Social engineering exploits human vulnerabilities by manipulating users to obtain confidential information. It works by avoiding activation of the critical thinking faculty and creating contexts where inappropriate behaviors seem natural. Three main human vulnerabilities exploited are that people leak information, are vulnerable to each other through social influences, and can be manipulated through web browsers. Social engineers use techniques like reciprocity, authority, social proof, confirmation bias, scarcity and emotional appeals to create frames that strengthen influence over targets.
2. Social Engineering:
The practice of obtaining
confidential information by
manipulating users.
Source: Wikipedia
3. Social Media Applications are
“applications that inherently
connect people and
information in spontaneous,
interactive ways”
Mark Drapeau and Linton Wells
National Defense University (NDU)
4. The Tipping Point
http://1.media.tumblr.com/iNIi9iwtqk9wp2rxEL7NpIPVo1_500.jpg
http://www.blogohblog.com/wp-content/pop/2008/03/facebook_chart.gif
8. Information Leakage
• Intentional or Ignorance
• We leak a million things
– Images
– GPS Coordinates
– Picnic Flyers
– Group Messages/Conversations
– Job Postings
• If you can imagine it, you can find it.
12. Only two things are infinite: the
universe and human stupidity.
And I'm not sure about the former.
- Albert Einsten
12
13. Human Vulnerability
• Humans are social creatures
• Human nature makes us vulnerable to each
other
• Social engineers exploit weaknesses in
human nature to obtain information or
access
14. The Critical Faculty
• The hypnotist’s term for the part of the mind
that acts as the rational alert system
– Allows the human to act on largely unconscious
process
– Things raise to conscious awareness based on CF
activation
• This suggests that all SE success is CF-related
– Avoid activating critical-faculty
– We want the person to execute a task that is
inappropriate, yet fail to raise the CF alert to
conscious awareness 14
23. Actual Email from TD
Hello Michael Murray,
I appreciate your interest in viewing your TD Visa account information
using EasyWeb. Thank you for taking the time to write.
If you currently have an active EasyWeb profile but can not access your TD
Visa, you may have 2 separate customer profiles set up with TD Canada
Trust. For immediate assistance with correcting this situation, I
encourage you to call EasyLine toll free at 1-866-222-3456. A Banking
Specialist can combine your profiles if necessary, provided that the
personal information on both profiles match. Representatives are available
24 hours a day, 7 days a week. If you are not registered for EasyLine,
kindly press 2 and then 0 to speak with a representative. The combining
process usually takes about two days to complete, and once it is finished,
you should be able to view your entire personal portfolio via EasyWeb.
26. During the run-up to the 2004 presidential election, while undergoing an fMRI bran scan, 30 men--
half self-described as "strong" Republicans and half as "strong“ Democrats--were tasked with
assessing statements by both George W. Bush and John Kerry in which the candidates clearly
contradicted themselves. . Not surprisingly, in their assessments Republican subjects were as critical
of Kerry as Democratic subjects were of Bush, yet both let their own candidate off the hook….
The neuroimaging results, however, revealed that…
"We did not see any increased activation of the parts of
the brain normally engaged during reasoning"
From: http://resonancetechnologies.com/press/articles/ThePoliticalBrain.pdf
28. Back to TD
Hello Michael Murray,
I appreciate your interest in viewing your TD Visa account information using EasyWeb. Thank you for taking the time to write.
If you currently have an active EasyWeb profile but can not access your TD Visa, you may have 2 separate customer profiles set up with TD Canada Trust. For
immediate assistance with correcting this situation, I encourage you to call EasyLine toll free at 1-866-222-3456. A Banking Specialist can combine your profiles if
necessary, provided that the personal information on both profiles match. Representatives are available 24 hours a day, 7 days a week. If you are not registered for
EasyLine, kindly press 2 and then 0 to speak with a representative. The combining process usually takes about two days to complete, and once it is finished, you
should be able to view your entire personal portfolio via EasyWeb.
Best regards,
Debra Matsumoto
Internet Correspondence Representative
________________________________________
TD Canada Trust 1-866-222-3456
http://www.tdcanadatrust.com
Email: customer.service@td.com
TDD (Telephone Device for the Deaf) 1-800-361-1180
This email is directed to, and intended for the exclusive use of, the addressee indicated above. TD Canada Trust endeavours to provide accurate and up-to-date
information relating to its products and services. However, please note that rates, fees and information are subject to change.
32. Reciprocity == Investment
• The act of exchanging value
– I can do something for you
– You can do something for me.
• Both acts strengthen our bond.
– We become more invested in the relationship
– The more invested a person feels, the more likely they
are to be influenced by the relationship
• This is the Nigerian scam’s overwhelming
power
32
33.
34. Scarcity
• People will take almost any opportunity for
their own gain
– Especially if the opportunity seems scarce
– If we have to hurry, the amygdala takes over
• This is a marketing tactic
– Infomercials
– Scams
34
35. “If you call in the next 15 minutes…”
Ron Popeil