1 00:00:00,000 --> 00:00:00,833 In this lesson, 2 00:00:00,833 --> 00:00:03,030 we'll be focused on the motivational triggers 3 00:00:03,030 --> 00:00:05,310 used by social engineers. 4 00:00:05,310 --> 00:00:07,080 The backbone of social engineering lies 5 00:00:07,080 --> 00:00:09,120 in the ability of an attacker to trigger a user 6 00:00:09,120 --> 00:00:10,740 into doing something for them. 7 00:00:10,740 --> 00:00:13,050 So, how do social engineers get a user 8 00:00:13,050 --> 00:00:14,460 to fall for their attacks? 9 00:00:14,460 --> 00:00:17,430 Well, that all comes down to the motivational triggers 10 00:00:17,430 --> 00:00:19,320 used by social engineer to convincing 11 00:00:19,320 --> 00:00:21,750 unsuspecting user to perform some malicious action 12 00:00:21,750 --> 00:00:24,270 on behalf of an attack. 13 00:00:24,270 --> 00:00:27,060 Now, there are six main types of motivational triggers 14 00:00:27,060 --> 00:00:31,290 that social engineers use, including authority, urgency, 15 00:00:31,290 --> 00:00:35,283 social proof, scarcity, likability and fear. 16 00:00:36,120 --> 00:00:38,280 First, we have authority. 17 00:00:38,280 --> 00:00:40,080 Most people are willing to comply 18 00:00:40,080 --> 00:00:42,060 and do whatever you tell them to do 19 00:00:42,060 --> 00:00:43,530 if they believe it comes from somebody 20 00:00:43,530 --> 00:00:47,160 who is in a position of authority to make the requests. 21 00:00:47,160 --> 00:00:49,950 For example, if an attacker pretends that they're a manager 22 00:00:49,950 --> 00:00:53,070 or a high level executive within the organization, 23 00:00:53,070 --> 00:00:54,660 they will probably be able to convince 24 00:00:54,660 --> 00:00:56,970 some lower level employee to do 25 00:00:56,970 --> 00:00:59,250 whatever they need to complete their attack. 26 00:00:59,250 --> 00:01:02,520 Or our attacker can pretend to be an important client 27 00:01:02,520 --> 00:01:04,860 that will have pressure on wanting employees to do something 28 00:01:04,860 --> 00:01:07,380 because after all, they are the client 29 00:01:07,380 --> 00:01:08,880 and employee's job is to make sure 30 00:01:08,880 --> 00:01:11,490 that the client is happy, right? 31 00:01:11,490 --> 00:01:13,980 I have also seen social engineers try to pretend 32 00:01:13,980 --> 00:01:15,150 that they're an employee 33 00:01:15,150 --> 00:01:17,430 of a government agency like the IRS, 34 00:01:17,430 --> 00:01:18,840 and they will send you emails 35 00:01:18,840 --> 00:01:20,880 or leave voicemails claiming that, 36 00:01:20,880 --> 00:01:22,080 if you don't call them back 37 00:01:22,080 --> 00:01:24,270 and provide them a payment for a late fee 38 00:01:24,270 --> 00:01:27,240 associated with your tax return in the next 24 hours, 39 00:01:27,240 --> 00:01:31,140 then they're going to send agency your house and arrest you. 40 00:01:31,140 --> 00:01:33,630 In reality though, they're not part of the IRS 41 00:01:33,630 --> 00:01:34,740 or the government all, 42 00:01:34,740 --> 00:01:37,620 but instead they're assuming that governmental authority 43 00:01:37,620 --> 00:01:40,020 to try to scare you into providing sense of information 44 00:01:40,020 --> 00:01:41,700 like credit card number. 45 00:01:41,700 --> 00:01:44,970 This is just a scam that someone is attempting against you 46 00:01:44,970 --> 00:01:47,730 using authority as their motivational trigger. 47 00:01:47,730 --> 00:01:49,830 Second, we have urgency. 48 00:01:49,830 --> 00:01:51,870 Urgency refers to the compelling sense 49 00:01:51,870 --> 00:01:54,330 of immediacy or time sensitivity 50 00:01:54,330 --> 00:01:56,220 that drives individuals to act swiftly 51 00:01:56,220 --> 00:01:58,500 or prioritize certain actions. 52 00:01:58,500 --> 00:02:01,920 Now, these days, most of us are in a rush all of the time, 53 00:02:01,920 --> 00:02:03,480 and we just don't have the time to stop 54 00:02:03,480 --> 00:02:05,640 and analyze a given situation fully. 55 00:02:05,640 --> 00:02:09,030 By our very nature, most people want to be helpful. 56 00:02:09,030 --> 00:02:12,143 So if an attacker walks up to the front door 57 00:02:12,143 --> 00:02:13,380 of a office building with their hands full of boxes 58 00:02:13,380 --> 00:02:15,300 and claims they're late for a meeting, 59 00:02:15,300 --> 00:02:17,580 you may be tempted to swipe your access badge 60 00:02:17,580 --> 00:02:18,750 and let them into the building 61 00:02:18,750 --> 00:02:20,040 instead of making them put down 62 00:02:20,040 --> 00:02:21,720 all the boxes that they're carrying 63 00:02:21,720 --> 00:02:24,930 and swipe their own access badge, even if they have one. 64 00:02:24,930 --> 00:02:26,430 Most of us wouldn't even think twice 65 00:02:26,430 --> 00:02:27,390 about holding that door open. 66 00:02:27,390 --> 00:02:29,070 But using urgency, 67 00:02:29,070 --> 00:02:30,600 the social engineer can trick you 68 00:02:30,600 --> 00:02:31,830 into letting them to the building 69 00:02:31,830 --> 00:02:35,370 without providing their own identification badge. 70 00:02:35,370 --> 00:02:37,350 I've also seen social engineering techs 71 00:02:37,350 --> 00:02:38,640 that rely on urgency, 72 00:02:38,640 --> 00:02:41,220 when an attacker runs up to the person's front desk, 73 00:02:41,220 --> 00:02:44,010 hands them a USB thumb drive with a PowerPoint file on it 74 00:02:44,010 --> 00:02:46,170 and tells the employee they have a big presentation 75 00:02:46,170 --> 00:02:47,940 to deliver to the company's executives 76 00:02:47,940 --> 00:02:49,500 the next five minutes, 77 00:02:49,500 --> 00:02:50,850 but their printer is broken 78 00:02:50,850 --> 00:02:51,810 and they need the employee 79 00:02:51,810 --> 00:02:53,760 to print off two copies of the slides 80 00:02:53,760 --> 00:02:55,620 from that USB thumb drive. 81 00:02:55,620 --> 00:02:56,820 Well, if you take the device 82 00:02:56,820 --> 00:02:57,990 and connect it to your computer, 83 00:02:57,990 --> 00:02:59,940 the PowerPoint will probably open a print, 84 00:02:59,940 --> 00:03:02,250 But there may be some malware that is going 85 00:03:02,250 --> 00:03:03,810 to be installed in the background 86 00:03:03,810 --> 00:03:06,150 on that computer system out your knowledge. 87 00:03:06,150 --> 00:03:08,190 Since the attacker claimed they needed it 88 00:03:08,190 --> 00:03:10,260 right now for the presentation in five minutes, 89 00:03:10,260 --> 00:03:11,520 you have decided to skip 90 00:03:11,520 --> 00:03:13,440 all your organization's normal procedures 91 00:03:13,440 --> 00:03:15,450 for handling removable media, 92 00:03:15,450 --> 00:03:17,550 like scanning it for malware before connecting it 93 00:03:17,550 --> 00:03:19,800 to your network computer system. 94 00:03:19,800 --> 00:03:21,870 Or I have also seen attackers try 95 00:03:21,870 --> 00:03:24,000 calling up the technical support help desk 96 00:03:24,000 --> 00:03:25,710 and claim they're locked out of their account 97 00:03:25,710 --> 00:03:27,270 and need their password reset. 98 00:03:27,270 --> 00:03:29,400 The help desk technician may tell them that they need 99 00:03:29,400 --> 00:03:31,560 to come to the help desk in person 100 00:03:31,560 --> 00:03:33,330 to show their identification badge 101 00:03:33,330 --> 00:03:35,640 before their account's password can be reset, 102 00:03:35,640 --> 00:03:37,470 and the social engineer will use urgency 103 00:03:37,470 --> 00:03:39,840 to try and convince the tech support person 104 00:03:39,840 --> 00:03:42,330 that the password must be reset right now 105 00:03:42,330 --> 00:03:45,540 and can't wait since there's a big deadline approaching. 106 00:03:45,540 --> 00:03:48,510 Again, they're trying to drive home this sense of urgency 107 00:03:48,510 --> 00:03:50,730 to get the organization's employees to ignore 108 00:03:50,730 --> 00:03:53,700 or bypass their normal security procedures 109 00:03:53,700 --> 00:03:57,180 and then be able to gain access to their systems. 110 00:03:57,180 --> 00:03:59,700 Third, we have social proof. 111 00:03:59,700 --> 00:04:02,250 Social proof is a psychological phenomenon 112 00:04:02,250 --> 00:04:03,420 where individuals look 113 00:04:03,420 --> 00:04:05,670 to the behaviors and actions of others 114 00:04:05,670 --> 00:04:07,139 to determine their own decisions and actions 115 00:04:07,139 --> 00:04:09,240 in similar situations. 116 00:04:09,240 --> 00:04:12,000 Now, let's pretend that an attacker creates a website 117 00:04:12,000 --> 00:04:15,000 with fake and scammy information on it. 118 00:04:15,000 --> 00:04:17,250 They may attempt to use phishing, 119 00:04:17,250 --> 00:04:19,110 to get people to get to their website. 120 00:04:19,110 --> 00:04:21,060 Now, that might not be very effective 121 00:04:21,060 --> 00:04:24,150 because people might detect that it was a phishing campaign, 122 00:04:24,150 --> 00:04:27,210 but what if I got people to start spreading the word 123 00:04:27,210 --> 00:04:29,070 about my new website on Facebook 124 00:04:29,070 --> 00:04:31,530 or LinkedIn or Instagram or whatever, 125 00:04:31,530 --> 00:04:34,050 and now their friends start going to my website 126 00:04:34,050 --> 00:04:35,460 because they think it's legitimate 127 00:04:35,460 --> 00:04:39,000 since their online friends posted about my website. 128 00:04:39,000 --> 00:04:41,760 This is the idea of social proof. 129 00:04:41,760 --> 00:04:44,400 If I can get likes and shares on social media 130 00:04:44,400 --> 00:04:45,930 for my scamming website, 131 00:04:45,930 --> 00:04:48,270 people are going to be much more likely to click the link 132 00:04:48,270 --> 00:04:50,610 because it has a lot of likes, a lot of shares, 133 00:04:50,610 --> 00:04:53,610 and a lot of their friends who claim they've used the site. 134 00:04:53,610 --> 00:04:55,650 So if a social engineer can trick 135 00:04:55,650 --> 00:04:57,420 one friend into posting about it, 136 00:04:57,420 --> 00:04:59,820 that friend might influence a second friend 137 00:04:59,820 --> 00:05:02,400 and then a third and then a fourth and so on. 138 00:05:02,400 --> 00:05:06,120 Remember, people crave being part of a social group. 139 00:05:06,120 --> 00:05:07,920 People want to have social interaction, 140 00:05:07,920 --> 00:05:11,250 and most people have an inherent need to feel included. 141 00:05:11,250 --> 00:05:13,080 So by using social proof, 142 00:05:13,080 --> 00:05:15,540 we can use that desire against them. 143 00:05:15,540 --> 00:05:18,450 Online marketers use social proof all the time. 144 00:05:18,450 --> 00:05:21,120 After all, before you signed up for this class, 145 00:05:21,120 --> 00:05:23,040 I bet you took a look at the reviews 146 00:05:23,040 --> 00:05:25,170 to see what others said about this course. 147 00:05:25,170 --> 00:05:26,490 If you looked at the reviews, 148 00:05:26,490 --> 00:05:28,710 and there were zero people enrolled in this course, 149 00:05:28,710 --> 00:05:30,780 you might just assume it is a worthless course 150 00:05:30,780 --> 00:05:32,580 and you will find a different one. 151 00:05:32,580 --> 00:05:34,140 On the other hand, if you see that there's more 152 00:05:34,140 --> 00:05:36,510 than 100,000 people enrolled in this course 153 00:05:36,510 --> 00:05:39,090 and it has tens of thousands of five star reviews, 154 00:05:39,090 --> 00:05:40,440 you're probably going to think 155 00:05:40,440 --> 00:05:42,300 it's a great course and purchase it. 156 00:05:42,300 --> 00:05:44,550 That is the whole idea of social proof. 157 00:05:44,550 --> 00:05:46,350 An attacker wants to make you believe 158 00:05:46,350 --> 00:05:48,390 that everybody else is doing something, 159 00:05:48,390 --> 00:05:51,300 so that thing must be a good thing to get involved with. 160 00:05:51,300 --> 00:05:53,580 Fourth, we have scarcity. 161 00:05:53,580 --> 00:05:56,700 Scarcity refers to the psychological pressure people feel 162 00:05:56,700 --> 00:05:59,040 when they believe a product, opportunity 163 00:05:59,040 --> 00:06:01,710 or resource is limited or in short supply. 164 00:06:01,710 --> 00:06:03,990 Scarcity is often used when you're trying 165 00:06:03,990 --> 00:06:05,700 to get people to act quickly. 166 00:06:05,700 --> 00:06:06,720 Much like urgency, 167 00:06:06,720 --> 00:06:08,280 but the difference is with scarcity, 168 00:06:08,280 --> 00:06:10,290 there's a limit number of something that draws people 169 00:06:10,290 --> 00:06:12,030 to make decisions quickly. 170 00:06:12,030 --> 00:06:15,390 Most often I see this tactic used in phishing campaigns 171 00:06:15,390 --> 00:06:18,630 to say something like, "Sign up now, supplies are limited. 172 00:06:18,630 --> 00:06:20,100 We only have five spots left. 173 00:06:20,100 --> 00:06:21,240 You need to sign up right now 174 00:06:21,240 --> 00:06:24,330 if you want to be part of this special offer." 175 00:06:24,330 --> 00:06:25,680 So a victim gets this email 176 00:06:25,680 --> 00:06:28,200 and it's totaled by some amazingly low offer 177 00:06:28,200 --> 00:06:29,370 on a desirable product, 178 00:06:29,370 --> 00:06:31,950 like being able to buy a new MacBook computer 179 00:06:31,950 --> 00:06:34,800 for a thousand dollars instead of the normal $2,000, 180 00:06:34,800 --> 00:06:38,100 but only for the first five people who buy one. 181 00:06:38,100 --> 00:06:40,770 This is the kind of offers and messages 182 00:06:40,770 --> 00:06:43,920 used when making scarcity as a motivational factor. 183 00:06:43,920 --> 00:06:46,140 So if the victim falls for this trick, 184 00:06:46,140 --> 00:06:47,910 they will click on the link in the email, 185 00:06:47,910 --> 00:06:49,950 enter their information like their email address 186 00:06:49,950 --> 00:06:51,330 or credit card details, 187 00:06:51,330 --> 00:06:52,710 and now the attacker has been able 188 00:06:52,710 --> 00:06:55,740 to breach their privacy and confidentiality. 189 00:06:55,740 --> 00:06:58,050 Fifth, we have likability. 190 00:06:58,050 --> 00:07:00,570 Most people wants to interact with people they like, 191 00:07:00,570 --> 00:07:02,850 and social engineers realize this. 192 00:07:02,850 --> 00:07:05,280 This is one of the reasons that social engineers 193 00:07:05,280 --> 00:07:06,720 are some of the most friendly 194 00:07:06,720 --> 00:07:09,300 and likable people you will ever meet. 195 00:07:09,300 --> 00:07:12,060 If someone is an angry or crusty person, 196 00:07:12,060 --> 00:07:14,790 they will repost their victims instead of drawing them 197 00:07:14,790 --> 00:07:16,410 into their sphere of influence. 198 00:07:16,410 --> 00:07:18,600 So social engineers work really hard 199 00:07:18,600 --> 00:07:20,910 to be friendly, nice and attractive 200 00:07:20,910 --> 00:07:22,950 to gain their victim's trust. 201 00:07:22,950 --> 00:07:25,020 When I used to work with Red Teams, 202 00:07:25,020 --> 00:07:26,880 it was a pretty common thing for them to have 203 00:07:26,880 --> 00:07:29,166 at least one very attractive man 204 00:07:29,166 --> 00:07:31,020 or a woman on the team. 205 00:07:31,020 --> 00:07:33,960 I've personally seen having an attractive woman on the team, 206 00:07:33,960 --> 00:07:36,570 is especially effective in gaining the intention 207 00:07:36,570 --> 00:07:38,720 of the vast majority of men who work in IT. 208 00:07:39,570 --> 00:07:41,340 So the way this works is that, 209 00:07:41,340 --> 00:07:42,810 the attractive woman would talk 210 00:07:42,810 --> 00:07:44,520 to their victims about flirting with them 211 00:07:44,520 --> 00:07:46,350 or ask them questions about their work, 212 00:07:46,350 --> 00:07:48,360 and these guys will usually open right up 213 00:07:48,360 --> 00:07:49,770 about the things that they're working on 214 00:07:49,770 --> 00:07:51,450 in their organization. 215 00:07:51,450 --> 00:07:53,010 When it comes to likability, 216 00:07:53,010 --> 00:07:56,340 this can take many forms including sexual attraction, 217 00:07:56,340 --> 00:07:58,110 pretending to be a victim's friend 218 00:07:58,110 --> 00:08:01,530 or chatting with them about some common interest. 219 00:08:01,530 --> 00:08:03,810 For example, one of my friends used to work 220 00:08:03,810 --> 00:08:06,060 as a social engineer penetration tester, 221 00:08:06,060 --> 00:08:08,130 and he commonly would start up a conversation 222 00:08:08,130 --> 00:08:09,780 with the organization's employees based 223 00:08:09,780 --> 00:08:11,880 on the sports teams that that person like. 224 00:08:11,880 --> 00:08:13,080 So if my friend saw some 225 00:08:13,080 --> 00:08:15,330 Buffalo Bills paraphernalia on the desk, 226 00:08:15,330 --> 00:08:16,800 they would strike up a conversation 227 00:08:16,800 --> 00:08:20,370 about the last week's game with their intended victim. 228 00:08:20,370 --> 00:08:22,410 Or if the person isn't into sports, 229 00:08:22,410 --> 00:08:24,330 the social engineer might strike up a conversation 230 00:08:24,330 --> 00:08:27,030 about a specific band, the latest action movie, 231 00:08:27,030 --> 00:08:29,130 or even their favorite television show. 232 00:08:29,130 --> 00:08:31,170 It really doesn't matter what the topic is, 233 00:08:31,170 --> 00:08:33,030 but using it to gain the trust 234 00:08:33,030 --> 00:08:36,059 and to be seen as likable is really what's important here. 235 00:08:36,059 --> 00:08:38,400 Six, we have fear. 236 00:08:38,400 --> 00:08:41,100 Fear can be a great motivator when it's used properly. 237 00:08:41,100 --> 00:08:43,470 In fact, ransomware and many virus scams 238 00:08:43,470 --> 00:08:46,260 are designed to play off the victim's fear, right? 239 00:08:46,260 --> 00:08:48,817 These types of attacks generally are focused on, 240 00:08:48,817 --> 00:08:50,700 "If you don't do what I tell you, 241 00:08:50,700 --> 00:08:52,830 then this bad thing is going to happen to you." 242 00:08:52,830 --> 00:08:55,350 For example, ransomware might encrypt your files 243 00:08:55,350 --> 00:08:58,140 and then demand a payment or a fine of $200 244 00:08:58,140 --> 00:09:00,213 to decrypt files to reclaim your excess. 245 00:09:01,050 --> 00:09:03,780 Or the attacker could use impersonation to pretend 246 00:09:03,780 --> 00:09:06,390 that they're from the Federal Bureau of Investigation, 247 00:09:06,390 --> 00:09:08,700 and if you don't call them or pay the fine right now, 248 00:09:08,700 --> 00:09:10,470 then they're going to come to your home 249 00:09:10,470 --> 00:09:13,620 and arrest you for some kind of fictitious crime. 250 00:09:13,620 --> 00:09:15,690 And this particular fear-based scam. 251 00:09:15,690 --> 00:09:18,720 The attacker is using two motivational factors together, 252 00:09:18,720 --> 00:09:21,360 both fear and authority, since they're pretending 253 00:09:21,360 --> 00:09:24,150 to be a government agent from the FBI. 254 00:09:24,150 --> 00:09:26,190 Here you can see that sometimes, 255 00:09:26,190 --> 00:09:27,960 we can overlap these motivations together 256 00:09:27,960 --> 00:09:30,120 to create an even more effective 257 00:09:30,120 --> 00:09:31,520 social engineering campaign. 258 00:09:32,370 --> 00:09:36,870 So remember, social engineers use motivational triggers 259 00:09:36,870 --> 00:09:39,540 to convince an unsuspecting user to perform some kind 260 00:09:39,540 --> 00:09:41,970 of malicious action on behalf of the attack. 261 00:09:41,970 --> 00:09:43,020 Social engineers use 262 00:09:43,020 --> 00:09:44,910 six main types of motivational triggers, 263 00:09:44,910 --> 00:09:47,430 including authority, urgency, 264 00:09:47,430 --> 00:09:50,913 social proof, scarcity, likability, and fear. 265 00:09:51,750 --> 00:09:54,030 Authority is perceived power or position 266 00:09:54,030 --> 00:09:56,880 that commands obedience or respect from others. 267 00:09:56,880 --> 00:09:59,220 Urgency involves creating a sense of immediacy 268 00:09:59,220 --> 00:10:00,810 or a time sensitive pressure 269 00:10:00,810 --> 00:10:03,270 to persuade someone to take action. 270 00:10:03,270 --> 00:10:05,250 Social proof is a tendency for individuals 271 00:10:05,250 --> 00:10:07,770 to look to others' actions or beliefs 272 00:10:07,770 --> 00:10:10,140 as a guide for their own behavior. 273 00:10:10,140 --> 00:10:12,750 Scarcity emphasizes limited availability 274 00:10:12,750 --> 00:10:14,910 or rarity to drop off demand 275 00:10:14,910 --> 00:10:18,090 or to convince someone to take some type of quick action. 276 00:10:18,090 --> 00:10:21,810 Likability is an attribute of being pleasant or agreeable 277 00:10:21,810 --> 00:10:23,610 so that someone wants to respond better 278 00:10:23,610 --> 00:10:25,950 to the attacker's attempts at persuasion. 279 00:10:25,950 --> 00:10:28,020 And lastly, fear capitalizes 280 00:10:28,020 --> 00:10:30,300 on individual's anxieties or concerns 281 00:10:30,300 --> 00:10:33,030 to compel them to act in a specific way. 282 00:10:33,030 --> 00:10:36,390 These motivational factors can be used by themselves, 283 00:10:36,390 --> 00:10:37,860 or the attacker may combine 284 00:10:37,860 --> 00:10:39,930 multiple motivational factors together 285 00:10:39,930 --> 00:10:43,563 to create a even more effective social engineering campaign.