- [Instructor] For many years,
attackers tried to manipulate the human behavior,
not only to reveal sensitive information,
so to trick a person to reveal information
that, you know, he or she should not be
potentially sharing with somebody.
But also to potentially redirect them
to malicious links to download malware,
or for them to act in a specific behavior,
you know, a specific manner.
Now how somebody influences,
interrogates, and impersonates others are key components
of these realm of social engineering.
So in short, elicitation and interrogation
are basically the act of gaining knowledge
or information from people.
In most cases, you know,
attackers actually get information
from the victims without directly asking
for particular information,
is basically just by carrying a specific dialogue.
And then, you know,
from there trying to convince the victim
to reveal specific information.
Now, how an attacker interrogates
and interacts with the victim is extremely crucial
for the success of the social engineering campaign.
An interrogator can actually ask
good open-ended questions
to learn about an individual's viewpoint,
an individual's values, their goals.
And then the interrogator can then use
that information to continue to gather
additional information or to obtain information
about another victim.
It is also possible
for that interrogator to be using closed-ended questions
to get more control of the conversations,
to lead the conversation,
or to actually stop the conversation in some cases.
Now asking too many questions
can cause the victim to basically shut down the interaction.
And then at the same time,
if you ask two few questions,
then it may seem awkward, right?
The conversation may seem awkward
and the victim, of course, will probably pick that up
and hold herself or himself back
from sharing any additional information.
Now successful social engineering interrogators
will basically use a narrow approach.
And that narrow approach in their questioning
is basically to gain the most information
from the victim as possible
in the least amount of time.
Now these are few things
that you as a social engineering expert,
or, you know a penetration tester
should pay attention to, right?
So the first thing is whenever you're talking
to the quote on quote victim or the target,
always look at the posture and the body language
of that person, right?
And see if the face has become, you know, a different color,
especially if victim is getting either mad, right?
Probably the face is becoming red or reddish.
Or it's becoming a little bit more pale
because potentially it's care, right.
That you're influencing
with potentially fear and so on, right?
Also the direction of the victim's heads and eyes, right?
That's what you can also tell
if somebody's lying in some cases, right?
The movement of the victim's hands and feet
also can reveal if they are comfortable
with the conversation or if they're not.
Now, the other thing is the pitch
and rate of the victim voice,
as well as the changes in the voice,
the victim's words, including their length,
the number of syllables, functions, pauses, and so on.
Now with pre-texting or impersonation,
an attacker can present as somebody else, right,
in order to gain information,
as I mentioned to you before.
In some cases it can be a very simple interaction,
such as just quickly pretending to be someone else
within the organization.
In other cases actually it can involve creating
a whole new identity,
and then using that identity to manipulate
the receipt of the information
and continue to interact with the target,
not only in one conversation, but in some cases
actually even developing a full relationship
with that individual.
Now social engineering may actually use
these type of techniques of pre-texting
to impersonate individuals in certain jobs,
in certain roles,
even if they don't have experience in those roles.
For example, you know,
you can impersonate somebody
that is delivering a package to you from UPS or FedEx,
or even a bicycle messenger,
or a courier with some important message
for somebody in the organization.
And then from there,
probably act a little bit confused,
ask for potentially contacts within the organization.
And in many cases, as a matter of fact,
scammers as well,
use a lot of these techniques
to try to manipulate users to reveal information.
You know, nowadays you get not only the robocalls
that we get all the time,
but a lot of tactics to influence somebody with fear,
probably impersonating somebody
from law enforcement,
somebody at least in the United States,
you know, we have the IRS, right.
Somebody impersonating that is an IRS person or personnel.
And then, you know, telling them that, you know,
you are potentially in trouble
because you owe some money to the US government.
And then from there, I mean, of course
the victim can react in a few different ways.
It can get mad or irate
because they don't owe that money to the government.
And then the attacker can actually potentially use that
to their advantage.
Some of these are becoming very mainstream,
and a lot of people are getting a lot more aware,
and we're gonna go over the counter measures
a little bit later.
But one of the main counter measures is of course,
education, user education.
In the next lesson, we're gonna be exploring
a few different social engineering techniques,
like spear phishing, phishing, farming,
malware advertising, and different others as well.