Speaker 1: Right, Welcome back everyone, Ready for another deep dive Today.
Speaker 1: We're going to be digging into social engineering.
Speaker 2: Ooh interesting, which I think.
Speaker 1: We all kind of have an idea of what it is, right,
Speaker 1: but this is going to be a really fascinating deep dive.
Speaker 1: We're using The Social Engineer's Playbook by Jeremiah Talamantes. Have
Speaker 1: you ever heard of this book?
Speaker 2: I have. It's really interesting.
Speaker 1: Yeah. It's packed with like all sorts of crazy statistics
Speaker 1: and real world examples and stuff like that.
Speaker 3: Yeah.
Speaker 2: I think what it does a good job of is
Speaker 2: that it highlights how social engineering it goes beyond just
Speaker 2: like the hacking, you know, the computers and stuff. It's
Speaker 2: about understanding human nature, yeah, and how we can exploit
Speaker 2: those those tendencies that we all have right to trust
Speaker 2: and be helpful, to be liked to belives exactly.
Speaker 1: Yeah, and especially you know in the world that we
Speaker 1: live in today, right, Yeah, which is like this hyper
Speaker 1: connected world. Like I mean, the book mentions that back
Speaker 1: in twenty twelve, thirty seven percent of data breaches involves
Speaker 1: social engineering. Wow, that's according to Verizon Data Breach Report.
Speaker 2: It's probably only gone up from there. Yeah, And I
Speaker 2: think the other thing too, is that you know, we're
Speaker 2: not just talking about online scams anymore. Right, Physical social
Speaker 2: engineering tactics are on the rise. It's like the con
Speaker 2: artist has gone digital in a way. Yeah, because now
Speaker 2: you can reach so many more people.
Speaker 1: Yeah, So okay, let's just kind of break it down,
Speaker 1: like what exactly is social engineering? So the book defines
Speaker 1: it as like manipulating people into taking actions or revealing
Speaker 1: sensitive information that ultimately goes against their best interests. So
Speaker 1: it's really all about the abuse.
Speaker 3: Of trust totally.
Speaker 2: And that's why it's so important for you listening to
Speaker 2: this to understand the different types, right, because it's not
Speaker 2: just about oh, I'm not going to fall for that
Speaker 2: phishing email. It can affect social engineering can affect anyone anywhere,
Speaker 2: and it can take many forms.
Speaker 1: Yeah. Like, for instance, the book talks about this security
Speaker 1: consultant Steve stasuconis I believe is how you pronounce his name?
Speaker 1: Who scottered USB drives labeled payroll or swim suit picks
Speaker 1: around a company's entrance? Can you believe that?
Speaker 3: Pretty genius?
Speaker 1: Actually?
Speaker 2: I know, right, if you think about it, it preys
Speaker 2: on our innate curiosity, right, like to uncover a mystery
Speaker 2: or you know, get a great deal, right.
Speaker 1: I mean I have to admit I would be very
Speaker 1: tempted me too, Yeah, I would be very tempted to
Speaker 1: be like, what's on this thing?
Speaker 2: Yeah, like what's on there?
Speaker 1: Especially the swimsuit picks? Come on?
Speaker 2: Yeah, especially and like who's who are the swimsuit picks of?
Speaker 1: Right? Right? Exactly? Yeah. So, I mean it really makes
Speaker 1: you realize, you know, just how vulnerable we all are,
Speaker 1: absolutely to these kinds of tactics, totally. Yeah.
Speaker 2: And I think what makes this even more complex is
Speaker 2: the psychology behind it all. So the book actually dedicates
Speaker 2: a whole chapter to how social engineers manipulate us using
Speaker 2: Robert Saldini's principles of persuasion.
Speaker 1: Yeah. So it's not just trickery. It's like understanding, you know,
Speaker 1: how our minds work.
Speaker 2: It's like they're hacking our brain.
Speaker 1: Right exactly, Yet.
Speaker 2: Not just our computers, but our actual brains.
Speaker 1: The thing about Chaldeani's work, and the reason why it's
Speaker 1: so so relevant here is because these are deeply ingrained
Speaker 1: persuasive techniques in human behavior totally, right, Like we are
Speaker 1: in many ways wired to respond to these.
Speaker 2: I don't even realize it, yeah, right exactly.
Speaker 1: Which is what makes us such prime targets for social engineers.
Speaker 1: So let's dive into some of these tactics one by
Speaker 1: one and see how they play out in the real world. Right.
Speaker 1: So the first one is reciprocity.
Speaker 2: Okay, reciprocity right, So this is the idea, right that
Speaker 2: if someone does something nice for you, you almost feel
Speaker 2: obligated to return the favor.
Speaker 1: Yeah.
Speaker 2: The book gives a very specific example which I love,
Speaker 2: which is like someone offers to light your cigarette in
Speaker 2: a smoking area. Oh interesting, and then later on they
Speaker 2: might need to get into a secure area, and so
Speaker 2: they ask you, hey, can you hold the door, and
Speaker 2: you're like, oh yeah, sure, you know, because they were
Speaker 2: nice to you earlier and just trying to be a.
Speaker 1: Polite right, And all of a sudden you've given someone
Speaker 1: access to like a restricted area or something exactly.
Speaker 3: That's it.
Speaker 2: So the takeaway for you is to be to be cautious, right,
Speaker 2: especially if you're in a security sensitive environment and someone's like, hey,
Speaker 2: can I get that for you? Can I do this
Speaker 2: for you? Just be cautious, like what's their motivation? Why
Speaker 2: are they going out of their way? What's going on?
Speaker 1: Yeah, that's a good point. It's easy to get caught
Speaker 1: up in the moment, you know, absolutely, and not think
Speaker 1: about the bigger picture. Okay, so what about authority?
Speaker 2: Authority classic, so we are conditioned right to obey authority
Speaker 2: figures even if they're fake.
Speaker 1: Yeah.
Speaker 2: And so the book uses the example of like the
Speaker 2: it guy needs access to the server room, right.
Speaker 1: Like, we just I don't know, I feel like our
Speaker 1: brains go on autopilot in those situations. It's you you
Speaker 1: see a uniform or hear like a voice of authority,
Speaker 1: and you're just like, oh, yeah, okay, they must be
Speaker 1: legitimate it.
Speaker 2: Yeah. And so this really highlights the importance of verifying authority,
Speaker 2: you know, don't be afraid, especially when it comes to
Speaker 2: like sensitive information or giving someone access to something, ask
Speaker 2: for identification, double check with you know, the department. It's
Speaker 2: much better to be safe than sorry.
Speaker 1: Right, exactly, absolutely, Okay, what about scarcity scarce?
Speaker 2: This is where they kind of, you know, social engineers
Speaker 2: use a sense of urgency to try to force you
Speaker 2: to make a quick decision. So the book gives an
Speaker 2: example of like a frantic call from the COO, right,
Speaker 2: like the CEO is locked out of their account and
Speaker 2: there's a big presentation and they need you to reset
Speaker 2: the password right now.
Speaker 1: Oh my gosh.
Speaker 2: Yeah, you can just imagine that stress and that pressure,
Speaker 2: right and you're just like, oh my gosh, I need
Speaker 2: to fix this right now.
Speaker 1: Right exactly.
Speaker 2: You know, So anytime you feel that pressure, those pressure
Speaker 2: tactics like that should be a huge red flag, right,
Speaker 2: take a breath, verify the situation, and remember that there's
Speaker 2: very rarely a true emergency in any of these situations.
Speaker 2: It's better to be slightly delayed than to compromise security.
Speaker 1: Absolutely. Yeah. Okay, so we've got reciprocity, authority, and scarcity.
Speaker 2: What's next next is likability?
Speaker 1: Likability Okay, this one's kind.
Speaker 2: Of straightforward, which is that we comply with people that
Speaker 2: we like or who seem similar to ourselves, right, like human.
Speaker 1: Nature to want to like help people we connect with totally.
Speaker 2: But this is where it gets true, okay, because be
Speaker 2: mindful of how much personal information you're sharing, especially with
Speaker 2: people you don't really know, right, even if they seem friendly,
Speaker 2: that could be a tactic, right to build that rapport
Speaker 2: with you for manipulation later on.
Speaker 1: So like set boundaries absolutely, and just you know, don't
Speaker 1: be too quick to trust someone just because they seem relatable.
Speaker 1: Totally okay, what about concession?
Speaker 2: Concession? So this is where a social engineer starts with
Speaker 2: a big request and then concedes to something smaller, which
Speaker 2: makes you feel like you've won the negotiation.
Speaker 1: Right, It's like you're using your own desire to like
Speaker 1: compromise it.
Speaker 3: Gets exactly, Yeah, that's it.
Speaker 2: So really the key here is to recognize any negotiation
Speaker 2: where you feel pressured is suspicious, right right, ask yourself,
Speaker 2: what are they getting out of this deal? Are you
Speaker 2: truly winning or are they manipulating you to get what
Speaker 2: they want?
Speaker 1: Yeah, so be aware of the power dynamics, Yeah, totally
Speaker 1: at play, and don't be free to walk away exactly. Yeah, yeah,
Speaker 1: if it feels off, If it feels off, okay. And last,
Speaker 1: but not least, on our list of like psychological uh
Speaker 1: you know, tactics here is obligation.
Speaker 3: Okay. Obligation.
Speaker 2: So this is when a social engineer gives you something,
Speaker 2: maybe a small gift or some information, to make you
Speaker 2: feel indebted to them.
Speaker 1: Right, So they're creating a sense of reciprocity.
Speaker 2: Exactly before they even like make the ass exactly.
Speaker 3: Yeah.
Speaker 2: So it's important to be wary of those strings attached,
Speaker 2: Like what might they ask for later? Is there a
Speaker 2: hidden cost to that free gift or helpful information?
Speaker 1: Right? So think critically, yes, and don't let your feelings.
Speaker 2: You know, feelings get in the way.
Speaker 1: Cloud you judgment. Right. Okay, So I think what's so
Speaker 1: fascinating about all this is that these tactics, I mean,
Speaker 1: we're talking about them in the context of social engineering,
Speaker 1: but they are used in everyday life.
Speaker 2: Oh yeah, all the time, all the time, right.
Speaker 1: And I'm like already starting to see it.
Speaker 2: It's like you put on a whole new lens to
Speaker 2: view the world.
Speaker 1: Right exactly, Yeah, like how people are trying to influence us. Absolutely,
Speaker 1: It's it's a little scary but also like kind of
Speaker 1: fascinating to it.
Speaker 3: It is fascinating.
Speaker 2: Yeah, it's like you can't you can't unsee it once
Speaker 2: you start seeing it.
Speaker 1: Okay, So we've kind of covered this like psychological foundation,
Speaker 1: right of social engineering, But now I'm curious about how,
Speaker 1: like how do they actually put these tactics into practice?
Speaker 2: So that brings us to like the next one of
Speaker 2: the more like intriguing things. I think the book talks
Speaker 2: about which is the concept of elicitation. So it's about
Speaker 2: subtly extracting information from someone without them realizing.
Speaker 3: They're being probed sneaking.
Speaker 2: It is, it is, And it's really about asking the
Speaker 2: right questions, listening very carefully, and then piecing together, you know,
Speaker 2: what seems like in ocuous details to build a bigger picture.
Speaker 1: So it's not just being chatty, it's being like strategically chatty.
Speaker 2: Yes, it's weaponized chattiness.
Speaker 1: Right, exactly. Yeah, And what makes it, I think, so
Speaker 1: powerful is that it plays on our natural tendencies to
Speaker 1: connect with others, to share information and to.
Speaker 3: Help exactly right.
Speaker 1: Okay, so let's break down some of these elicitation techniques
Speaker 1: that are mentioned in the book. So, one of the
Speaker 1: first ones is flattery.
Speaker 3: Flattery.
Speaker 2: Yeah, so because we all love a little bit of praise, right, Like,
Speaker 2: who doesn't like to be like complimented, right, And so
Speaker 2: they know how to use it, right, They'll shower you
Speaker 2: with compliments, make you feel good about yourself, and therefore
Speaker 2: you're much more inclined to open up share information. You know.
Speaker 1: It's amazing how like a few well placed compliments can
Speaker 1: just like lower our guard.
Speaker 3: It really is.
Speaker 1: Yeah.
Speaker 2: So The takeaway for you is to be wary of flattery, right,
Speaker 2: especially from people you don't know well if they're fishing
Speaker 2: for details, especially about work or personal life. Be cautious
Speaker 2: how much are you revealing?
Speaker 1: Keep the bragging in check exact, especially with strangers. Yeah, okay,
Speaker 1: So what about false statements?
Speaker 2: False statements? So the idea here is that we can't
Speaker 2: resist correcting someone who's dead wrong. Oh yeah, that's true,
Speaker 2: and then in the process of correcting them, we might
Speaker 2: accidentally reveal confidential information.
Speaker 1: Yeah that's so true, because you're you know, you're so
Speaker 1: focused on setting the record straight total that you don't
Speaker 1: even realize you're giving away sensitive information exactly. Yeah, So
Speaker 1: just a reminder to be careful about how much insider knowledge. Yeah,
Speaker 1: you know you're sharing, even if you think you're just
Speaker 1: being helpful.
Speaker 2: Totally think about the consequences before you.
Speaker 1: Speak, right, exactly, So think before you speak, and don't
Speaker 1: let your desire to be right override your sense of security.
Speaker 3: Good one.
Speaker 1: Yeah, okay, So next, artificial ignorance.
Speaker 2: What is that artificial ignorance? This is where a social
Speaker 2: engineer plays them okay, to get you to explain things.
Speaker 1: Oh, so they're using our helpfulness against it. Yeah.
Speaker 2: They might pretend to be unfamiliar with your field or
Speaker 2: a particular process, right, and then they're prompting you to
Speaker 2: explain it to them, and in the process, you might
Speaker 2: reveal something you shouldn't.
Speaker 1: Oh. Wow, that's so subtle.
Speaker 3: It is subtle.
Speaker 1: Yeah, it's like they're leading you down a path but
Speaker 1: you don't even realize it.
Speaker 3: Exactly.
Speaker 2: Yeah, So be wary of overly curious strangers who seem
Speaker 2: oddly uninformed about your field could be a ploy to
Speaker 2: get you to lower your guard and divulge information you shouldn't.
Speaker 1: Yeah. So it's about like trusting our instincts, I know.
Speaker 1: Yea if someone's questions, you know, feel a little too probing,
Speaker 1: or you know, their lack of knowledge feels suspicious, exactly,
Speaker 1: we should be cautious. Okay. Now, sounding board, this is
Speaker 1: a new one for me.
Speaker 3: Sounding board.
Speaker 2: So this is where the social engineer pretends to be
Speaker 2: like a sympathetic listener, and so they encourage you to
Speaker 2: like vent about your work or brag about your work
Speaker 2: or your personal Oh.
Speaker 1: So they're like creating a safe space for you.
Speaker 2: To overshare exactly.
Speaker 1: Okay.
Speaker 2: Yeah, and then in the process you're unwittingly revealing information
Speaker 2: that could be used against you or your organization.
Speaker 1: It's amazing, how like, you know, just having that feeling
Speaker 1: that someone's on your side absolutely and just completely lower our.
Speaker 2: Guard you can. Yeah, it's a reminder that even venting
Speaker 2: or celebrating, like even when you're happy, right, can leak information.
Speaker 1: Right, So think twice, Think twice before you open up,
Speaker 1: even to people who seem trustworthy.
Speaker 2: Yeah, think about the potential consequences, right.
Speaker 1: So, like, be mindful of our audience absolutely, even in
Speaker 1: casual conversations.
Speaker 2: Even casually, we never know who's.
Speaker 1: Listening or how they might use that information.
Speaker 2: Never know.
Speaker 1: Okay, bracketing, this is a weird one.
Speaker 2: Bracketing. Yeah, so this is a technique where the social
Speaker 2: engineer throws out wild guesses, either too high or too low,
Speaker 2: to get you to give a more accurate answer.
Speaker 1: Oh. So they're using a process of elimination.
Speaker 3: They are, Yeah, they are to narrow it down exactly.
Speaker 2: For example, they might say something like I bet your
Speaker 2: company has at least five hundred employees, right, and then
Speaker 2: you correct them and say, well, actually no, we have
Speaker 2: closer to two hundred.
Speaker 3: They just elicited you know that's so clever, A good one.
Speaker 1: Yeah, I would have never thought of that.
Speaker 3: Yeah.
Speaker 2: So it's a reminder that if someone's pushing for numbers
Speaker 2: or specifics, that's a sign they're not just making casual conversation.
Speaker 1: Okay, be cautious. Yeah, so pay attention to the types
Speaker 1: of questions people are asking, absolutely, and don't be afraid
Speaker 1: to like be vague or evasive if you feel uncomfortable.
Speaker 2: Yeah, don't give it to them, right exactly.
Speaker 1: Okay. And last, but not least, confidential baiting. This is
Speaker 1: the one that like, I don't know it, just it
Speaker 1: feels wrong.
Speaker 2: It does feel wrong. It's like, come on, Yeah, so
Speaker 2: this is where a social engineer shares fake secrets to
Speaker 2: get you to reciprocate with real ones.
Speaker 1: Oh, it's like they're playing a game of like informational Chicken.
Speaker 3: They are, they are.
Speaker 1: Yeah.
Speaker 2: They'll say something like, just between you and me, I
Speaker 2: heard our departments getting a huge budget increase next year.
Speaker 2: Oh yeah, And if you're not careful, you might be like, oh, really, well,
Speaker 2: I heard we're getting a whole new software.
Speaker 1: System, right, you know, just get caught up in.
Speaker 3: It, you do.
Speaker 2: Yeah, So be extremely cautious. Yeah, shared secrets aren't always confidential, right,
Speaker 2: It could be a ploy.
Speaker 1: Okay, so the lesson here be very cautious about what
Speaker 1: you reveal, absolutely, even if someone else sees to be
Speaker 1: sharing sensitive information exactly. Okay, So we've talked about elicitation,
Speaker 1: these like sneaky tactics that are designed to get us
Speaker 1: to spill the beans without even realizing it. But what
Speaker 1: happens when social engineering gets even more theatrical. That's where
Speaker 1: pretexting comes in.
Speaker 3: You got it.
Speaker 2: Pretexting This takes it to a whole new level. It's
Speaker 2: about creating believable scenarios sometimes with like fake identities, backstories,
Speaker 2: even props, to gain your trust and achieve their goals.
Speaker 1: So they're like putting on a performance.
Speaker 2: Totally, Yeah, a one man show to deceive their target.
Speaker 1: Yeah. It's so crazy wild and so you know, just
Speaker 1: like with any good performance, research is key, Like they
Speaker 1: have to sound legitimate, right, so they have to know
Speaker 1: the lingo, the.
Speaker 2: Procedure culture of the organization, and they're trying to infiltrate.
Speaker 1: Yeah, it's like they're like method acting, method acting, really
Speaker 1: immersing themselves in the role. Okay, so give me the
Speaker 1: good stuff, Like what are some of the examples from
Speaker 1: the book.
Speaker 2: So one of the more simpler ones, right, which I
Speaker 2: think is still really effective, is the copyer repair guy
Speaker 2: needs mailroom access. It's all about appearances, right, and assumptions.
Speaker 1: You see someone in a uniform.
Speaker 3: Yeah, exactly.
Speaker 1: Carrying a toolbox, like, Okay, this person's probably legit, exactly,
Speaker 1: even if something feels slightly off.
Speaker 2: Even if yeah, and then you're like, oh.
Speaker 1: Man, it's amazing how our own expectations can fool us totally.
Speaker 3: Yeah, it's wild.
Speaker 2: The book also mentions the irs audit notice email this
Speaker 2: plays on our fear and urgency.
Speaker 1: Just those two words are enough to send like.
Speaker 2: Shivers sends me into a cold sweat.
Speaker 1: Oh my gosh. Yeah yeah. Yeah, so they're exploiting that
Speaker 1: fear totally.
Speaker 3: Yeah, right, absolutely.
Speaker 1: Okay, so even the most official looking emails.
Speaker 3: Ken be fake.
Speaker 2: Yeah, so always double check the sender, look for any
Speaker 2: red flags, and never click on links or attachments that
Speaker 2: you weren't expecting.
Speaker 1: Yeah, and actually this is a good place to stop
Speaker 1: for now, and we will pick up this conversation in
Speaker 1: part two.
Speaker 2: Okay, So where were we? Oh yeah, talking about some
Speaker 2: of these crazy social engineering tactics The book actually has
Speaker 2: this whole chapter. It calls it the playbook.
Speaker 1: Oh yeah, it's like literally a playbook.
Speaker 2: It is like a cheat sheet for how to like
Speaker 2: manipulate people, right, all these different pretexts.
Speaker 3: It's pretty wild.
Speaker 2: It's like you almost have to admire the creativity, but
Speaker 2: also like knowing about it is the first step to
Speaker 2: protecting yourself, right exactly.
Speaker 1: Yeah. Yeah, So walk me through some of these plays, like,
Speaker 1: you know, what kind of scenarios should we be on
Speaker 1: the look for.
Speaker 2: So one that's incredibly common and still super effective is
Speaker 2: like the security bulletin email.
Speaker 3: It looks like.
Speaker 2: It's coming from you know, Microsoft, your anti virus provider.
Speaker 1: Oh yeah, yeah, I've seen those.
Speaker 2: You've seen those. Yeah, and they're warning you, like about
Speaker 2: some critical security vulnerability, you know, try to scare you
Speaker 2: into clicking a link or opening an attachment to fix
Speaker 2: the problem.
Speaker 1: Yeah. Yeah. It's like using your own good intention against
Speaker 1: you totally, right, Like I'm just trying to be a
Speaker 1: responsible digital citizen exactly.
Speaker 2: You're trying to be safe, right yeah, and they're exploiting that.
Speaker 1: Okay, what else? What else?
Speaker 3: Okay?
Speaker 2: Bank security email alert they're posing as you know, a
Speaker 2: bank representative emailing you about suspicious activity on your account.
Speaker 1: I've gotten those two. Yeah, they always like make it
Speaker 1: sound super urgent.
Speaker 2: Oh yeah, they always do, right, Like you need to
Speaker 2: act immediately to prevent fraud, right right, right, And so
Speaker 2: they want you to act quickly without thinking. Yeah, you know,
Speaker 2: they might ask you to open attachment supposedly to review
Speaker 2: the transactions, but it's actually loaded with malware.
Speaker 1: Oh yeah. They play on our you know, financial anxieties,
Speaker 1: like we're so worried about our money being stolen.
Speaker 2: Totally.
Speaker 3: It's like a primal fear.
Speaker 1: Yeah, okay, so what about I mean this is like
Speaker 1: the granddaddy of all the fear inducing emails, the IRS
Speaker 1: audit notice.
Speaker 3: Oh yeah, that one's a classic.
Speaker 2: I don't think there's anyone out there who wouldn't feel
Speaker 2: at least a little bit of dread, right.
Speaker 1: I mean those two words irs audit are enough to, like,
Speaker 1: I don't know, make me want to just crawl under
Speaker 1: a rocket too.
Speaker 2: Yeah, like sends me to a cold sweat, like get
Speaker 2: me out of here exactly. So of course they know
Speaker 2: that they'll exploit that fear, claiming you've been selected for
Speaker 2: an audit, right, and then you have to open an attachment,
Speaker 2: oh yeah, for more information. Of course, the attachment malicious
Speaker 2: designed a compromiser system.
Speaker 1: Okay, so this is just a good reminder, right, Like
Speaker 1: even the most official looking emails can be faked.
Speaker 2: Oh yeah, totally always double check the center for any
Speaker 2: red flex Verify, Verify verify exactly. Don't click on links
Speaker 2: or attachments you weren't expecting.
Speaker 1: Right, Okay, So I mean even those of us who
Speaker 1: are like, you know, pretty tech savvy, right, can still
Speaker 1: fall prey to these things. What about, Like, I'm curious,
Speaker 1: have you seen any like specifically designed for people who
Speaker 1: are like more technical?
Speaker 2: Oh yeah, They even have like pretexts for that.
Speaker 1: Okay.
Speaker 2: One of them is called like get your Updates here,
Speaker 2: where the social engineer pretends to be from like your
Speaker 2: IT department, right yeah, and they're urging you to visit
Speaker 2: a website to register your computer for automatic security.
Speaker 1: Updates, which sounds like perfectly.
Speaker 3: Legitimate, totally legitimate, Yeah.
Speaker 1: Especially for people who are like you know, used to
Speaker 1: like keeping their software up to date exactly. Yeah.
Speaker 2: It plays on that trust and authority figures and that
Speaker 2: desire to you know, stay protected. But of course the
Speaker 2: website is a fake right, designed to steal your log
Speaker 2: in credentials or install malware.
Speaker 1: Right. Okay, so I guess, like you know, none of
Speaker 1: us are like immune to this stuff.
Speaker 2: No one's immune. No, we all have our vulnerability, right,
Speaker 2: they're masters at finding them.
Speaker 1: Okay, So let's move on from email to telephone attacks,
Speaker 1: because I think a lot of people would be surprised
Speaker 1: to know that this is still one of the most
Speaker 1: common forms of social engineering.
Speaker 3: Oh yeah.
Speaker 1: You know it's like in this age of like, you know,
Speaker 1: texting an email, you'd think phone calls would be like
Speaker 1: less effective.
Speaker 3: Yeah, but.
Speaker 1: I don't know. There's something about that, like human voice.
Speaker 2: Human voice, Yeah, that like real time interaction. It's very powerful, right,
Speaker 2: and it allows them to really adapt to like how
Speaker 2: you're responding right, right, and make it even more believable.
Speaker 1: Okay, So what are what are some of the scenarios
Speaker 1: that we should be aware of.
Speaker 2: So one of the classic ones is the forgetful user,
Speaker 2: where the social engineer calls like the help desk, right
Speaker 2: and pretends to be a legitimate user who's forgotten their passwords.
Speaker 1: Oh yeah, I could totally see that working. Oh yeah,
Speaker 1: because I mean, like we all forget our passwords.
Speaker 2: Happens all the time, and to make it even more believable,
Speaker 2: they'll be like, oh, I have this urgent deadline, you know,
Speaker 2: or like my boss is waiting on me to send
Speaker 2: this five you know, Like they create that sense of
Speaker 2: urgency to pressure the help desk person to reset their
Speaker 2: password without the proper verification.
Speaker 1: Oh yeah, they're using their like you know, the help
Speaker 1: desk person's desire to be helpful.
Speaker 3: And efficient exactly.
Speaker 2: So that highlights the importance of good authentication protocols. Right,
Speaker 2: you know, always verify even when it seems legitimate.
Speaker 1: Right, always verify. Yeah, okay, So what about like what
Speaker 1: other you know, phone tactics you know, should we be
Speaker 1: like aware of?
Speaker 2: Right? So there's one called a sleight of hand where
Speaker 2: the social engineer pretends to be from like it again,
Speaker 2: calls you and then asks you to visit a website
Speaker 2: to register your comp you know, okay, yeah, like for
Speaker 2: system upgrade or new security software.
Speaker 1: Right. Sounds legit, totally legit.
Speaker 2: Yeah, happens all the time, But of course the website
Speaker 2: is a fake, right, and it's designed to steal your
Speaker 2: loging credentials. And what's clever is that they never actually
Speaker 2: ask for the password, right, Like they just ask you
Speaker 2: to go to this website. It's very clever.
Speaker 1: So they're kind of bypassing your defenses.
Speaker 2: Totally because you're expecting them to ask for your password,
Speaker 2: but they don't.
Speaker 1: Right, Okay, okay, what about like financial stuff?
Speaker 2: Oh yeah, financial foray. So this is where the social
Speaker 2: engineer pretends to be like a bank rep calling to
Speaker 2: verify information.
Speaker 1: Oh yeah, I get those calls. Get those?
Speaker 3: Yeah.
Speaker 2: It's really tricky, right because they sound super official, and
Speaker 2: they often will have specific details about your account. They
Speaker 2: might ask for your account number, your social even your
Speaker 2: online banking log in credentials to you know, resolve a
Speaker 2: minor issue.
Speaker 1: Right. It's so hard to tell those from a legitimate call.
Speaker 3: It is.
Speaker 2: So the best advice is to never give out sensitive
Speaker 2: information over the phone unless you initiated the call. Right.
Speaker 2: If you get a call that seems suspicious, just hang
Speaker 2: up right, call back using the number, the official number
Speaker 2: you know, exlisted on your statement, your website, whatever.
Speaker 1: Good rule with them, Always verify, always verify. Yeah yeah, okay,
Speaker 1: so what about those like you know, we all get
Speaker 1: those like robo calls, right, I feel like they're coming
Speaker 1: more and more these days.
Speaker 2: Oh yeah, yeah, and they're using those too. The book
Speaker 2: calls it attack of the Phones, where they use like
Speaker 2: a text to speech a program to create like this
Speaker 2: fake automated call. Oh yeah, pretending to be from the IRS,
Speaker 2: a government agency.
Speaker 1: Yeah. They're usually warning you about some kind of legal
Speaker 1: action or like unpaid taxes, totally. Yeah, and then they
Speaker 1: want you to like enter personal information exactly.
Speaker 2: Yeah, and they're exploiting again our fear of authority, our
Speaker 2: tendency to trust automated systems. The call might even instruct
Speaker 2: you to like enter your Social Security number right for verification,
Speaker 2: and then they can capture that. They use something called
Speaker 2: a DTMF decoder.
Speaker 1: Oh, a DTMF decoder. What is that? That sounds fancy.
Speaker 2: It sounds super fancy, right. So DTMF stands for dual
Speaker 2: tone multi frequency signaling. It's basically the technology that allows
Speaker 2: you to like press the keys on your phone, you know, Okay, yeah,
Speaker 2: like one for sales or whatever.
Speaker 1: I've never thought about how that actually works, but yeah.
Speaker 2: Yeah, so they can use that. Oh, they have this
Speaker 2: decoder that can capture that.
Speaker 1: So it's like they're even though it seems automated, they're
Speaker 1: actually listening.
Speaker 3: In they are.
Speaker 2: Yeah, essentially, it's scary, so be cautious about providing any
Speaker 2: information over the phone, even if it seems like it's automated.
Speaker 1: Right. Okay, so we've covered some pretty sophisticated stuff like
Speaker 1: you know, email and telephone attacks. What about like, what
Speaker 1: other tricks do they have up their sleeves?
Speaker 2: Okay, So there's another tactic that's like surprisingly simple, but
Speaker 2: it's still very effective, called baiting. It preys on our
Speaker 2: curiosity and our love of free stuff.
Speaker 1: Okay, I like free stuff, tell me more.
Speaker 2: So it's about leaving like infected media like USB drives
Speaker 2: or CDs okay, around in places where, like you know,
Speaker 2: the target is likely to find them, right, and the
Speaker 2: media is often labeled with something enticing like payroll or
Speaker 2: private picks you.
Speaker 1: Know, right, it's like, I don't know, it's like finding
Speaker 1: a twenty dollars bill on the sidewalk. It is, you know,
Speaker 1: you probably shouldn't pick it up, but it's so hard to.
Speaker 2: Resist exactly, And the book calls this like the oldie
Speaker 2: but a goodie. Right. It's crazy how effective it still is.
Speaker 1: Yeah, so give me some give me some real world examples,
Speaker 1: like how does this actually play out?
Speaker 2: Okay? So there's like the Blazing Fast interwebs where they
Speaker 2: mail you a USB drive disguised as like an Internet
Speaker 2: speed booster.
Speaker 1: Yeah.
Speaker 3: Oh, I would.
Speaker 2: Totally fall for that. Who doesn't want faster Internet?
Speaker 1: Exactly? It plays on that desire for like instant gratification,
Speaker 1: right right, right? Are willing not to try new technologies,
Speaker 1: especially if they're free, especially if they're free. Yeah, but
Speaker 1: in reality it's just a sneaky way to get you
Speaker 1: to install malware, right okay? Okay. And then there's the
Speaker 1: Save Big Money where they mail you a USB drive
Speaker 1: that appears to contain a coupon book. Ooh, I love
Speaker 1: everyone loves coupon's huge discounts. Yeah, popular stores. And then
Speaker 1: you know, as soon as you plug in the drive,
Speaker 1: bam malware.
Speaker 3: Okay.
Speaker 2: So if something seems too good to be true, it probably.
Speaker 1: Is exactly yeah. And then they even like tailor it
Speaker 1: to specific interests.
Speaker 3: Oh okay.
Speaker 1: For car enthusiasts, you know, they have the Recalling all Cars,
Speaker 1: where they mail you a USB drive claiming it contains
Speaker 1: like important information about a recall for your specific make
Speaker 1: and model of car.
Speaker 2: Oh yeah, I mean a car recall is like a
Speaker 2: big deal.
Speaker 1: It's a big deal, right, like both safety and like
Speaker 1: you know, could cost you a lot of.
Speaker 2: Money, totally praying on that desire to keep our vehicles
Speaker 2: running smoothly and to be safe.
Speaker 1: Right, so again like you know, using our own anxieties
Speaker 1: against us totally.
Speaker 2: And then finally the bank security software. So they mail
Speaker 2: you a USB drive claiming it contains security software, right
Speaker 2: to protect your computer and your bank account.
Speaker 1: Oh yeah, that makes sense. Like with all the data
Speaker 1: breaches and identity theft happening these days, you know, Oh yeah,
Speaker 1: people are very concerned about their online security.
Speaker 2: Absolutely, so they combine the appeal of free security software
Speaker 2: with that fear of financial fraud. Right, and to make
Speaker 2: it even more urgent, they might even reference some suspicious activity.
Speaker 3: Right right on your account.
Speaker 1: Okay. So it's all about playing on our emotions, our fears,
Speaker 1: and our desires.
Speaker 3: It is.
Speaker 2: Yeah. What's striking is that all these tactics they rely
Speaker 2: on exploiting human nature. It's not about like brute force hacking.
Speaker 2: It's about manipulating our psychology.
Speaker 1: Right. It really makes you like think twice about who
Speaker 1: you trust.
Speaker 3: It does.
Speaker 1: Yeah, it's scary and how easily. We can be deceived
Speaker 1: very easily, right, So it really brings us back to
Speaker 1: like the core message of this whole deep dive, right,
Speaker 1: like knowledge is.
Speaker 3: Power, totally.
Speaker 2: Yeah, the more you understand about these tactics, the better
Speaker 2: you can protect yourself.
Speaker 1: So it's not about living in fear. No, it's about
Speaker 1: being like you know, informed and.
Speaker 2: Aware, being aware exactly, and that's like your first line
Speaker 2: of defense, you know. Just start paying attention to how
Speaker 2: people try to influence you.
Speaker 3: In everyday life.
Speaker 2: I know, right, I guarantee you'll start to see it everywhere.
Speaker 1: I'm already noticing it, and it's like a little unsettling.
Speaker 3: Honestly, it is unsettling.
Speaker 2: Yeah, but you're already way ahead of the game, right right,
Speaker 2: because you're aware of it. You're less likely to fall
Speaker 2: for those traps because you know what to look for.
Speaker 1: Okay, So I guess to kind of like, you know,
Speaker 1: wrap up this whole conversation social engineering. It's really all
Speaker 1: about exploiting the human element, right, our trust, our helpfulness,
Speaker 1: even our desired to be liked, and it uses psychology
Speaker 1: and trickery to get us to do things that we
Speaker 1: wouldn't normally do.
Speaker 2: Totally right, And the best way to protect yourself is
Speaker 2: to stay informed, be skeptical, never be afraid to question authority.
Speaker 2: If something feels off, it probably is. Trust your gut.
Speaker 1: I love that.
Speaker 2: Trust your gut, verify information. Yeah, and remember that no
Speaker 2: one has the right to pressure you into giving up
Speaker 2: sensitive information.
Speaker 1: Right exactly. And I think you know the trust your
Speaker 1: gut part, it's so important. It's huge, right because we
Speaker 1: often like have that feeling, you know, like something's not right,
Speaker 1: but we just kind of ignore it because we want
Speaker 1: to want to seem rude or paranom you.
Speaker 2: Feel like we're overreacting or whatever. But it's much better
Speaker 2: to be cautious than to become a victim. You know.
Speaker 2: It's about finding that balance between being open and trusting
Speaker 2: but also discerning and aware.
Speaker 1: Yeah, it's tricky. It is tricky, and you know, it's
Speaker 1: not just about protecting ourselves personally, but also our organizations
Speaker 1: absolutely and their communities. Like this stuff can have like
Speaker 1: far reaching consequences, oh yeah.
Speaker 2: Data breaches, financial losses, reputational damage, like it can get
Speaker 2: really bad.
Speaker 1: Right, Okay, So to our listeners out there, stay vigilant,
Speaker 1: stay informed, stay informed, stay safe, stay safe and if
Speaker 1: you really want to like dive deep into this whole
Speaker 1: world of social engineering, definitely check out the Social Engineer's Playbook. Yeah.
Speaker 2: The book is really interesting. It lays everything out very clearly. Yeah,
Speaker 2: and I think even if you just implement like a
Speaker 2: few of the tips we've talked about, you'll be much
Speaker 2: better off, right exactly, Yes, significantly.
Speaker 1: And a if you've ever encountered any particularly like you know,
Speaker 1: clever or outrageous social engineering attempts, we want to hear
Speaker 1: about them.
Speaker 2: Oh yeah, share your stories.
Speaker 1: Share your stories, hit us up on social media.
Speaker 3: Yeah, we want to hear them, right.
Speaker 1: Because I mean, I think you know, the best way
Speaker 1: to learn is from you know, shared experiences.
Speaker 2: Right, Absolutely, learn from each other's mistakes.
Speaker 1: Right. So until next time, I'm stay curious, stay skeptical,
Speaker 1: and stay safe out there in the digital wild West.
Speaker 2: And remember knowledge is power.
Speaker 1: Yes, thanks for joining us for another deep dive. We'll
Speaker 1: see you next time. Forewarned is forearmed, right exactly. So
Speaker 1: the more we know about these tactics, the better we
Speaker 1: can protect ourselves.
Speaker 2: Absolutely, awareness is your first line of defense. And just
Speaker 2: start paying attention to how people try to influence you
Speaker 2: in everyday life. I know, online, offline, everywhere. I guarantee
Speaker 2: you'll start to see it everywhere once you start looking
Speaker 2: for it.
Speaker 1: Oh yeah, I'm already noticing it. Yes, And it is
Speaker 1: a little it's a little unsettling.
Speaker 2: It is unsettling. But the good news is you're already
Speaker 2: ahead of the game because you're aware of it, right,
Speaker 2: So you're less likely to fall for those traps because
Speaker 2: you know what to look for, right.
Speaker 1: So it's a good thing.
Speaker 3: Okay.
Speaker 2: So to kind of like wrap up this whole conversation,
Speaker 2: social engineering, I mean, it's really all about exploiting the
Speaker 2: human element, our trust, our helpfulness, even our desire to
Speaker 2: be liked. Yeah, and it uses psychology and trickery to
Speaker 2: get us to do things that we would normally do.
Speaker 2: Totally and the best way to protect ourselves. I mean,
Speaker 2: just to reiterate what we've been talking about, stay informed,
Speaker 2: be skeptical, never be afraid to question authority.
Speaker 1: Absolutely question everything.
Speaker 2: Right, if something feels off, it probably is. Trust your gut,
Speaker 2: verify information, and remember that no one has the right
Speaker 2: to pressure you into giving up sensitive information or access.
Speaker 1: Couldn't this set it better myself?
Speaker 2: Yeah?
Speaker 3: I love that advice.
Speaker 2: Trust your gut. It's so simple, it's so sick, but
Speaker 2: it's so important, right, because we often have that feeling like, hmmm,
Speaker 2: something's not right here, but we just kind of ignore
Speaker 2: it because we don't want to seem rude or paranoid exactly.
Speaker 1: Yeah, I think we're overreacting or whatever.
Speaker 2: But it's much better to be cautious than to become
Speaker 2: a victim.
Speaker 3: Right.
Speaker 2: It's about finding that balance between you know, being open
Speaker 2: and trusting, but also discerning and aware.
Speaker 1: Right, discerning in a way. Yeah, it's a tricky balance.
Speaker 3: It is tricky.
Speaker 1: Yeah. And you know, it's not just about protecting ourselves personally, no, right, Like,
Speaker 1: it's about protecting our organizations, our communities absolutely. I mean
Speaker 1: this stuff can have like really far reaching.
Speaker 2: Consequences, data breaches, financial losses, reputational damage.
Speaker 3: I mean it can be really bad.
Speaker 1: Right. Okay, So to our listeners out there, stay vigilant,
Speaker 1: stay informed, stay safe, stay safe, and if you want
Speaker 1: to like really dive deep into this whole world of
Speaker 1: social engineering, definitely check out the Social Engineer's Playbook.
Speaker 2: It's a great book.
Speaker 1: Yeah. We'll put a link in the show notes along
Speaker 1: with some of the other resources that we mentioned. And hey,
Speaker 1: if you have ever encountered any particularly you know, clever
Speaker 1: or outrageous social engineering attempts, we want to hear about them.
Speaker 1: Share them, share them. Yeah, hit us up on social media.
Speaker 3: We love we love those stories because.
Speaker 1: I think sometimes, you know, the best way to learn
Speaker 1: is from shared experiences.
Speaker 2: Right, Yeah, absolutely learn from each other's mistakes.
Speaker 1: So until next time, stay curious, stay skeptical, and stay
Speaker 1: safe out there in the digital wild West.
Speaker 2: And remember knowledge is power.
Speaker 1: Thanks for joining us for another deep dive. We'll see
Speaker 1: you next time.