually a factor in social engineering.
Either it could be fear, it could be urgency,
it could be pleading, pulling at their heartstrings.
Often there might be free stuff in a social engineering attack.
Sometimes there's blackmail and extortion.
And we can look at romance schemes
and some different scams that are part of this as well
as a quid pro quo.
So that's maybe setting someone up for blackmail
or that you give a little, you get a little.
So how is this used?
Phishing has been around for a long, long time.
When we're talking about information security,
that is one of the primo ways of social engineering people.
Alongside that are often watering
hole attacks, which we'll describe in a bit, also
baiting, putting something out there to pull someone in,
and physical access.
It's not always through an email.
It's not always over a phone call, sometimes gaining
physical access or utilizing social engineering
to gain physical access.
Both of those can be a part of this as well.
And I'll describe those in a bit.
So what is phishing?
Phishing was first introduced by AOL back in the '90s
to describe what could happen with scams when people
send you an email trying to get information from you as a user.
Often it could be, hey, welcome to the company.
I'm your CEO.
I'm stuck in a meeting.
And I need you to go out and get some gift cards
and send me the codes off those.
I know I've received those.
I know companies often have streaks
of that, where it's almost a business email compromise.
But getting you to interact and send something to the person.
You might be thinking, what does this
have to do with information security?
We'll get into that in a little bit.
First, we want to talk about the overarching theme
of social engineering.
They might want you to click on a link or download a file.
It might be, hey, here is the invoice,
or, here are the directions for the thing you just signed up
for.
It's using pretexting, something that you already signed up for
or an invoice.
Oh, were you expecting to pay an invoice?
Sometimes a little bit of awareness
helps go a long way as a user, knowing
I shouldn't be getting an invoice this way
or I shouldn't be getting instructions in this matter.
Checking links, checking that files
are what they're supposed to be, having some things in place
for your enterprise, for your business can help with those.
But these are the methods of gaining information.
Now, with phishing, there's a little more.
So there's spear phishing, which is a targeted phishing attack.
If you go after a company, the individuals
add that company or specific people.
Maybe you get a list or maybe the attacker
gets a list of email addresses and names about fans of a team.
Now, going after them with that information
might render some useful results.
There's whaling, which is spear phishing for big targets.
In Vegas and gambling circles, there's
these people called whales.
And it's rich individuals who will spend a lot of money.
Similarly, whaling is going after targets
that have a lot of wealth, that are a big attack surface, not
because of their physicality but because of their assets.
There's smishing, which is like phishing.
But it happens across text messaging, SMS messaging.
So instead of an email, you might get a download
on your phone.
You might get a link on your phone,
say, from a service provider, maybe from your ISP,
maybe from your cell phone carrier,
sending you a text saying, hey, you
need to download this thing so that we
can help you with this problem.
And you're like, I don't know that I have a problem.
But you click on it.
And now they have access.
Or maybe they ask you to send them some information.
Vishing, similar to phishing, happens over the phone.
And it can be potentially very, very dangerous
because if you're not expecting phone calls,
you might give a little bit more trust.
That's what a lot of this comes down to is trust.
Then you should be based on their pretext.
I know in the military, we used to use some pretexting of, oh,
the commander asked me to send you this file.
And we would get people to download the file.
And they're like, I wasn't expecting anything
from the commander.
But I'm going to do it anyways.
So who would fall for this?
Well, often links look like what you're expecting.
If it's from a bank, maybe it looks
like the name of your bank.
That's called pharming, so redirecting web traffic.
Maybe they put a link that's www.yourbank.com.
And you see that, hey, you log in to your account.
And it looks just like the email that you get from your bank.
It looks just like the email you get from your cell phone
carrier to go pay your bill.
You're like, OK.
And you go to click on it.
Well, instead of going to your bank, what it does
is it actually has a URL to a malicious site, where it's
going to pull your credentials.
Or it might take some of your information.
So that's a watering hole, sending you
to a site that looks like a site you trust.
Similarly, depending on where the email is coming from,
you might have business email compromise,
where someone has access to a legitimate business email
and is sending out this malicious email from there.
That is huge.
And it's something that we're going
to cover in just a little bit.
It has huge repercussions.
All of this usually requires some impersonation or spoofing,
saying that you're someone that is trusted, again, taking
advantage of people's trust.
People want to trust.
And so if you approach-- if an attacker approaches
with the method of getting people's trust,
pulling at their heartstrings, pulling at them emotionally,
it tends to work.
And that can be malicious or not.
Speaking of malicious actors, here's
some data that was pulled together by the United States
FBI for 2021.
They have a crime center that organizations or individuals
can send in complaints.
And they get tallied and processed
and often followed up on.
But then at the end of the year, they put this all together.
And this is what we get.
So I've pulled some statistics from the 2021
report, which is very recent to when I'm making this video.
And for the past five years, complaints
have been increasing.
And losses have been increasing.
So what are the most effective techniques?
Well, phishing, vishing, smishing, and pharming far
outweigh all other complaints.
So there are people who are either getting emails or phone
calls or text messages or going to sites that they expect that
end up being malicious sites, losing a lot of money,
and having a lot of this occur.
Similarly, there's a lot of different categories
that they track.
But you'll see in there that business email compromise, BEC,
EAC.
Spoofing are also very common.
Government impersonation is just another form of it.
Overpayment is a scam that runs in a very similar method.
And in this list, you might notice
that malware, scareware, and viruses as well as ransomware
do not have as many complaints as phishing by quite a factor.
There are 323,000 complaints, victims in this study
or in this report.
And nothing else comes close at all.
Now, this is crime data put together by the US FBI.
So understanding who the victims might be also
weighs a little bit into this.
Again, now looking at what the losses are,
business email compromise and then confidence fraud
and romance scams are very high on here
that are social engineering as opposed to investment
fraud or personal data breach.
And tech support losses have been increasing as well, where
someone is impersonating tech support
and getting information from the target.
What's really, really effective--
pharming or spoofing a website.
So here we have several different logins
for the Apple Store.
Which one is the right one?
I'm not going to tell you.
But you might trust all of them if you came across them.
Similarly, now here is an email.
And I've got this information as well as those websites
from IRONSCALES, a company that provides solutions
for email spoofing and phishing attacks
and some worthwhile training.
But they provide this.
And this is a typical phishing email
you've got from a supplier.
If you are a medical organization,
a health care organization, then you
might have a medical supplier send you things.
And if they have an idea of who might be sending things, which
there are common organizations and common businesses that
supply these things, they can put
whoever they want as the sender despite whatever
email is actually being used.
And you might see that it almost looks like a legit email
address.
But for some reason, suppliers has two s's.
This is impersonation.
They might even have a real person.
They might know that emails come from this person
at this organization.
And they can spoof that.
You might also see that there is a link in there.
Now, that link could go to a website that
automatically downloads a file.
It could go to a website that looks like what the victim is
expecting and, actually, puts all their information in
and pays a bill to an organization that
doesn't really exist.
Now baiting.
Baiting is-- it can be used alongside a phishing campaign
of, here, I'm going to give you something.
Or often it is used for rubber duckies.
Rubber duckies in pen testing lingo
are you USBs that are placed around an organization
on the ground, maybe on desks if you get physical access,
or in the parking lot.
And what happens is a USB can be programmed to auto run.
So you plug it in.
And it automatically runs a program.
Now, depending on what the program is,
it might be something simple, like opening a back door
or sending up a key logger and sending that information
to a remote attacker.
It's very effective.
I know many organizations that do pen tests that utilize this
regularly.
A lot of it goes back to the early 2010s.
This was used against the US military overseas.
And since then, USBs are not even allowed at all
on US military networks.
And that's been taken to many organizations, many governments
across the world.
What's really effective is some physical access.
If you can manipulate your way into a building,
get physical access to the network,
you can get around so many blocks and defenses
that are set up to normally keep attackers out.
There's this sense that security is great and perfect.
But with some social engineering,
you can get around what people expect by utilizing some trust.
I know when I was in the Air Force, they said,
if you carried around one of these blue file folders,
it didn't have to have anything in it.
But if you walked around with a blue file folder,
people thought that you should be here
or that you were looking for someone.
And so, usually, you could walk around wherever you wanted.
Now, it isn't always the case.
But you could walk into offices and be like, oh,
is Bob in here?
And people would be like, he's got a blue file folder.
And he's looking for Bob.
There's not a Bob in here.
But there's a Bob somewhere.
So they're just like, oh, no, he's not here.
And you've just given away so much.
You've allowed someone access.
And you haven't even questioned who they are
or why they're there or if they should be there
in the first place.
Similarly, gaining access to a building during rush hour.
When everyone is coming into the office,
maybe it's common for people to forget their badges.
Or if there's turnstiles, it's very common
if people forget things just to let them through because they
got to get to work.
And everyone's there.
And whoever's in charge of security just let
things go perhaps.
There is right now a trend of people making videos
about walking into unauthorized areas
because they're carrying a ladder.
It is hilarious.
And it's scary according to these videos, it works.
People will trust that if you've got tools and a ladder
and you're walking right into the company, right
through the doors, and you wave to the receptionist
and walk in, that you're supposed to be there working
on something.
Impersonating a service person is very, very common.
You could be the cable person.
You could be there for a plumber, an electrician.
If you are wearing the right things and you walk in
and you say the right things, people
will trust you and be like, oh--
especially if you know some inside information, like,
oh, I'm supposed to be talking to Mr.
Miller on the third floor and fixing his toilet.
OK, well, go on up because Mr. Miller isn't someone
I want to bother to ask if you're actually
supposed to be there or not.
So I will let you right in the door
without looking at your credentials or double checking.
This happens.
So what does all of this have to do with cybersecurity,
with information security?
Well, scams against individuals can affect a business.
If you are able to take advantage of one person's
account, maybe financially taking advantage of them
with a scam might not result in a complete business loss.
But those same methods might result
in downloading malicious files and malware,
opening up back doors to the network,
maybe sending business information,
or compromising information that it shouldn't be shared.
All of these as cybersecurity professionals,
we need to be thinking about and setting up
some defenses to protect.
Best way is to stop the attack.
User awareness and training is the number one
prescribed method for preventing phishing, business email
compromise, pharming, and watering hole attacks.
Teaching users not to click links, not to download things,
to check URLs, and check where things are being sent from
and who's sending them, and maybe doing
a little bit of follow up if something looks suspicious,
sending things to the security team when they look suspicious,
that can only be done through user awareness and training.
Similarly, setting up proper security policies and controls,
be it software or hardware, or just having the right
configurations in the software that you already
have might help to defend against this.
Furthermore, defense in depth.
Right now while I'm recording this,
zero trust is a term thrown around very often.
But truth be told, just having things segregated,
blocked off, least privilege is, truthfully,
one of the best ways to prevent something small,
like one person computer being compromised
because they click the link from affecting
the whole network as a whole.
If they have least privilege, if they
can't navigate across the network and proliferate,
then an attacker might only have access to one machine.
If you have the right firewalls in place,
if you have proxies in place, that
might even make it more difficult for this to work.
So defense in depth and covering all of your bases
starting at the lowest level and moving up.
Now, this is all great.
But you might be wondering, isn't this
a pen testing course?
Yes.
And in the next lesson, we're going
to get into, how can we pen test to find vulnerabilities
utilizing social engineering?
I think you'll really enjoy it.