Social Engineering

Keith A. Pachulski @sec0ps NEPA InfoSec – February 18, 2011 Social Engineering Talking your way to the goods..

101 Overview • Focus here is specifically on the physical entry • Make a new friend • Appear to have a new friend • Ignorance • Overworked

Make a new friend • Requires some degree of social interaction • Most fail here, talking to people does not appeal to all of us • Manipulation of the target may be needed • I work here, really I do • Do your home work (google) for the organizational structure.. • Cute kids (keychain) • Pay attention, use the kid card.. • Random chatter (small talk – build rapport)

Appear to have a new friend • Slightly easier, simply have to give the appearance the person you are “with” is actually with you • Requires close contact with the target • In proximity but not so close to breach their personal space – could turn bad for you if this goes south

Ignorance • Totally ignore anyone who may attempt to stop you • Fake phone conversation • Make sure your tone/demeanor is appropriate to the location • Outside the building conversations can appear ‘heated’ • Internal office conversations cannot or will draw undue attention • Talking isn't always required..just the appearance you are talking

Overworked • Have had decent success with this ploy • Overworked IT tech carrying too much equipment • Multiple laptops, backpack, breathing heavy • Do not actually run around to get ‘tired’; a stinky person gets no love • Will build the sympathy card quickly… • My fastest time with this ploy was 42 seconds and gained access to the bank vault.

Questions -> Comments ?

Social Engineering