In this demonstration,
I'm going to show you how pretexting works
as part of a larger social engineering campaign.
Now, to help me with this short example,
let's call up a company on my speaker phone here
and see if we can trick the receptionist
into giving me some details
about the model of printers that they have,
and maybe I can figure out a good attack vector
to use against them as part of my pen test.
(phone ringing)
Hi, big old corporate headquarters.
This is Sally.
How may I help you?
Yes, hello.
My name is Bob Smith with Ink and Toner Express.
Our offices received your order for toner last night,
but we're having a slight delay
in shipping your printer's toner cartridges.
Now, I'm pretty sure I can get you an alternative
shipped out this afternoon
and to your offices by the morning,
but I need to verify your printer model.
I would hate to send you a couple of cases
of the wrong toner, you know?
Are you guys still using the HP LaserJet
as your multifunction printer?
Could you double check the model number for me?
Let me check.
Hold on one second, please.
Alright, now while she's off
looking for that, let's talk about this pretext
for a second.
I have no idea what kind of printer they're even using,
but I bet she has no idea either.
So if I just pick one of the big brands like Epson
or HP or Lexmark, hopefully she's going to go check for me,
and if I get it wrong,
she's going to fill the details in for me.
Mr. Smith, I just checked,
and it says it's a Konica Minolta C368, not an HP.
Oh, right, I see that now.
I'm sorry, I had your order mixed up with somebody else's.
They have the HPs over there.
You've got those wonderful Konica Minoltas last year.
I remember that.
Let me double check my system a second here.
Ah, yes, yes, yes, I see it now.
The Konica Minolta Biz Hub C368.
Perfect, perfect.
I see your order was for two cases of black,
one case of cyan, one case of magenta,
and only half a case of yellow.
Now, here is where I'm going to try to push my luck
and get some additional details from her.
So Sally, you know that normally,
the printer sends us the request for auto shipment
as it gets low in supplies, but unfortunately,
I was surprised when Jimmy called us yesterday
to tell us that you guys were running low.
It seems our connection between your system and ours
is not working quite right.
I was wondering if you could do me a really big favor
so we can get this fixed.
I just need you to double check the IP address
on the printer,
and make sure that I have it right in our system.
I would hate for the company to run out of supplies
when you're up against a deadline.
Do you think you have just a moment
that you can help me out real quick?
It'll just take a second.
Yeah, I guess so.
How do I check the IP address on a printer?
Oh, it's really, really easy.
All you have to do is go over to the printer,
on the touch screen,
press the eye in the upper right corner.
When that comes up,
just snap a picture with your cell phone,
bring it back here,
and you can read me the details of what I need.
Do you think you could do that for me?
Oh, sure, that seems easy enough.
I'll be right back.
Alright, so that's the basic idea
of a pretexting call.
I didn't know anything about the organization,
but giving this receptionist some kind of likely facts,
like the fact that she's running an HP system
or a large printer in the copy room,
which most businesses have, then I can trick her
into giving me some kind of information.
Now, if you've ever gotten one of those calls that says,
hey, this is John from Microsoft,
and your Windows machine has been reporting
that's been infected with malware.
I'm calling you to help clean it up.
I just need you to do step one, two, and three.
This is a pretexting call.
In fact, this is one of the more common pretexts out there.
The reason why I even used this example
of a Windows machine calling out with malware
is because I had the conversation
with my mom earlier this week.
She had gotten one of these calls a couple of days ago,
and they were telling her that her computer
was infected with malware
and that her Windows machine was calling out.
And so she started playing along with them
for about 20 minutes, eating up their time,
because she knew it was false.
She knew it was a pretext,
and they were trying to get to a scam
and try to coerce her for money
or to get remote control of her computer.
Now, how would she know this?
Because she's one of those people in the 10%
that doesn't run Windows, she has an iMac.
And so for her, it wasn't something
that she was going to fall for,
because she knew she didn't have a Windows machine.
You want to make sure that you do good user training
with your staff, so they understand
never to give information out over the phone.
Even information that seems innocent,
like a model number for a printer
or an IP address for a printer
can be used as part of a further attack.
And so we want to make sure we train our employees
to not fall for pretext,
and don't fill in the gaps for other people
when they're calling you,
or even if they're doing it in person.
Because pretexting is a way
that we give some amount of information
that seems true so that you'll give us more information
to fill in the gaps.