In this lesson,
we'll be focused on the motivational triggers
used by social engineers.
The backbone of social engineering lies
in the ability of an attacker to trigger a user
into doing something for them.
So, how do social engineers get a user
to fall for their attacks?
Well, that all comes down to the motivational triggers
used by social engineer to convincing
unsuspecting user to perform some malicious action
on behalf of an attack.
Now, there are six main types of motivational triggers
that social engineers use, including authority, urgency,
social proof, scarcity, likability and fear.
First, we have authority.
Most people are willing to comply
and do whatever you tell them to do
if they believe it comes from somebody
who is in a position of authority to make the requests.
For example, if an attacker pretends that they're a manager
or a high level executive within the organization,
they will probably be able to convince
some lower level employee to do
whatever they need to complete their attack.
Or our attacker can pretend to be an important client
that will have pressure on wanting employees to do something
because after all, they are the client
and employee's job is to make sure
that the client is happy, right?
I have also seen social engineers try to pretend
that they're an employee
of a government agency like the IRS,
and they will send you emails
or leave voicemails claiming that,
if you don't call them back
and provide them a payment for a late fee
associated with your tax return in the next 24 hours,
then they're going to send agency your house and arrest you.
In reality though, they're not part of the IRS
or the government all,
but instead they're assuming that governmental authority
to try to scare you into providing sense of information
like credit card number.
This is just a scam that someone is attempting against you
using authority as their motivational trigger.
Second, we have urgency.
Urgency refers to the compelling sense
of immediacy or time sensitivity
that drives individuals to act swiftly
or prioritize certain actions.
Now, these days, most of us are in a rush all of the time,
and we just don't have the time to stop
and analyze a given situation fully.
By our very nature, most people want to be helpful.
So if an attacker walks up to the front door
of a office building with their hands full of boxes
and claims they're late for a meeting,
you may be tempted to swipe your access badge
and let them into the building
instead of making them put down
all the boxes that they're carrying
and swipe their own access badge, even if they have one.
Most of us wouldn't even think twice
about holding that door open.
But using urgency,
the social engineer can trick you
into letting them to the building
without providing their own identification badge.
I've also seen social engineering techs
that rely on urgency,
when an attacker runs up to the person's front desk,
hands them a USB thumb drive with a PowerPoint file on it
and tells the employee they have a big presentation
to deliver to the company's executives
the next five minutes,
but their printer is broken
and they need the employee
to print off two copies of the slides
from that USB thumb drive.
Well, if you take the device
and connect it to your computer,
the PowerPoint will probably open a print,
But there may be some malware that is going
to be installed in the background
on that computer system out your knowledge.
Since the attacker claimed they needed it
right now for the presentation in five minutes,
you have decided to skip
all your organization's normal procedures
for handling removable media,
like scanning it for malware before connecting it
to your network computer system.
Or I have also seen attackers try
calling up the technical support help desk
and claim they're locked out of their account
and need their password reset.
The help desk technician may tell them that they need
to come to the help desk in person
to show their identification badge
before their account's password can be reset,
and the social engineer will use urgency
to try and convince the tech support person
that the password must be reset right now
and can't wait since there's a big deadline approaching.
Again, they're trying to drive home this sense of urgency
to get the organization's employees to ignore
or bypass their normal security procedures
and then be able to gain access to their systems.
Third, we have social proof.
Social proof is a psychological phenomenon
where individuals look
to the behaviors and actions of others
to determine their own decisions and actions
in similar situations.
Now, let's pretend that an attacker creates a website
with fake and scammy information on it.
They may attempt to use phishing,
to get people to get to their website.
Now, that might not be very effective
because people might detect that it was a phishing campaign,
but what if I got people to start spreading the word
about my new website on Facebook
or LinkedIn or Instagram or whatever,
and now their friends start going to my website
because they think it's legitimate
since their online friends posted about my website.
This is the idea of social proof.
If I can get likes and shares on social media
for my scamming website,
people are going to be much more likely to click the link
because it has a lot of likes, a lot of shares,
and a lot of their friends who claim they've used the site.
So if a social engineer can trick
one friend into posting about it,
that friend might influence a second friend
and then a third and then a fourth and so on.
Remember, people crave being part of a social group.
People want to have social interaction,
and most people have an inherent need to feel included.
So by using social proof,
we can use that desire against them.
Online marketers use social proof all the time.
After all, before you signed up for this class,
I bet you took a look at the reviews
to see what others said about this course.
If you looked at the reviews,
and there were zero people enrolled in this course,
you might just assume it is a worthless course
and you will find a different one.
On the other hand, if you see that there's more
than 100,000 people enrolled in this course
and it has tens of thousands of five star reviews,
you're probably going to think
it's a great course and purchase it.
That is the whole idea of social proof.
An attacker wants to make you believe
that everybody else is doing something,
so that thing must be a good thing to get involved with.
Fourth, we have scarcity.
Scarcity refers to the psychological pressure people feel
when they believe a product, opportunity
or resource is limited or in short supply.
Scarcity is often used when you're trying
to get people to act quickly.
Much like urgency,
but the difference is with scarcity,
there's a limit number of something that draws people
to make decisions quickly.
Most often I see this tactic used in phishing campaigns
to say something like, "Sign up now, supplies are limited.
We only have five spots left.
You need to sign up right now
if you want to be part of this special offer."
So a victim gets this email
and it's totaled by some amazingly low offer
on a desirable product,
like being able to buy a new MacBook computer
for a thousand dollars instead of the normal $2,000,
but only for the first five people who buy one.
This is the kind of offers and messages
used when making scarcity as a motivational factor.
So if the victim falls for this trick,
they will click on the link in the email,
enter their information like their email address
or credit card details,
and now the attacker has been able
to breach their privacy and confidentiality.
Fifth, we have likability.
Most people wants to interact with people they like,
and social engineers realize this.
This is one of the reasons that social engineers
are some of the most friendly
and likable people you will ever meet.
If someone is an angry or crusty person,
they will repost their victims instead of drawing them
into their sphere of influence.
So social engineers work really hard
to be friendly, nice and attractive
to gain their victim's trust.
When I used to work with Red Teams,
it was a pretty common thing for them to have
at least one very attractive man
or a woman on the team.
I've personally seen having an attractive woman on the team,
is especially effective in gaining the intention
of the vast majority of men who work in IT.
So the way this works is that,
the attractive woman would talk
to their victims about flirting with them
or ask them questions about their work,
and these guys will usually open right up
about the things that they're working on
in their organization.
When it comes to likability,
this can take many forms including sexual attraction,
pretending to be a victim's friend
or chatting with them about some common interest.
For example, one of my friends used to work
as a social engineer penetration tester,
and he commonly would start up a conversation
with the organization's employees based
on the sports teams that that person like.
So if my friend saw some
Buffalo Bills paraphernalia on the desk,
they would strike up a conversation
about the last week's game with their intended victim.
Or if the person isn't into sports,
the social engineer might strike up a conversation
about a specific band, the latest action movie,
or even their favorite television show.
It really doesn't matter what the topic is,
but using it to gain the trust
and to be seen as likable is really what's important here.
Six, we have fear.
Fear can be a great motivator when it's used properly.
In fact, ransomware and many virus scams
are designed to play off the victim's fear, right?
These types of attacks generally are focused on,
"If you don't do what I tell you,
then this bad thing is going to happen to you."
For example, ransomware might encrypt your files
and then demand a payment or a fine of $200
to decrypt files to reclaim your excess.
Or the attacker could use impersonation to pretend
that they're from the Federal Bureau of Investigation,
and if you don't call them or pay the fine right now,
then they're going to come to your home
and arrest you for some kind of fictitious crime.
And this particular fear-based scam.
The attacker is using two motivational factors together,
both fear and authority, since they're pretending
to be a government agent from the FBI.
Here you can see that sometimes,
we can overlap these motivations together
to create an even more effective
social engineering campaign.
So remember, social engineers use motivational triggers
to convince an unsuspecting user to perform some kind
of malicious action on behalf of the attack.
Social engineers use
six main types of motivational triggers,
including authority, urgency,
social proof, scarcity, likability, and fear.
Authority is perceived power or position
that commands obedience or respect from others.
Urgency involves creating a sense of immediacy
or a time sensitive pressure
to persuade someone to take action.
Social proof is a tendency for individuals
to look to others' actions or beliefs
as a guide for their own behavior.
Scarcity emphasizes limited availability
or rarity to drop off demand
or to convince someone to take some type of quick action.
Likability is an attribute of being pleasant or agreeable
so that someone wants to respond better
to the attacker's attempts at persuasion.
And lastly, fear capitalizes
on individual's anxieties or concerns
to compel them to act in a specific way.
These motivational factors can be used by themselves,
or the attacker may combine
multiple motivational factors together
to create a even more effective social engineering campaign.