Speaker 1: I have to admit I spent I don't know, maybe
Speaker 1: twenty minutes this morning stressing over a new password. I
Speaker 1: did the whole routine, you know, capital letters, a number,
Speaker 1: a special symbol, the whole nine yards, the whole nine yards.
Speaker 1: And I sat there looking at it, thinking, Okay, this
Speaker 1: is it. I am fort Knox. Nobody is getting into
Speaker 1: this account.
Speaker 2: It's a satisfying feeling, though, isn't it locking that digital door?
Speaker 1: It is? But then I started reading the material for
Speaker 1: today's deep dive, and that feeling of security just completely
Speaker 1: evaporated because I realized my twelve character uncrackable password, it's
Speaker 1: just totally useless if I will, if I just tell
Speaker 1: it to you.
Speaker 2: And that is the uncomfortable truth we're digging into today.
Speaker 2: We tend to think of security as a technology problem. Firewalls, encryption,
Speaker 2: two factor off, all the tech stuff, but we almost
Speaker 2: always ignore the single biggest vulnerability in any system. And
Speaker 2: it's not the software. It's not the hardware, it's the meatware.
Speaker 1: It's us, the human being sitting in the chair.
Speaker 2: Precisely today, we're diving into social engineering. The Art of
Speaker 2: Human Hacking by Christopher Hadniggi and this source, it really
Speaker 2: challenges that traditional idea of.
Speaker 3: What a hacker is.
Speaker 1: Yeah, when I think hacker, I picture, you know, a
Speaker 1: guy in a hoodie in a dark room furiously typing
Speaker 1: green code onto a black screen.
Speaker 3: We all do.
Speaker 1: But Hadniggi argues that the most dangerous hackers don't hack computers.
Speaker 1: They hack people. He defines social engineering as and I
Speaker 1: want to get this wording right, the art and science
Speaker 1: of skillfully maneuvering human beings to take action.
Speaker 2: And we should probably clarify that action is usually something
Speaker 2: that is definitely not in their best interest. It's manipulation.
Speaker 2: But it's not just you know, lying, it's manipulation down
Speaker 2: to a science.
Speaker 1: The source uses this metaphor that I found really really helpful.
Speaker 1: It compares a social engineer to a master chef.
Speaker 3: I like that analogy a lot. It really works.
Speaker 1: It makes sense, right, because a chef doesn't just throw
Speaker 1: one raw ingredient on a plate. You don't just hand
Speaker 1: someone to raw potato and call it a meal. You
Speaker 1: have to mix.
Speaker 2: Things right, and in the world of social engineering, those
Speaker 2: ingredients are things like elicitation, pretexting, and psychological triggers.
Speaker 1: So a master social engineer minces them in just the
Speaker 1: right amounts, adds a little pressure or urgency the heat,
Speaker 1: the heat, and serves up the perfect attack. They're blending
Speaker 1: all these elements to bypass your logic and get to
Speaker 1: your emotional control panel.
Speaker 2: Okay, but before we get too deep into this recipe,
Speaker 2: we need to drop a massive disclaimer.
Speaker 1: Here, Yes, a big one.
Speaker 3: The stuff we're.
Speaker 2: Talking about today, this is the playbook used by criminals,
Speaker 2: con artists, spies.
Speaker 1: We have to be crystal clear about that. Yeah, the
Speaker 1: purpose of this deep dive and the purpose of a
Speaker 1: Hadnig's book is strictly security through education. Right.
Speaker 2: You can't defend yourself against a weapon if you don't
Speaker 2: even know what it looks like. We're analyzing these methods
Speaker 2: so you can spot them, not so you can go
Speaker 2: out and use them.
Speaker 1: Please do not rob a bank.
Speaker 3: The police don't.
Speaker 1: All right, So let's look at that first ingredient in
Speaker 1: the chef's kitchen. The source argues this is the foundation
Speaker 1: of every it's information gathering.
Speaker 2: Yeah, there's a quote in there from Napoleon Bonaparte. War
Speaker 2: is ninety percent information. If a social engineer wants to
Speaker 2: target you, they don't just walk up cold they do
Speaker 2: their homework first.
Speaker 1: And when we say homework, we are not talking about
Speaker 1: a quick Google search. The level of detail here is obsessive.
Speaker 1: There's a case study in the book about a guy
Speaker 1: named Madia Heroni.
Speaker 3: Oh yeah, this one's great.
Speaker 1: He's a professional penetration tester. Yeah, one of the good guys.
Speaker 3: Right.
Speaker 2: He's hired to break into this secure banking facility. But
Speaker 2: this place was a fortress, almost zero web footprint, no
Speaker 2: obvious servers to attack, tight physical security, a hard target.
Speaker 1: So the front door is locked, the back doors walk, all.
Speaker 2: The windows are barred exactly. So Madie stops looking at
Speaker 2: the building and starts looking at the people inside. He
Speaker 2: starts digging into the personal lives of the high ranking staff.
Speaker 1: And he finds this one tiny, seemingly useless detail about
Speaker 1: a top executive.
Speaker 3: He was a member of a stamp collecting forum stamp.
Speaker 1: I mean, come on, you literally cannot get a more
Speaker 1: innocent hobby than that.
Speaker 2: It seems innocent to you and me, but to a
Speaker 2: social engineer, that's a golden ticket. Madi saw that this
Speaker 2: executive was really active in threads about rare stamps from
Speaker 2: the nineteen fifties, so.
Speaker 1: He didn't attack the bank. He attacked the hobby.
Speaker 3: He pivoted completely.
Speaker 2: Maddy went and registered a domain Stamp collection dot com
Speaker 2: or something like that. He built a fake website, filled
Speaker 2: it with pictures of these rare nineteen fifties stamps.
Speaker 1: And then he crafted the perfect.
Speaker 2: Email, posing as someone who just inherited his grandfather's collection.
Speaker 3: Hey, I have these old stamps. Are they worth anything?
Speaker 1: That was the hook, and he sends this to the
Speaker 1: executive's corporate email.
Speaker 3: Now you gotta put yourself in the executive's shoes.
Speaker 2: You're at work thinking about spreadsheets, right Suddenly an email
Speaker 2: pops up about your absolute favorite niche passion. Your guard
Speaker 2: doesn't just go down, it vanishes.
Speaker 1: He clicks the link.
Speaker 2: Of course, he clicks the link, and that's where the
Speaker 2: tech comes in. The website had a malicious frame embedded
Speaker 2: in it that exploited a vulnerability and Internet explorer.
Speaker 1: So he didn't even have to download a file called
Speaker 1: virus dot ex or anything.
Speaker 2: Nope, he just had to look at the pretty stamps.
Speaker 2: The moment the page loaded, Maddy had control of his
Speaker 2: computer and through that the entire banking network.
Speaker 1: That is terrifying because the executive didn't do anything stupid,
Speaker 1: you know, he just engaged with his hobby.
Speaker 3: That's the chef at work.
Speaker 2: But information gathering isn't always that high tech. Sometimes it's
Speaker 2: remarkably gross. We have to talk about dumpster diving.
Speaker 1: I was hoping we'd get here. The book spans a
Speaker 1: surprising amount of time on trash. I guess the logic
Speaker 1: is one man's trash is another man's password.
Speaker 3: It's a gold mine.
Speaker 2: People assume that once they toss something in the bin,
Speaker 2: it just sort of disappeared.
Speaker 1: Yeah, into the magic trash void.
Speaker 2: But until that truck comes, it's fair game. The source
Speaker 2: tells this story about the Canadian CTU, the counter Terrorism Unit.
Speaker 1: Now, if I'm thinking secure organizations, these guys are at
Speaker 1: the top of my.
Speaker 3: List, you would hope so.
Speaker 2: But a social engineer, just to prove a point during
Speaker 2: an audit, went through their garbage and he found top
Speaker 2: secret defense documents.
Speaker 1: No way.
Speaker 3: Oh yeah, we're talking.
Speaker 2: Floor plans of the Canadian Joint Incident Response Unit, locations
Speaker 2: of security fences, patrol schedules.
Speaker 3: Just sitting there in a bag.
Speaker 1: Thatd is just negligence on a whole other level. Yeah,
Speaker 1: but surely most places shred that stuff.
Speaker 2: They do, but even then people mess it up. I
Speaker 2: didn't realize there was such a strict hierarchy of shredders.
Speaker 1: The strip cut versus crosscut debate.
Speaker 3: Yeah, it matters so much.
Speaker 2: Most people buy those cheap strip cut shudders that turn
Speaker 2: paper into what spaghetti?
Speaker 1: Yeah, like long ribbons exactly.
Speaker 2: Well, if you have enough patients, and social engineers have
Speaker 2: infinite patients, you can just tape those back together. There's
Speaker 2: even software that can do it for you now.
Speaker 1: So a strip cut shredder is basically just a puzzle
Speaker 1: maker for bad guys pretty much.
Speaker 2: The source says, you need a crosscut shredder, the kind
Speaker 2: that turns paper into confetti, a fine minced mess. You
Speaker 2: aren't taping that back together, No.
Speaker 1: To self, buy a better shredder. Yeah, but it's not
Speaker 1: just physical anymore. It's digital. The book uses this TERMO
Speaker 1: loved digital exhaust.
Speaker 2: It's a perfect metaphor. Right, we leave traces of ourselves
Speaker 2: everywhere online. The source mentions a site called icanstockhu dot com.
Speaker 2: It doesn't exist anymore, but it showed how dangerous geotagging is.
Speaker 1: That's when your phone embeds the GPS coordinates right into
Speaker 1: the photo file.
Speaker 2: Yes, so people were posting pictures of their cats or
Speaker 2: their dinner on Twitter. This site just scraped those photos
Speaker 2: and plotted them on a map in real time so
Speaker 2: you could see, Oh, user one two three is that
Speaker 2: this specific intersection right now?
Speaker 1: Or even worse, User one two three is in Hawaii,
Speaker 1: which really means User one two three is definitely not
Speaker 1: at home, so come rob their house exactly.
Speaker 2: It's creating a pattern of life, and that brings us
Speaker 2: to the next big section. Once you have the dots,
Speaker 2: the info, you have to connect them, and you do
Speaker 2: that by talking to people.
Speaker 3: This is the art of elicitation.
Speaker 1: Elicitation it's one of those things that feels like a
Speaker 1: superpower once you learn what it is. The book defines
Speaker 1: it as the subtle extraction of information during an apparently
Speaker 1: normal conversation.
Speaker 2: The keyword there is normal. It can't feel like an
Speaker 2: interrogation right.
Speaker 1: If it does, you've failed.
Speaker 2: It relies on our deep seated human programming. We're wired
Speaker 2: to be polite, to seem helpful, to look intelligent. We
Speaker 2: love to be praised, and.
Speaker 1: There's this specific technique in the book called the false statement.
Speaker 1: I actually tried this on a friend the other day,
Speaker 1: and I was shocked at how fast it worked.
Speaker 3: It is frightfully effective.
Speaker 1: Yeah.
Speaker 2: The basic idea is, if you want the truth, don't
Speaker 2: ask a question, tell a lie.
Speaker 1: Right, Because people have this burning need to correct others. Yeah,
Speaker 1: we hate being wrong, but we love pointing out when
Speaker 1: someone else's it's the ego.
Speaker 2: So a social engineer doesn't ask what were your sales
Speaker 2: last quarter? That's a huge red flag.
Speaker 1: Instead they lean in and say something like, man, I
Speaker 1: heard you guys had a rough quarter. Rumor as sales
Speaker 1: are down to like, what, twenty three percent, And.
Speaker 2: The employee's brain just snaps, what, No, way, we did great,
Speaker 2: we were at thirty percent.
Speaker 1: And boom, you just handed over proprietary data. Yeah, and
Speaker 1: you feel good about it because you defended your company, You.
Speaker 3: Corrected him misconception. You don't even realize you've been played.
Speaker 1: There's a much heavier example in the book, though it
Speaker 1: involves nuclear weapons. This one gave me chills.
Speaker 2: This is the story of the senior scientists from Los
Speaker 2: Almos who visited China in nineteen eighty. Now this guy
Speaker 2: knew the Chinese scientists were going to pump him for
Speaker 2: info on neutron.
Speaker 1: Bombs, so he had his guard up. He was ready
Speaker 1: for the interrogation.
Speaker 2: He was, and he stonewalled them on every classified question.
Speaker 2: But elicitation works best when your guard is down. So
Speaker 2: there's a dinner, cocktails, toasts, everyone's relaxed.
Speaker 1: And he starts telling a story.
Speaker 2: He uses an analogy. He's trying to explain fusion, so
Speaker 2: he makes a hand gesture. He talks about rolling deterium
Speaker 2: and tritium into a ball and then rolling them off
Speaker 2: a table.
Speaker 1: Now to me, that sounds like this. It's not nonsense
Speaker 1: rolling off a table.
Speaker 2: To a lay person, yes, But to the Chinese researchers
Speaker 2: who were stuck on how to ignite the reaction, that
Speaker 2: was everything. By describing it as rolling a ball, he
Speaker 2: was inadvertently confirming a theory about spherical compression.
Speaker 1: He didn't give a formula, but that one little analogy that.
Speaker 2: Was a missing puzzle piece. He gave away the method
Speaker 2: of ignition with a hand gesture because he wanted to
Speaker 2: tell a good story.
Speaker 1: Wow. Speaking of manipulation, there's another trick called preloading. This
Speaker 1: is less about getting info out and more about planting
Speaker 1: an idea. Right.
Speaker 2: Preloading is about manipulating the context, so that when you
Speaker 2: ask for something, the answer is already yes in the
Speaker 2: target's brain.
Speaker 1: The book uses the steak dinner strategy. I feel like
Speaker 1: I've been the victim of this one.
Speaker 2: We all have a husband wants steak, knows his wife
Speaker 2: hates the steakhouse.
Speaker 3: If he just asked directly, she'll say no.
Speaker 1: So he asked a hacker in a way.
Speaker 2: Early in the day, he mentions how good the neighbor's
Speaker 2: grilling smells. Later, he leaves a coupon for the steakhouse
Speaker 2: on the counter. He's setting the stage.
Speaker 1: He's marinating her brain in the.
Speaker 2: Idea of steak exactly by the time he actually asked,
Speaker 2: she's much more likely to say yes. He manipulated the
Speaker 2: sensory input to get the results he wanted.
Speaker 1: Okay, so we've gathered the ingredients, we've mixed them with elicitation.
Speaker 1: Now we get to the performance. Section three. Pre Texting.
Speaker 2: Pretexting is what people usually think of as the con
Speaker 2: but the book makes a key distinction. It is not
Speaker 2: just lying. Lying is saying I'm a doctor.
Speaker 1: Pretexting is wearing the scrubs, having the stethoscope, knowing the jargon,
Speaker 1: and acting like you're late for surgery. It's method acting.
Speaker 2: And the golden rule here is simplicity. Amateurs create these
Speaker 2: super elaborate backstories that fall apart under pressure. A good
Speaker 2: pretext is simple, Hi, I'm from it, I'm here to
Speaker 2: fix the printer.
Speaker 1: We have to talk about the Stanley Mark Rifkin heist.
Speaker 1: This case, steady reads like a movie.
Speaker 2: It's a classic. Riffkin was a computer consultant for a bank.
Speaker 2: He had a badge that got him in the building.
Speaker 2: He walks down to the secure wire transfer room.
Speaker 1: He just walks in like he.
Speaker 3: Owns the place.
Speaker 2: He's taking notes, acting busy, and he spots the daily
Speaker 2: transfer code written on a piece of paper pinned to
Speaker 2: the wall.
Speaker 1: Which can we just pause on that writing the password on.
Speaker 3: The wall huge failure.
Speaker 2: But notice what Rifkin does. He doesn't steal anything. He
Speaker 2: memorizes the code and walks out. He goes to a payphone.
Speaker 1: This was the seventies, right.
Speaker 2: And he calls the very room he was just in,
Speaker 2: And this is the pretext. He becomes Mike Hanson, a
Speaker 2: branch manager. He's casual, professional. He gives the clerk the
Speaker 2: code he just memorized, and.
Speaker 1: Because he had the code, the clerk trusted the voice exactly.
Speaker 2: The clerk's brain thinks only authorized people have the code,
Speaker 2: so Mike Hanson must be real. Rifkin transferred ten point two.
Speaker 1: Million dollars, ten million dollars, No guns, no masks, no
Speaker 1: computer hacking, just a payphone and a fake name.
Speaker 2: That is the power of a good pretext. But it's
Speaker 2: not just lone wolves. The book brings up the Hewlett
Speaker 2: Packard scandal. This was corporate warfare.
Speaker 1: Yeah, this one shocked me.
Speaker 2: The chairman of HP was trying to find a leak
Speaker 2: on her board, so she hired security consultants who started
Speaker 2: calling phone companies and.
Speaker 1: They pretended to be the board members themselves.
Speaker 3: They did.
Speaker 2: They impersonated them, use their social security numbers, and use
Speaker 2: these heartfelt please to customer service reps to get their
Speaker 2: personal phone records.
Speaker 1: Wow.
Speaker 3: It shows that.
Speaker 2: Even at the highest levels, these tactics are used because
Speaker 2: they work. It really blurs the line between a security
Speaker 2: audit and a criminal act.
Speaker 1: So underneath all of this there's a psychological game being played.
Speaker 1: The book talks about thinking like a hacker.
Speaker 2: It's a total mindset shift. A normal person sees a
Speaker 2: trash bag as garbage a social engineer sees it as
Speaker 2: a puzzle.
Speaker 1: There's that story about the rental car.
Speaker 2: Right, a social engineer found a ripped up check in
Speaker 2: a rental car. Most people would ignore it. This guy
Speaker 2: taped it back together. He had the account number, the name,
Speaker 2: everything for identity theft. He saw value where we see waste.
Speaker 1: And then there's cognitive dissonance. How does a hacker use that.
Speaker 2: It's that uncomfortable feeling you get when you hold two
Speaker 2: conflicting beliefs. Your brain hates it and wants to resolve
Speaker 2: it immediately.
Speaker 1: Okay, so give meetings.
Speaker 2: A guy walks into your restricted office. He's wearing a
Speaker 2: confident smile and holding a clipboard. Your brain sees two
Speaker 2: things belief A intruder belief B he looks like he
Speaker 2: belongs here.
Speaker 1: In my brain wants the path of least resistance exactly.
Speaker 2: It's socially awkward to confront someone. It's easy to assume
Speaker 2: they belong so your brain just decides, I mean, it's
Speaker 2: probably fine. The social engineer uses your own politeness against you.
Speaker 1: There's one last concept that sounds like it's from a
Speaker 1: sci fi novel, the human buffer overflow.
Speaker 2: Yeah, so in computing a buffer overflow is when you
Speaker 2: flood a program with too much data and it crashes,
Speaker 2: letting you rewrite the code.
Speaker 1: And the theory is you can do the same thing
Speaker 1: to a person.
Speaker 2: You overload their sensory input. Think of a mother with
Speaker 2: a screaming baby at an airline counter. The attendant is
Speaker 2: being hit with auditory stress, emotional stress, social pressure.
Speaker 1: Their brain just locks up.
Speaker 2: It stops processing logic, it goes into survival mode. The
Speaker 2: attendant might just stamp the ticket to make the noise
Speaker 2: stop bypath protocol.
Speaker 1: And a social engineer can fake that chaos.
Speaker 2: They can manufacture it. They can scream, act furious, create
Speaker 2: artificial urgency to overload you so that you stop thinking
Speaker 2: and just react.
Speaker 1: That is devious. So where does this leave us? I
Speaker 1: mean it feels like the deck is stacked against us.
Speaker 3: It can feel that way.
Speaker 2: But remember the goal security through education, right.
Speaker 1: You can't patch a human like you patch software. I
Speaker 1: can't download a security update from my brain.
Speaker 2: No, but you can upgrade your own software through knowledge.
Speaker 2: If you know elicitation is a real technique, you'll pause
Speaker 2: the next time a stranger asks a weirdly specific question
Speaker 2: about your work.
Speaker 1: And if you know about pretexting. You'll actually double check
Speaker 1: the ide of the guy who says he's from the.
Speaker 3: Water company exactly.
Speaker 2: It's about moving your default setting from trust to verify.
Speaker 1: I want to leave everyone with a final thought that
Speaker 1: really stuck with me. We talk about digital exhaust. I
Speaker 1: want you to think about your own life for a second.
Speaker 3: It's a scary thought experiment.
Speaker 1: Spend just one week digging through your trash, reading your
Speaker 1: shredded mail, and looking at the geotags in your last
Speaker 1: five photos. Could they become you? Could they walk into
Speaker 1: your bank and convince the teller they are you.
Speaker 2: That is the question everyone should ask themselves before they
Speaker 2: post that next photo or toss that bank statement.
Speaker 3: In the bin.
Speaker 1: Definitely something Tom all over, Stay safe out there, watch
Speaker 1: your trash, and thanks for listening to this deep dive.
Speaker 3: Be safe.