Dear viewer, these subtitles were generated by a machine via the service YouTube and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/2505 Thanks!
[Music]
to actual like exit trots oh now I'm on
hello everybody
so so in order to not to like waste too
much time in my yabbering but instead
like listen to Somebody smart um welcome
to to the next talk um I'm not sure uh
if you are actually like uh here by your
own choice or if somebody has uh kind of
uh had a Spell on You uh but maybe
you'll find out after 20 minutes uh
after the talk by uh Uber hacker about
uh identifying social engineering thank
you thank you very much yeah welcome 20
minutes and I want to show you a bit
what I did well almost the last uh 10
years to identify social engineering
because it's quite a a challenge okay
let's start where why I am doing that so
the first thing is after years in
information security I always uh um had
the the feeling that digital and uh
physical security measures are not
really uh um uh capable of uh dealing
with the human element so you know you
do everything firewalls antivirus and so
on uh physical access control and then
at the end uh someone can social
engineer or just know uh get into the
building or bypass anything uh with a
malicious USB stick Etc so um there's
always this kind of human element and uh
we had a very famous paper in
1999 which is why Johnny can't still
can't encrypt uh why Johnny can't
encrypt and it's about pgp 4.0 uh so a
long time ago uh but still we have the
the challenge how to get security um um
yeah measures um used and do we want
that uh end users use security measures
directly um so it was uh pgp 4. uh 5.0
uh we are still having that issue uh if
an end user who is not uh security Savvy
needs to um interact with security
mechanisms something like uh memorizing
a password recalling a password entering
a password and then we tell them okay
please uh use a complex long password
and then we say Okay use multifactor
authentication and the use user says
okay so much security are you paranoid
so that's the maybe the end user
perspective why are you doing all that
stuff and uh the security engineer says
Ah why uh it's just that easy just do it
no but from a from a workflow
perspective you always get interrupted
there's a pop up ah vpm down so I need
then multifactor authentication again
and your workflow gets interrupted which
costs time um so there is this approach
okay then use opportunistic encryption
and let's see later maybe uh if uh it
was Secure maybe the the key changed uh
um and then you will see uh something
the safety number changed and for an end
user what does that tell an end user
they just say Okay safety number changed
and and now don't know let's go on so uh
we still have the to tackle this issue
that's called the the research topic is
usable Security on the the other hand if
you force an end user to to uh use
security related mechanisms um then they
are become a part of the um attack
Vector of the attack surface they can be
attacked as well you have digital
physical security measures and then you
force them and um then you can attack
them as well you can emplo exploit that
uh uh Factor um which makes it quite
difficult to deal with to protect um our
assets whatever that is no um against
such attacks um if you use the complex
password long password uh and MFA then
yes social engineering is quite easy to
uh circumvent that to just uh yeah make
all these kind of cool uh ideas cool no
we will see in userful security maybe a
years a few years later uh obsolete so
obsolete in the sense of no this Factor
can be exploited so what my um question
was at the beginning over 10 years ago
is we always have to deal with this
factor and how can we go forward go
further there how can we understand that
why are maybe some uh end users more
susceptible to for example social
engineering than others so I was looking
for a suitable social engineering
definition which means suitable for
interdisciplinary research for um
finding then uh um social engineering um
stories anecdotes in the wild no how to
get such insights how does social
engineering work the uh Modo operandi so
we need somehow evidence what kind of
evidence ever no or you can use
experimental designs but the point is
what is social engineering how can I
identify it and so so my first approach
was uh looking for indicators in a a
cycle of um interlocking deduction and
induction so it was over the years and
looking for a definition on of course
you know the famous
XKCD I have a new one but
um the the point for me was that it's
not um single use this indicators can be
used um as well for um for uh um
identifying social engineering in the
wild so it's dual use but um in the end
it's uh for me for identifying social
engineering so when I was looking for a
definition I came up ah there's an RFC
perfect RFC
4949 yeah they say don't use that yeah
it's uh too widely used and the majority
of uh papers or talks Etc say uh social
engineering you know everyone knows
something and everyone has has a
different view uh me as well no so I'm
standing here um and um please don't use
that and using just examples to Define
it is not the the best approach so I was
looking for a good definition and then
find um um the
indicators um The Challenge so was as
well to to do this in interdisciplinary
research because social engineering is
not just um uh computer
science um and uh suitable of course I
already mentioned that but also it
should not be too General yeah some
people say every human interaction is
social engineering yeah a kid at the at
the checkout in a supermarket sees some
sweets okay uh social Engineers may be
the parents but is this social
engineering so this was all the cycle I
I um I was uh thinking of and uh um
sometimes to wake missing something or
too strict so saying uh only digital
technology only only V it but social
engineering is not something new um this
is my view and we can discuss this maybe
later somewhere in the corner because we
only have 20 minutes um so uh the point
was that um it's nothing nothing new
it's not only it related um for example
The Spanish Prisoner scam um or um uh
which is okay short short info there uh
which is via prison uh prisoners that uh
uh um should be uh sending um mails uh
should be telling people um please uh if
you give me money so a kind of advanced
fee scam um and then uh I will reward
you because I'm a millionaire and I'm in
prison um and this worked in some pups
um telling people up please we need
money to get him out and then he will
reward you L later but we need money
first to to all do do this so these are
the the where the the things that is
nothing new like gr grandparent scam as
well could be on the door a person to
person no telephone scam no it no
internet um so therefore I was looking
into just finding indicators so first
thing um here you see the first three of
the five um what you need to know here
is um that I have two perspectives two
views that is the targeted person I use
targeted person and not Victim Because
the person is targeted and becomes a
victim if successful yeah different uh
bit uh different um thing and um you see
the capital letters which is the RFC
2119 um about um how how to um put some
um um yeah operators what is really
important here so first thing Target
person is the human enabler and this was
quite the the key for me a key enabler
meaning um only if there is a human
element that is
exploited enables the attack uh so some
people say dumpster diving is social
engineering no it's not for me there's
no you human element in the majority of
times um uh it's a pre-attack
information gathering to then maybe make
a social engineering uh attack or uh to
use um uh this could be then social
engineering to um uh manipulate someone
to throw something in the bin which you
later uh gather so that would could be
social engineering so just to give there
a difference um and uh this is very the
for me the most important uh indicator
the second one is the attacker must
initiate the communication which could
be in three different types um like bi
uh bidirectional meaning uh there's
really a communication no you receive a
faximile scam uh like you just uh uh get
a lot of money please call this lawyer
somewhere in Spain and um then you have
a bidirectional uh communication
unidirectional which is just the typical
scams with without not just a fishing
email spear fishing as well where you
just uh click on an um link for example
um and indirect means that you maybe
drop a malicious USB a bed USB uh stick
somewhere in the parking lot and hope
that people picks it up goes through the
physical access uh um um measures uh
turn pile anything then puts it into the
laptop in the company uh where you uh um
have firewalls protection Etc but you
can use the USB port and then have maybe
a malicious payload there um so this is
intentional communication um unawareness
of the targeted person so as well this
you will see in the next slide it's goes
and vice versa so someone who is bribed
and knows about that is not uh social
engineered yeah he knows about this so
there's an unawareness
Factor um about the real uh attacker's
intention or it could be something
different than we can think of social
engineering then we have um the
malicious intent of the attacker so some
people say uh maybe um a teacher who
wants the has the best interest of a
pupil um um is social engineering
yeah uh the pupil but but that's the
best interest well we can discuss what
is best teacher Etc and education but um
there's best interest like parents as
well so is this social engineering no um
and the last one the where which I will
um elaborate a bit more is deceptive
techniques so this is the other part of
unawareness um the attacker use
deceptive techniques and um um get the
the targeted person comply with the
request which could be anything but um
no I won't go in 20 minutes into detail
so deceptive
techniques um we have many um different
types um and long list and it's not uh
uh um finished but you can see it in
literature um for example Kevin mitnik
use name dropping yeah if you know
someone's name in a company then you
call someone else and tell them
hey this person your colleague wants uh
this done please help me yeah um or
fishing um there are uh types of
opportunistic social engineering if you
use fishing and um jump onto on a onto a
b bandwagon U for example gdpr
compliance no that you send out uh Bank
uh fish and uh telling uh the people you
need to be comp you need to comply or
your account your bank account will be
uh uh deactivated such things no or the
pandemic as well of
course um impersonation is quite
interesting um technique and um many
people think about uh the captain of
kopernick yeah as a quite a funny story
which has uh real life uh uh Roots but
the heral in in English the drum head
Court Marshal was really happening End
of the World War II where someone a
Chimney Sweeper from from Chets used a
uh military uniform from the yeah
military police and uh pretended to be
military police got other soldiers
following him and then executing um
people um so
this thank you um so this is um about
techniques and one part of my definition
is that a deceptive technique must have
an underlying persuasion principles one
or more there are different types of
course people who are into social
engineering have heard about chalini
it's from marketing and marketing uses
some techniques that can quite easily be
used for malicious intent and if you
think of marketing techniques you could
have viral marketing you can use dark
patterns Etc and then we have a gray
area and could be maybe not in the best
interest um of the targeted person of
the um uh um audience um so there are
some like I I will go fastly over it but
as well this is nothing new loss
aversion is something for uh um for the
historians maybe um that um um Adam
Smith already used if there's a good
scarce um then people tend to be
motivated to buy that product even even
if they maybe at the moment don't need
that um so this is something as well
nothing new and stano and Wilson as well
an interesting paper and for those who
want to see some episodes the real
hustle is the series quite nice to see
how they do um I would say most of them
are social engineering in the wild okay
so far persuasion principles that's for
now I don't know if you trust me that
this is not a malicious uh link or pil
or anything but this is the link to my
thesis which has uh quite more uh
interesting pieces um for example I
analyzed uh court documents looking for
fishing in German Court um documents or
uh I organized with uh some friends the
social engineering poetry slam on one of
the conferences or congresses a few
years back okay so far I think I I am in
time then thank you very much and uh
yeah stay
safe
yep
okay okay uh thanks a lot um so uh we
have couple of minutes uh so we can have
a couple of questions uh so if you have
a question line up line up here uh you
see uh See the mic is here there yeah um
so um
yes if we want to uh talk privately with
the UB hacker um they uh uh promise to
be on that side of the tent after the
talk so
um yes we have a question there hi hi um
so malicious intent seems to beit a bit
vague so the social your social
engineering definition
or your attempt to make it less wag B is
based on something that is also wag yeah
malicious intent is as well wag um I
have in my thesis more examples um so if
you think um it's not everything is
monetary yeah but well the majority I
would think is monetary even if you have
a uh try to harm the reputation of a
company um and the reputation leads to
some loss no it's again a bit Financial
but there are many things no um if you
want to harass someone then this could
be as well social engineering depends on
how you do it no um so there are many
things and um therefore this is Wake as
well I agree and maybe this would be
important to have their more um yeah
definition as well but um yeah thank
you yes we have time for uh one question
more so please thank you for your talk
um I sometimes uh being hired uh for red
team uh assessments and we try to get in
the building and usually it uh it it
works but um at the same time I
sometimes thinking how often does this
happen in uh for
real with malicious intent with
malicious intent getting in in into the
building
I have out of card with but
malicious have and has to answer if they
are caught to the police so the stakes
are pretty high for an
attacker uh they are um the the as well
there's a challenge one thing is
tailgating is nothing new no you do this
maybe of kindness yeah someone okay yeah
come just come in or you get a access
card without many questions or details
but um in the end um this was my the
challenge for me I need evidence but how
can I find found evidence that is um
suitable meaning has enough information
what happened um and this is quite
difficult because some people don't want
to talk about incidents in their company
and others say I heard from someone and
then you as a from researching uh uh
from scientific perspective you you
can't really tell if it's true or not
yeah as an
extreme um if you take some book of a
security uh engineer and they tell a
story how can
I prove or be sure that this is uh
correct and of course some books are
cited quite often um but you can't be
sure that it's correct no citing is good
and but um what is the source can I ask
someone no and even news articles are
not very honest always therefore was my
approach to use um the court documents
no because they have a truth finding
process uh in
itself okay um we're unfortunately out
of time uh you can uh UB hacker will be
available here at the uh side of the
stage for a while for like extra
question so uh let's give one more huge
Applause thank you very
much
[Music]