Hacking Humans: Social Engineering and Protection

Introduction

• The talk focuses on social engineering, a non-technical subject.
• Key topics covered include:
  • Definition of social engineering.
  • Famous cases of social engineering.
  • Techniques used in social engineering.
  • Protection strategies against social engineers.
• Disclaimer: The goal is to learn how to protect against social engineering, not perform illegal activities.

What is Social Engineering?

• Definition: Influencing someone to take an action that may not be in their best interest.
• Types of Attacks:
  • Phishing: Deceptive emails asking for sensitive info.
  • Vishing: Voice phishing through phone calls.
  • Impersonation: Assuming another's identity.

Famous Social Engineering Cases

• Kevin Mitnick:
  • Notorious hacker turned security consultant.
  • Known for hacking and frauds, spent 5 years in prison.
  • Authored several books on security.
• Frank Abagnale:
  • Con artist, known from "Catch Me If You Can."
  • Impersonated various professionals.
  • Known for escaping custody.
• Charles Ponzi:
  • Known for the Ponzi scheme.
  • Profited from fraudulent mail coupons and pyramid schemes.

Social Engineering Techniques

• Information Gathering: Research targets through dumpster diving, social media, and malware.
• Pretexting: Creating a believable scenario or identity to gain trust and information.
• Elicitation: Extracting information without direct questioning.
• Manipulation: Influencing someone negatively, exploiting psychology.

Common Manipulation Techniques

• Fear-Then-Relief: Creating fear and offering a solution.
• Guilt: Inducing guilt to gain compliance.
• Foot-in-the-Door: Starting with small requests to gain larger favors.

Protecting Against Social Engineering

Personal Mitigation

• Verify IDs of visitors or callers.
• Be cautious of out-of-character questions.
• Escort unknown individuals within office spaces.
• Avoid plugging in unknown USBs.
• Shred sensitive documents.
• Use encryption on devices and drives.

Corporate Mitigation

• Identify valuable information assets and classify them.
• Develop and enforce corporate security policies.
• Keep software updated and patched.
• Utilize document shredding services.
• Consider no company too small to be a target.

Summary

• Social engineering is effective due to human vulnerabilities.
• It poses significant risks as people are the weakest link.
• Training and awareness are key to mitigating social engineering threats.

Resources

• Books by Kevin Mitnick:
  • The Art of Deception
  • The Art of Intrusion
  • Ghost in the Wires
• The Art of Human Hacking by Christopher Hadnagy.
• What Everybody is Saying by Joe Navarro, on body language.

Conclusion

• Presented by Stephen Haunts, co-founder and CTO of LouderPay.
• Encouragement to educate oneself on social engineering tactics and defenses.