Now that we've talked about what social engineering is,
let's look at what it looks like.
So I'm going to walk through some real-life examples
and see what it looks like in the wild.
So here, we're first going to go through the Google and Facebook
Fake Invoicing scam, the FACC CEO Fraud, Robinhood Vishing
scam, what it looks like with malware as a fake Excel file,
using an HTML table to represent a Windows logo for a business
email compromise, and also FIN7 sending USBs in the mail.
So in 2013 to 2015, someone impersonated
an electronics manufacturer that supplies both Google
and Facebook.
They sent fake invoices with forged executive signatures.
Now, this might not seem like social engineering.
But in order to get the information,
to know who the manufacturer is that supplies both of them,
also to know what the invoices look like,
and to get the executive signatures,
doesn't just randomly happen.
That's from planned social engineering.
It's able to steal hundreds million US dollars.
The culprit was arrested and the funds were recovered,
but still it was a very thorough social engineering scam.
FACC back in 2016, their aircraft manufacturing company,
I think that's in China, and they
had 54 million euros stolen from them through fake president
fraud.
There's someone compromised or impersonated the CEO's email,
sent an email to the CFO seeming urgent
and knowing and sending it at a time where the CEO couldn't
actually respond with the information of hey,
forward or pay this invoice.
Send this money now to our supplier.
Finish the deal.
You have the ability to do it.
And it was such a good or decent impersonation
that the CFO fell for it and/or the finance people fell
for it, sent the money.
And it ended up with the CEO and the CFO of the company
being fired for not having things properly put in place,
so this couldn't happen.
And then the company sued them after they
were fired even though they did recover some of the money
from insurance.
So what that looks like, bad guys will troll companies
and find information gathering.
And then once they have enough information,
you send a phish, so urgent wire transfer request or pay
this time-sensitive invoice.
And people either feel the urgency,
or they feel like they have to do it,
or they don't want to screw up the deal,
so they're going to do their part.
And so they don't check, or maybe they
trust that the scammer, trust that maybe it's
a toxic environment.
And the CEO demands people do what they ask right
when they ask it.
And so this was put together by KnowBe4.
They are a vendor who helps with email fraud,
but you end up with all these fraudulent wire transfers.
And this isn't the only one.
This is just a big one that went poorly.
And it ends up in people being fired in lawsuits
and losing money.
So it's quite a scam, but it is business email compromised.
Here's a real world, and we'll talk about why
it matters in the next lesson.
Robinhood vishing scam.
So back in November of 2021, not too distant from now, someone
called the Robinhood service line,
and they were able to escalate their case up to a point
where they gathered information from the person
on the other end of the phone.
I think they were on the phone for two hours.
In the end, they got enough information
to get over 5 million email addresses.
They had 200 full names, so some of these people's
first and last name.
And for 300 individuals, there will be birthdays and zip
codes.
Now, you put emails, names, birthdays, and zip codes
together, and you can scam a lot of customers.
And then Robinhood would not look great from that.
Fortunately, in that situation, the customer service person
explained their day to their friend.
And their friend is like that's not good.
You should go tell someone.
They talked about the breach and all
that happened and got things sorted,
but it's not a good thing.
So vishing, stealing information through a long phone call
is the thing.
A fake Excel file.
So April 2021, this time last year,
there was a researcher that found this business email
compromise scheme, where someone would send an Excel
file like your finance department saying, hey,
here is the invoice.
Here is the bookkeeping file.
And when someone opens it, it's actually in HTML file.
So they saved an HTML file within dot xls or dot xlxs
file extension, so it looks like an Excel file.
And when they click on it, it says,
how do you want to open this?
And if they choose a browser, then what it does
is it actually reaches out.
It's an HTML file.
So it reaches out to the system that the attacker set up.
It will download a file that then opens up
what looks like an Office 365 login page, which makes sense.
You download a file, and you end up at an Office 365 log in.
And you're like oh, OK, I guess this
is what happens now because your computer did it on its own.
But it's not a real Office 365 page.
Instead, you put it in your office credentials,
and those go back to the attacker.
Now, they have your Office 365, which
could be all of your files, could
be your email, business email compromised, escalation.
It's a slippery slope.
And so that one is pretty neat.
Thinking from an attacker's standpoint, it's neat.
This next one, some email filters
can be set up by administrators.
That will pull out or will look at files
that have images in them.
And if they have images in them, that's the first flag.
And then it might look for some more flags.
Then it'll be like oh, OK, this is spam,
or this is a scam filtered out.
Well, if one of those first things that they jump on
is company logos, another researcher
found that people were getting around it
by instead making a table like what I have here.
This is a table on the bottom half.
It's a four-cell table, and I colored it in the cells.
And then I made the lines match the Windows logo
that I found online.
So tables aren't part of the filter.
So if you get an email from Microsoft
saying you need to log into your account,
and you see their logo, and it says
it's from Microsoft even though if you hover over it,
it says it's from Microsoft or something,
extra letters in their actual attacker domain,
that's how they can get around some of these things.
Finally going to wrap up with quite a scenario.
August to November of 2021, coming
into in the United States and a lot of the Western world,
the Christmas season going through the fall
to Christmas time, packages were sent.
And this did happen in the United States via UPS
and the US Postal Service, that impersonated
the Department of Health, and Health and Human Services,
and Amazon.
So two different boxes that you can get for different labels,
and they had a USB stick inside.
The United States, people were expecting information
about the COVID pandemic from Department of Health and Human
Services or from Amazon.
Maybe it said it was a gift card,
but you had to plug-in the USB to get it.
Well, I'll talk to you about what we can do with USBs,
but they can be loaded with malware that will autorun.
And that's what was set up here.
FIN7 had-- that two investigators
decided who was probably behind this.
People would plug in this USB.
Maybe it would look benign, but what it does
initially is it runs malware.
And it might be keylogger in this situation
since it's less targeted.
It was probably just to set a reverse shells
and get information to put malware on the machine.
But there's lots that can be done with that.
And by impersonation and using people's trust
in known good or known expected organizations,
they can get away with some things.
In the next lesson, we'll then talk
about what we would do as penetration testers
to test whether there are any controls in place to stop
these.
And we will think and act like a scammer.
Think and act like a criminal in order
to find these human vulnerabilities.