WEBVTT

1
00:00.000 --> 00:00.090 align:middle line:84%


2
00:00.090 --> 00:02.298 align:middle line:90%
The next exploit that we're
going to be talking about

3
00:02.298 --> 00:05.310 align:middle line:90%
is one of my favorite ones to
talk about, social engineering

4
00:05.310 --> 00:08.400 align:middle line:90%
and phishing because instead
of exploiting technology,

5
00:08.400 --> 00:10.110 align:middle line:84%
it's exploiting the person.

6
00:10.110 --> 00:12.210 align:middle line:90%
And I've seen this in
action many, many times

7
00:12.210 --> 00:13.360 align:middle line:84%
throughout my career.

8
00:13.360 --> 00:15.652 align:middle line:90%
So in this Nugget, what we're
going to be talking about

9
00:15.652 --> 00:18.778 align:middle line:90%
is how an attacker may actually
prey on the person instead

10
00:18.778 --> 00:20.070 align:middle line:84%
of the tech that they're using.

11
00:20.070 --> 00:20.873 align:middle line:84%
Let's get going.

12
00:20.873 --> 00:23.290 align:middle line:90%
The next one is one that I
really like talking about a lot

13
00:23.290 --> 00:25.783 align:middle line:90%
because it's one that
if you work in IT,

14
00:25.783 --> 00:27.450 align:middle line:90%
this is the one that's
going to get you.

15
00:27.450 --> 00:29.867 align:middle line:90%
This is the one that's really
going to get your end users.

16
00:29.867 --> 00:32.100 align:middle line:90%
And that's phishing
and social engineering.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

16
00:29.867 --> 00:32.100 align:middle line:90%
And that's phishing
and social engineering.

17
00:32.100 --> 00:33.900 align:middle line:90%
Now these are two
different attacks.

18
00:33.900 --> 00:36.660 align:middle line:90%
But they're categorized
into the same section

19
00:36.660 --> 00:38.340 align:middle line:90%
because what they
really do is they

20
00:38.340 --> 00:41.310 align:middle line:90%
play on the
vulnerability of people,

21
00:41.310 --> 00:43.717 align:middle line:84%
the trustworthiness of people.

22
00:43.717 --> 00:45.300 align:middle line:90%
And that's where
they really get your.

23
00:45.300 --> 00:48.750 align:middle line:90%
With phishing, this is commonly
carried out through email.

24
00:48.750 --> 00:51.630 align:middle line:90%
And this is where you get an
email that looks legitimate,

25
00:51.630 --> 00:54.990 align:middle line:90%
it looks like it's coming
from maybe Microsoft, or maybe

26
00:54.990 --> 00:57.070 align:middle line:90%
Facebook, or
something like that.

27
00:57.070 --> 00:59.513 align:middle line:90%
But the email address would
be something more like--

28
00:59.513 --> 01:00.930 align:middle line:90%
I'm just picking
on Facebook here.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

28
00:59.513 --> 01:00.930 align:middle line:90%
I'm just picking
on Facebook here.

29
01:00.930 --> 01:02.760 align:middle line:90%
Facebook is really
secure and everything--

30
01:02.760 --> 01:06.373 align:middle line:90%
but it might be
FacebookSSupport.

31
01:06.373 --> 01:08.040 align:middle line:90%
And then it may be
two T's, or something

32
01:08.040 --> 01:14.442 align:middle line:84%
like that, @msYb125.com.

33
01:14.442 --> 01:15.840 align:middle line:84%
But you don't see that.

34
01:15.840 --> 01:17.550 align:middle line:90%
You never look at
the email address.

35
01:17.550 --> 01:20.370 align:middle line:90%
All you see is something
like Facebook support.

36
01:20.370 --> 01:23.250 align:middle line:90%
And in close but
not perfect English,

37
01:23.250 --> 01:26.220 align:middle line:90%
it says something like
click this link right here

38
01:26.220 --> 01:29.070 align:middle line:90%
to reset your password, maybe
because your account's been

39
01:29.070 --> 01:31.080 align:middle line:90%
compromised, or
maybe because you
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

39
01:29.070 --> 01:31.080 align:middle line:90%
compromised, or
maybe because you

40
01:31.080 --> 01:32.880 align:middle line:90%
have 30 days to
reset your password,

41
01:32.880 --> 01:34.090 align:middle line:84%
or something like that.

42
01:34.090 --> 01:36.840 align:middle line:90%
But the thing is, is this link
doesn't take you to Facebook.

43
01:36.840 --> 01:40.860 align:middle line:84%
It takes you to msYb125.com.

44
01:40.860 --> 01:43.030 align:middle line:90%
And it looks like
a Facebook page.

45
01:43.030 --> 01:44.680 align:middle line:90%
So when you type in
your current user

46
01:44.680 --> 01:47.280 align:middle line:90%
name and your current
password, guess what?

47
01:47.280 --> 01:49.020 align:middle line:90%
They've now got your
Facebook account

48
01:49.020 --> 01:51.630 align:middle line:90%
because you were
misdirected to something

49
01:51.630 --> 01:52.860 align:middle line:84%
that looked legitimate.

50
01:52.860 --> 01:54.780 align:middle line:90%
You had an email that
looked legitimate,

51
01:54.780 --> 01:56.370 align:middle line:90%
and you had a website
that it took you

52
01:56.370 --> 01:57.930 align:middle line:84%
to that it looked legitimate.

53
01:57.930 --> 02:00.330 align:middle line:84%
But it was just a little off.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

53
01:57.930 --> 02:00.330 align:middle line:84%
But it was just a little off.

54
02:00.330 --> 02:03.180 align:middle line:90%
And to the unsuspecting
eye, or the untrained eye,

55
02:03.180 --> 02:04.680 align:middle line:84%
they totally fell for it.

56
02:04.680 --> 02:06.600 align:middle line:84%
And this is called phishing.

57
02:06.600 --> 02:09.449 align:middle line:90%
Attackers send this email
out to tens of thousands

58
02:09.449 --> 02:12.100 align:middle line:90%
or even hundreds of
thousands of people at once.

59
02:12.100 --> 02:14.960 align:middle line:90%
And all they're hoping for is
that one or two fall for it.

60
02:14.960 --> 02:17.370 align:middle line:90%
And chances are,
they probably will.

61
02:17.370 --> 02:19.260 align:middle line:90%
Now there is a type
of phishing where

62
02:19.260 --> 02:22.260 align:middle line:90%
they go after C-level
executives and directors.

63
02:22.260 --> 02:23.820 align:middle line:84%
And that is called whaling.

64
02:23.820 --> 02:26.910 align:middle line:90%
That is a more
targeted attack, trying

65
02:26.910 --> 02:30.210 align:middle line:90%
to get usernames and passwords
to the sensitive information
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

65
02:26.910 --> 02:30.210 align:middle line:90%
to get usernames and passwords
to the sensitive information

66
02:30.210 --> 02:33.228 align:middle line:90%
of the CEOs and
C-level executives.

67
02:33.228 --> 02:34.770 align:middle line:90%
So that's phishing
and whaling, where

68
02:34.770 --> 02:38.010 align:middle line:90%
they're just firing off emails
and hoping something sticks.

69
02:38.010 --> 02:39.900 align:middle line:90%
Something that's a
little more involved,

70
02:39.900 --> 02:42.780 align:middle line:90%
actually a lot more involved,
is social engineering.

71
02:42.780 --> 02:45.520 align:middle line:90%
Now there are steps
to social engineering.

72
02:45.520 --> 02:47.790 align:middle line:90%
And these are the things
that you need to look for.

73
02:47.790 --> 02:49.350 align:middle line:90%
First thing that the
attacker is going to do,

74
02:49.350 --> 02:51.308 align:middle line:90%
is they're going to be
researching the business

75
02:51.308 --> 02:53.670 align:middle line:90%
and figuring out, OK,
who do they partner with?

76
02:53.670 --> 02:54.680 align:middle line:84%
Who do they work with?

77
02:54.680 --> 02:56.400 align:middle line:90%
What do their
receipts look like?

78
02:56.400 --> 02:58.410 align:middle line:90%
That way, they
can set the stage.

79
02:58.410 --> 03:01.560 align:middle line:90%
They can identify themselves
as somebody else or somebody
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

79
02:58.410 --> 03:01.560 align:middle line:90%
They can identify themselves
as somebody else or somebody

80
03:01.560 --> 03:05.040 align:middle line:90%
trustworthy based on who
the company is already

81
03:05.040 --> 03:05.760 align:middle line:84%
working with.

82
03:05.760 --> 03:08.110 align:middle line:90%
They figure out who
they're going to identify.

83
03:08.110 --> 03:11.310 align:middle line:90%
And even though it says,
identify frustrated employees,

84
03:11.310 --> 03:13.470 align:middle line:90%
it's not necessarily
frustrated employees.

85
03:13.470 --> 03:16.020 align:middle line:90%
They're just looking for
someone that they can fool.

86
03:16.020 --> 03:17.970 align:middle line:90%
And as terrible
as this is to say,

87
03:17.970 --> 03:21.640 align:middle line:90%
sometimes this is actually the
nicest person in your company.

88
03:21.640 --> 03:24.540 align:middle line:90%
So over time, they'll find a
way to build a relationship

89
03:24.540 --> 03:27.360 align:middle line:90%
with them, maybe pretending
to be someone they're not.

90
03:27.360 --> 03:29.640 align:middle line:90%
For instance, maybe they've
done dumpster diving

91
03:29.640 --> 03:32.100 align:middle line:90%
and found a receipt
for AT&T. Maybe
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

91
03:29.640 --> 03:32.100 align:middle line:90%
and found a receipt
for AT&T. Maybe

92
03:32.100 --> 03:35.250 align:middle line:90%
then they identify someone
within the company that

93
03:35.250 --> 03:37.470 align:middle line:84%
believes they work with AT&T.

94
03:37.470 --> 03:39.350 align:middle line:90%
So they dress up
like an AT&T employee

95
03:39.350 --> 03:41.880 align:middle line:90%
and they have an
AT&T bill of service.

96
03:41.880 --> 03:45.310 align:middle line:90%
And they show up to the front
door and tell them, look,

97
03:45.310 --> 03:48.098 align:middle line:90%
I'm with AT&T. I'm here to
do some work on your network.

98
03:48.098 --> 03:49.890 align:middle line:90%
And that's how they
build the relationship.

99
03:49.890 --> 03:52.380 align:middle line:90%
The person being as
friendly as they are,

100
03:52.380 --> 03:54.060 align:middle line:90%
doesn't check to
see that they have

101
03:54.060 --> 03:56.400 align:middle line:90%
an appointment with AT&T.
They just let them in

102
03:56.400 --> 03:58.440 align:middle line:84%
because they trust AT&T.

103
03:58.440 --> 04:01.020 align:middle line:90%
And lastly, they exploit
the relationship.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

103
03:58.440 --> 04:01.020 align:middle line:90%
And lastly, they exploit
the relationship.

104
04:01.020 --> 04:03.390 align:middle line:90%
Now that the person
has unfettered access

105
04:03.390 --> 04:06.420 align:middle line:90%
into the business because they
look like an AT&T employee,

106
04:06.420 --> 04:08.658 align:middle line:90%
they're going to walk around
and find a server room.

107
04:08.658 --> 04:10.200 align:middle line:90%
And all they have
to do at this point

108
04:10.200 --> 04:14.160 align:middle line:90%
is plug in a USB stick with
their attacking software in it.

109
04:14.160 --> 04:15.120 align:middle line:84%
And here's the thing.

110
04:15.120 --> 04:18.630 align:middle line:90%
Earlier we talked about white
hat hackers and pen testers,

111
04:18.630 --> 04:21.329 align:middle line:90%
you better believe,
what I just described

112
04:21.329 --> 04:23.400 align:middle line:84%
is exactly what they do.

113
04:23.400 --> 04:26.400 align:middle line:90%
When I was a consultant,
we hired a pen tester

114
04:26.400 --> 04:28.890 align:middle line:90%
to tell one of the companies
about their vulnerabilities.

115
04:28.890 --> 04:32.100 align:middle line:90%
They showed up dressed
like an AT&T employee.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

115
04:28.890 --> 04:32.100 align:middle line:90%
They showed up dressed
like an AT&T employee.

116
04:32.100 --> 04:34.500 align:middle line:90%
They had unfettered
access to everything

117
04:34.500 --> 04:35.970 align:middle line:84%
in the entire environment.

118
04:35.970 --> 04:40.770 align:middle line:90%
They plugged a USB stick into
the server in the server room.

119
04:40.770 --> 04:42.982 align:middle line:90%
They went into
every single office.

120
04:42.982 --> 04:44.190 align:middle line:84%
And you know what they found?

121
04:44.190 --> 04:47.220 align:middle line:90%
In one of the offices of the
principal software developers

122
04:47.220 --> 04:49.500 align:middle line:90%
there, the principal
software developer

123
04:49.500 --> 04:51.510 align:middle line:90%
had left their
computer unlocked,

124
04:51.510 --> 04:55.290 align:middle line:90%
logged into the SQL server
as the systems administrator.

125
04:55.290 --> 04:57.660 align:middle line:90%
And now the pen
tester had full access

126
04:57.660 --> 05:00.440 align:middle line:90%
to the entire database
of confidential data.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

126
04:57.660 --> 05:00.440 align:middle line:90%
to the entire database
of confidential data.

127
05:00.440 --> 05:03.620 align:middle line:90%
All it took was just
looking trustworthy enough

128
05:03.620 --> 05:05.180 align:middle line:84%
to get past the front door.

129
05:05.180 --> 05:08.120 align:middle line:90%
And that's the power of
phishing and social engineering.

130
05:08.120 --> 05:10.790 align:middle line:90%
And this is why it honestly
may be your number one

131
05:10.790 --> 05:11.820 align:middle line:84%
vulnerability.

132
05:11.820 --> 05:13.580 align:middle line:90%
So that's phishing and
social engineering.

133
05:13.580 --> 05:15.288 align:middle line:90%
I hope this has been
informative for you.

134
05:15.288 --> 05:17.680 align:middle line:90%
And I'd like to thank
you for viewing.