psychological principles in social engineeringaz9194.vo.msecnd.net/pdfs/110902/3381.pdf · common...
TRANSCRIPT
![Page 1: Psychological Principles in Social Engineeringaz9194.vo.msecnd.net/pdfs/110902/3381.pdf · common psychological principles and ... •Jeffrey Dahmer ... •Investigated multiple,](https://reader031.vdocuments.mx/reader031/viewer/2022020214/5ae9099e7f8b9a3d3b90ccff/html5/thumbnails/1.jpg)
Psychological Principles in Social Psychological Principles in Social
Engineering
September 20, 2011
![Page 2: Psychological Principles in Social Engineeringaz9194.vo.msecnd.net/pdfs/110902/3381.pdf · common psychological principles and ... •Jeffrey Dahmer ... •Investigated multiple,](https://reader031.vdocuments.mx/reader031/viewer/2022020214/5ae9099e7f8b9a3d3b90ccff/html5/thumbnails/2.jpg)
Introductions
• Joe Sechman, CISSP|CISA|CSSLP, Director
of Attack and Penetration Testing Practice
• Robert Carr, CISSP|OSCP, Senior Manager
within Attack and Penetration Testing Practice
22
![Page 3: Psychological Principles in Social Engineeringaz9194.vo.msecnd.net/pdfs/110902/3381.pdf · common psychological principles and ... •Jeffrey Dahmer ... •Investigated multiple,](https://reader031.vdocuments.mx/reader031/viewer/2022020214/5ae9099e7f8b9a3d3b90ccff/html5/thumbnails/3.jpg)
Presentation Goal
• Increase awareness regarding social
engineering techniques by examining
common psychological principles and
real-world examples
3
real-world examples
• *Disclaimer* we are NOT psychologists
or law enforcement
![Page 4: Psychological Principles in Social Engineeringaz9194.vo.msecnd.net/pdfs/110902/3381.pdf · common psychological principles and ... •Jeffrey Dahmer ... •Investigated multiple,](https://reader031.vdocuments.mx/reader031/viewer/2022020214/5ae9099e7f8b9a3d3b90ccff/html5/thumbnails/4.jpg)
What is Social Engineering?
4
Social engineering is the ability to manipulate people, by
deception, into giving out information or performing an action.2
[1] Photo: Breaking Bad from AMCTV: http://www.amctv.com/breaking-bad/videos/breaking-bad-talked-about-scenes-jesse-and-the-meth-head
[2] Mann, Ian (2008). Hacking the Human: Social Engineering Techniques and Security Countermeasures. Burlington, VT: Gower.
![Page 5: Psychological Principles in Social Engineeringaz9194.vo.msecnd.net/pdfs/110902/3381.pdf · common psychological principles and ... •Jeffrey Dahmer ... •Investigated multiple,](https://reader031.vdocuments.mx/reader031/viewer/2022020214/5ae9099e7f8b9a3d3b90ccff/html5/thumbnails/5.jpg)
Psychological Principles
• Conformity (Solomon Asch)
• Obedience to Authority (Stanley Milgram)
• Ingratiation (J.S. Seiter)
5
• Ingratiation (J.S. Seiter)
• Influence/Persuasion (Robert Cialdini)
![Page 6: Psychological Principles in Social Engineeringaz9194.vo.msecnd.net/pdfs/110902/3381.pdf · common psychological principles and ... •Jeffrey Dahmer ... •Investigated multiple,](https://reader031.vdocuments.mx/reader031/viewer/2022020214/5ae9099e7f8b9a3d3b90ccff/html5/thumbnails/6.jpg)
Conformity
• Conformity
• The act of matching attitudes, beliefs, and
behaviors to what individuals perceive is
normal of their society or social group.
6
normal of their society or social group.
![Page 7: Psychological Principles in Social Engineeringaz9194.vo.msecnd.net/pdfs/110902/3381.pdf · common psychological principles and ... •Jeffrey Dahmer ... •Investigated multiple,](https://reader031.vdocuments.mx/reader031/viewer/2022020214/5ae9099e7f8b9a3d3b90ccff/html5/thumbnails/7.jpg)
Conformity
• Types
• Informational
• An individual seeks information from the group to
7
• An individual seeks information from the group to
come to a decision.
• Normative
• An individual changes their behavior in public to
align with the group.
![Page 8: Psychological Principles in Social Engineeringaz9194.vo.msecnd.net/pdfs/110902/3381.pdf · common psychological principles and ... •Jeffrey Dahmer ... •Investigated multiple,](https://reader031.vdocuments.mx/reader031/viewer/2022020214/5ae9099e7f8b9a3d3b90ccff/html5/thumbnails/8.jpg)
Conformity
• The Asch Experiment
• Tested whether individuals will conform with
a group.
8
• All but one of the participants were
confederates of the experiment.
![Page 9: Psychological Principles in Social Engineeringaz9194.vo.msecnd.net/pdfs/110902/3381.pdf · common psychological principles and ... •Jeffrey Dahmer ... •Investigated multiple,](https://reader031.vdocuments.mx/reader031/viewer/2022020214/5ae9099e7f8b9a3d3b90ccff/html5/thumbnails/9.jpg)
Conformity
• The Asch Experiment
• “Vision Tests”
9
![Page 10: Psychological Principles in Social Engineeringaz9194.vo.msecnd.net/pdfs/110902/3381.pdf · common psychological principles and ... •Jeffrey Dahmer ... •Investigated multiple,](https://reader031.vdocuments.mx/reader031/viewer/2022020214/5ae9099e7f8b9a3d3b90ccff/html5/thumbnails/10.jpg)
Conformity
• “Vision Test”
• Results
• 18 subjects
10
• 18 subjects
• 74% of subjects complied at least once.
• 32% of responses were compliant
![Page 11: Psychological Principles in Social Engineeringaz9194.vo.msecnd.net/pdfs/110902/3381.pdf · common psychological principles and ... •Jeffrey Dahmer ... •Investigated multiple,](https://reader031.vdocuments.mx/reader031/viewer/2022020214/5ae9099e7f8b9a3d3b90ccff/html5/thumbnails/11.jpg)
Conformity
• “Vision Test”
• Further Observations
• None of the participants complied 100%
11
• None of the participants complied 100%
• Criticisms
• Societal Views
• What is compliant and what is polite?
![Page 12: Psychological Principles in Social Engineeringaz9194.vo.msecnd.net/pdfs/110902/3381.pdf · common psychological principles and ... •Jeffrey Dahmer ... •Investigated multiple,](https://reader031.vdocuments.mx/reader031/viewer/2022020214/5ae9099e7f8b9a3d3b90ccff/html5/thumbnails/12.jpg)
Conformity Examples
• Cults
• Jonestown Massacre
• Led by Jim Jones
• November 18, 1978. 913 victims
12
• November 18, 1978. 913 victims
• Heavens Gate
• Led by Marshall Applewhite and Bonnie Nettles
• March 26, 1997
• Leaving human existence for alien life (Hale-Bopp)
![Page 13: Psychological Principles in Social Engineeringaz9194.vo.msecnd.net/pdfs/110902/3381.pdf · common psychological principles and ... •Jeffrey Dahmer ... •Investigated multiple,](https://reader031.vdocuments.mx/reader031/viewer/2022020214/5ae9099e7f8b9a3d3b90ccff/html5/thumbnails/13.jpg)
Conformity Social Engineering Examples
• Physical
• Tailgating a Group
• Phishing
13
• Phishing
• Group Inclusion/Pressure Emails
• Peer Emails to join fake/new social site or job
focused site
![Page 14: Psychological Principles in Social Engineeringaz9194.vo.msecnd.net/pdfs/110902/3381.pdf · common psychological principles and ... •Jeffrey Dahmer ... •Investigated multiple,](https://reader031.vdocuments.mx/reader031/viewer/2022020214/5ae9099e7f8b9a3d3b90ccff/html5/thumbnails/14.jpg)
Conformity Social Engineering Examples
• Phishing Example:
Dear Target,
There are currently 15 members of your company who have enrolled in CorporateLink.com.
The following is a list of members from your company who joined CorporateLink.com today:
14
Smith
Jones
Wright
James
Join now: http://malicioussite.com/join.php
CorporateLink Team
![Page 15: Psychological Principles in Social Engineeringaz9194.vo.msecnd.net/pdfs/110902/3381.pdf · common psychological principles and ... •Jeffrey Dahmer ... •Investigated multiple,](https://reader031.vdocuments.mx/reader031/viewer/2022020214/5ae9099e7f8b9a3d3b90ccff/html5/thumbnails/15.jpg)
Obedience to Authority
• Milgram Experiment
• Three participants
• Teacher (volunteer)
• Learner (confederate)
15
• Learner (confederate)
• Experimenter
![Page 16: Psychological Principles in Social Engineeringaz9194.vo.msecnd.net/pdfs/110902/3381.pdf · common psychological principles and ... •Jeffrey Dahmer ... •Investigated multiple,](https://reader031.vdocuments.mx/reader031/viewer/2022020214/5ae9099e7f8b9a3d3b90ccff/html5/thumbnails/16.jpg)
Obedience to Authority
• Milgram Experiment
• The Learner is setup with an electrode attached to
his arm.
• The Teacher and Learner are in different rooms
16
• The Teacher and Learner are in different rooms
but can communicate with each other.
• The Teacher is shown equipment that will deliver
electric shock to the Learner when a wrong answer
is given.
![Page 17: Psychological Principles in Social Engineeringaz9194.vo.msecnd.net/pdfs/110902/3381.pdf · common psychological principles and ... •Jeffrey Dahmer ... •Investigated multiple,](https://reader031.vdocuments.mx/reader031/viewer/2022020214/5ae9099e7f8b9a3d3b90ccff/html5/thumbnails/17.jpg)
Obedience to Authority
• Milgram Experiment Results
• Pre-test surveys predicted that 1-3/100
participants would deliver the 450 volt shock.
17
• 26/40 participants delivered the 450 volt
maximum shock
![Page 18: Psychological Principles in Social Engineeringaz9194.vo.msecnd.net/pdfs/110902/3381.pdf · common psychological principles and ... •Jeffrey Dahmer ... •Investigated multiple,](https://reader031.vdocuments.mx/reader031/viewer/2022020214/5ae9099e7f8b9a3d3b90ccff/html5/thumbnails/18.jpg)
Obedience to Authority Examples
• The Holocaust
• A motivating factor for the Milgram Experiment
• Nazi guards viewed atrocities as “following orders” and
managed completely separate, and seemingly “normal”
18
managed completely separate, and seemingly “normal”
lives
• Objectification and increasingly horrendous atrocities
enabled guards to become desensitized
![Page 19: Psychological Principles in Social Engineeringaz9194.vo.msecnd.net/pdfs/110902/3381.pdf · common psychological principles and ... •Jeffrey Dahmer ... •Investigated multiple,](https://reader031.vdocuments.mx/reader031/viewer/2022020214/5ae9099e7f8b9a3d3b90ccff/html5/thumbnails/19.jpg)
Serial Killers
Obedience / Authority
• Business Owners Recruited Victims
• John Wayne Gacy
19
• Wayne Williams
• Abuse of Authority
• Dennis Rader
• Ted Bundy
![Page 20: Psychological Principles in Social Engineeringaz9194.vo.msecnd.net/pdfs/110902/3381.pdf · common psychological principles and ... •Jeffrey Dahmer ... •Investigated multiple,](https://reader031.vdocuments.mx/reader031/viewer/2022020214/5ae9099e7f8b9a3d3b90ccff/html5/thumbnails/20.jpg)
Obedience to Authority SE Examples
• Social Engineering Examples
• Hierarchy Jumping
• Phishing
20
• Phone
• Physical
![Page 21: Psychological Principles in Social Engineeringaz9194.vo.msecnd.net/pdfs/110902/3381.pdf · common psychological principles and ... •Jeffrey Dahmer ... •Investigated multiple,](https://reader031.vdocuments.mx/reader031/viewer/2022020214/5ae9099e7f8b9a3d3b90ccff/html5/thumbnails/21.jpg)
Obedience to Authority SE Examples
• Social Engineering Examples
• Phishing
Target,
Our Audit team needs you to fill out the attached questionnaire immediately. Please open
21
the attached document, answer the four questions in the space provided and click submit.
Regards,
Internal Audit
![Page 22: Psychological Principles in Social Engineeringaz9194.vo.msecnd.net/pdfs/110902/3381.pdf · common psychological principles and ... •Jeffrey Dahmer ... •Investigated multiple,](https://reader031.vdocuments.mx/reader031/viewer/2022020214/5ae9099e7f8b9a3d3b90ccff/html5/thumbnails/22.jpg)
Ingratiation
• Ingratiation
• Becoming more likeable to a target
22
![Page 23: Psychological Principles in Social Engineeringaz9194.vo.msecnd.net/pdfs/110902/3381.pdf · common psychological principles and ... •Jeffrey Dahmer ... •Investigated multiple,](https://reader031.vdocuments.mx/reader031/viewer/2022020214/5ae9099e7f8b9a3d3b90ccff/html5/thumbnails/23.jpg)
Ingratiation
• Seiter Ingratiation Experiment
• Food servers will receive significantly higher
tips when they compliment their customers
than when they do not.
23
than when they do not.
• Servers complimented patrons on their order
in about half of the cases.
![Page 24: Psychological Principles in Social Engineeringaz9194.vo.msecnd.net/pdfs/110902/3381.pdf · common psychological principles and ... •Jeffrey Dahmer ... •Investigated multiple,](https://reader031.vdocuments.mx/reader031/viewer/2022020214/5ae9099e7f8b9a3d3b90ccff/html5/thumbnails/24.jpg)
Ingratiation
• Seiter Ingratiation Experiment
• Results
• Complimented Patrons Left
24
• Complimented Patrons Left
• 18.94% Gratuity
• Control Patrons Left
• 16.41% Gratuity
![Page 25: Psychological Principles in Social Engineeringaz9194.vo.msecnd.net/pdfs/110902/3381.pdf · common psychological principles and ... •Jeffrey Dahmer ... •Investigated multiple,](https://reader031.vdocuments.mx/reader031/viewer/2022020214/5ae9099e7f8b9a3d3b90ccff/html5/thumbnails/25.jpg)
Ingratiation Examples
• Serial Killers
• Employ Ingratiation to claim victims
• Jeffrey Dahmer
• John Wayne Gacy
25
• John Wayne Gacy
• Employ Ingratiation against investigators
• Inquire about details of the investigation, may also draw
unnecessary suspicion
• 1996 Olympic Park Bombing
• Dennis Rader, BTK Killer
![Page 26: Psychological Principles in Social Engineeringaz9194.vo.msecnd.net/pdfs/110902/3381.pdf · common psychological principles and ... •Jeffrey Dahmer ... •Investigated multiple,](https://reader031.vdocuments.mx/reader031/viewer/2022020214/5ae9099e7f8b9a3d3b90ccff/html5/thumbnails/26.jpg)
Ingratiation Social Engineering Examples
• Physical Compliments
• Knowledge
• Dress
26
• Age Based
• Phishing Compliments
• Performance Based
• Accolades of Public Material
![Page 27: Psychological Principles in Social Engineeringaz9194.vo.msecnd.net/pdfs/110902/3381.pdf · common psychological principles and ... •Jeffrey Dahmer ... •Investigated multiple,](https://reader031.vdocuments.mx/reader031/viewer/2022020214/5ae9099e7f8b9a3d3b90ccff/html5/thumbnails/27.jpg)
Ingratiation Social Engineering Examples
• Phishing
Dear Target,
We noticed that you have obtained your CISSP, CISA and CSSLP. Congratulations, you
must have worked very hard!
We are looking to people like you who are accomplished within industry and model mentors
to help students and recent graduates looking to establish a career in information security.
27
to help students and recent graduates looking to establish a career in information security.
Please take a few minutes to review our program as it won't require a large time investment
and can help the next generation of professionals.
http://maliciouswebsite.com/mentor_program.aspx
Regards,
Security Mentor Group
![Page 28: Psychological Principles in Social Engineeringaz9194.vo.msecnd.net/pdfs/110902/3381.pdf · common psychological principles and ... •Jeffrey Dahmer ... •Investigated multiple,](https://reader031.vdocuments.mx/reader031/viewer/2022020214/5ae9099e7f8b9a3d3b90ccff/html5/thumbnails/28.jpg)
Influence/Persuasion
• Cialdini
• Weapons of Influence
• Reciprocity
• Commitment and Consistency
28
• Commitment and Consistency
• Social Proof
• Authority
• Liking
• Scarcity
![Page 29: Psychological Principles in Social Engineeringaz9194.vo.msecnd.net/pdfs/110902/3381.pdf · common psychological principles and ... •Jeffrey Dahmer ... •Investigated multiple,](https://reader031.vdocuments.mx/reader031/viewer/2022020214/5ae9099e7f8b9a3d3b90ccff/html5/thumbnails/29.jpg)
Influence/Persuasion Examples
• Scarcity
• Home Shopping Channels
• Offers are only available for a limited time
• Countdown is available on the screen
29
• Countdown is available on the screen
• Time frames are mentioned
• Time left to Christmas
![Page 30: Psychological Principles in Social Engineeringaz9194.vo.msecnd.net/pdfs/110902/3381.pdf · common psychological principles and ... •Jeffrey Dahmer ... •Investigated multiple,](https://reader031.vdocuments.mx/reader031/viewer/2022020214/5ae9099e7f8b9a3d3b90ccff/html5/thumbnails/30.jpg)
Influence/Persuasion Examples
• Scarcity
• Physical
• Late for a meeting
• Electronic
30
• Electronic
• Phishing
• 24 hour deal
![Page 31: Psychological Principles in Social Engineeringaz9194.vo.msecnd.net/pdfs/110902/3381.pdf · common psychological principles and ... •Jeffrey Dahmer ... •Investigated multiple,](https://reader031.vdocuments.mx/reader031/viewer/2022020214/5ae9099e7f8b9a3d3b90ccff/html5/thumbnails/31.jpg)
Influence/Persuasion Examples
• Phishing
All,
We are upgrading our email server tonight at 3 a.m. EST. To ensure that you do not get
locked out of your account and that you can continue to use your mobile device, you will
need to login to our OWA server as soon as possible.
31
need to login to our OWA server as soon as possible.
https://malicious.com/owa/
Regards,
IT
![Page 32: Psychological Principles in Social Engineeringaz9194.vo.msecnd.net/pdfs/110902/3381.pdf · common psychological principles and ... •Jeffrey Dahmer ... •Investigated multiple,](https://reader031.vdocuments.mx/reader031/viewer/2022020214/5ae9099e7f8b9a3d3b90ccff/html5/thumbnails/32.jpg)
Predicting Behavior
• Criminal Profilers
• Robert Ressler
• John Douglas
32
• John Douglas
• Roy Hazelwood
![Page 33: Psychological Principles in Social Engineeringaz9194.vo.msecnd.net/pdfs/110902/3381.pdf · common psychological principles and ... •Jeffrey Dahmer ... •Investigated multiple,](https://reader031.vdocuments.mx/reader031/viewer/2022020214/5ae9099e7f8b9a3d3b90ccff/html5/thumbnails/33.jpg)
Criminal Profilers
• Pioneered the art of applying psychological principles
to criminal investigations using detailed interviews
with convicted serial killers
• By observing and comparing their findings, profilers
were able to “get into the mind” of the serial killer and
33
were able to “get into the mind” of the serial killer and
create guides to local law enforcement to track down
killers
• These approaches are similar in concept to those
used to understand and defend against experienced
social engineering attacks
![Page 34: Psychological Principles in Social Engineeringaz9194.vo.msecnd.net/pdfs/110902/3381.pdf · common psychological principles and ... •Jeffrey Dahmer ... •Investigated multiple,](https://reader031.vdocuments.mx/reader031/viewer/2022020214/5ae9099e7f8b9a3d3b90ccff/html5/thumbnails/34.jpg)
Robert Ressler
• Coined the term “serial killer”
• Key player in setting up the VICAP (Violent Criminal
Apprehension Program) computer-based system
• Instrumental in organizing the original program to
34
• Instrumental in organizing the original program to
interview notorious serial killers
![Page 35: Psychological Principles in Social Engineeringaz9194.vo.msecnd.net/pdfs/110902/3381.pdf · common psychological principles and ... •Jeffrey Dahmer ... •Investigated multiple,](https://reader031.vdocuments.mx/reader031/viewer/2022020214/5ae9099e7f8b9a3d3b90ccff/html5/thumbnails/35.jpg)
John Douglas / Roy Hazelwood
• Leading pioneers along with Robert
Ressler in the field of criminal profiling
• Investigated multiple, high profile serial murder cases
• Atlanta child murders
• Green River Killer
35
• Green River Killer
• Alaskan serial killer Robert Hansen
• Douglas was the inspiration for “Jack Crawford” in
Thomas Harris novels
![Page 36: Psychological Principles in Social Engineeringaz9194.vo.msecnd.net/pdfs/110902/3381.pdf · common psychological principles and ... •Jeffrey Dahmer ... •Investigated multiple,](https://reader031.vdocuments.mx/reader031/viewer/2022020214/5ae9099e7f8b9a3d3b90ccff/html5/thumbnails/36.jpg)
In Conclusion
• Fundamental psychological principles are important
in both executing and defending against social
engineering attacks
• Examining extreme historical atrocities and behaviors
provides an understanding of psychological principles
36
provides an understanding of psychological principles
• An understanding of these principles allows for better
defenses and pretexting exercises
![Page 37: Psychological Principles in Social Engineeringaz9194.vo.msecnd.net/pdfs/110902/3381.pdf · common psychological principles and ... •Jeffrey Dahmer ... •Investigated multiple,](https://reader031.vdocuments.mx/reader031/viewer/2022020214/5ae9099e7f8b9a3d3b90ccff/html5/thumbnails/37.jpg)
References• Mann, Ian (2008). Hacking the Human: Social Engineering Techniques and Security Countermeasures. Burlington, VT:
Gower.
• Cialdini, Robert B (2006). Influence: The Psychology of Persuasion (Collins Business Essentials). New York, NY: Quill
• A&E Biography. (Director). (2000). Serial Killers: Profiling the Criminal Mind [DVD]. New York: A&E Television Networks
& ABC News Productions.
• Friend, Ronald; Rafferty Yvonne; Bramel, Dana (1990). A puzzling misinterpretation of the Asch “conformity” study.
European Journal of Social Psychology
• [1] Photo: Breaking Bad from AMCTV: http://www.amctv.com/breaking-bad/videos/breaking-bad-talked-about-scenes-jesse-
and-the-meth-head
37
and-the-meth-head
• [2] Photo: Vision Test Wikipedia.org: http://en.wikipedia.org/wiki/File:Asch_experiment.png
• Wikipedia. Conformity Definition. http://en.wikipedia.org/wiki/Conformity
• Muzafer Sherif (1935). "A study of some social factors in perception: Chapter 3." Archives of Psychology
![Page 38: Psychological Principles in Social Engineeringaz9194.vo.msecnd.net/pdfs/110902/3381.pdf · common psychological principles and ... •Jeffrey Dahmer ... •Investigated multiple,](https://reader031.vdocuments.mx/reader031/viewer/2022020214/5ae9099e7f8b9a3d3b90ccff/html5/thumbnails/38.jpg)
Questions?
Thank you for watching our presentation. We can be reached at the following addresses:
Joe Sechman, CISSP|CSSLP|CISA
Director
Robert Carr, MBA|CISSP|OSCP
Sr. Manager
38
You can also visit us at www.sunera.com
and our blog at security.sunera.com