1
00:00:00,240 --> 00:00:02,070
In this demonstration,

2
00:00:02,070 --> 00:00:03,960
I'm going to show you how pretexting works

3
00:00:03,960 --> 00:00:06,750
as part of a larger social engineering campaign.

4
00:00:06,750 --> 00:00:08,460
Now, to help me with this short example,

5
00:00:08,460 --> 00:00:10,710
let's call up a company on my speaker phone here

6
00:00:10,710 --> 00:00:12,022
and see if we can trick the receptionist

7
00:00:12,022 --> 00:00:13,740
into giving me some details

8
00:00:13,740 --> 00:00:15,349
about the model of printers that they have,

9
00:00:15,349 --> 00:00:17,612
and maybe I can figure out a good attack vector

10
00:00:17,612 --> 00:00:20,299
to use against them as part of my pen test.

11
00:00:20,299 --> 00:00:21,480
(phone ringing)

12
00:00:21,480 --> 00:00:23,070
Hi, big old corporate headquarters.

13
00:00:23,070 --> 00:00:23,903
This is Sally.

14
00:00:23,903 --> 00:00:24,955
How may I help you?

15
00:00:24,955 --> 00:00:26,160
Yes, hello.

16
00:00:26,160 --> 00:00:28,422
My name is Bob Smith with Ink and Toner Express.

17
00:00:28,422 --> 00:00:31,200
Our offices received your order for toner last night,

18
00:00:31,200 --> 00:00:32,280
but we're having a slight delay

19
00:00:32,280 --> 00:00:33,685
in shipping your printer's toner cartridges.

20
00:00:33,685 --> 00:00:35,910
Now, I'm pretty sure I can get you an alternative

21
00:00:35,910 --> 00:00:37,020
shipped out this afternoon

22
00:00:37,020 --> 00:00:38,670
and to your offices by the morning,

23
00:00:38,670 --> 00:00:39,835
but I need to verify your printer model.

24
00:00:39,835 --> 00:00:42,240
I would hate to send you a couple of cases

25
00:00:42,240 --> 00:00:43,650
of the wrong toner, you know?

26
00:00:43,650 --> 00:00:45,037
Are you guys still using the HP LaserJet

27
00:00:45,037 --> 00:00:47,190
as your multifunction printer?

28
00:00:47,190 --> 00:00:50,340
Could you double check the model number for me?

29
00:00:50,340 --> 00:00:51,173
Let me check.

30
00:00:51,173 --> 00:00:52,290
Hold on one second, please.

31
00:00:53,460 --> 00:00:54,780
Alright, now while she's off

32
00:00:54,780 --> 00:00:57,240
looking for that, let's talk about this pretext

33
00:00:57,240 --> 00:00:58,080
for a second.

34
00:00:58,080 --> 00:01:00,325
I have no idea what kind of printer they're even using,

35
00:01:00,325 --> 00:01:02,880
but I bet she has no idea either.

36
00:01:02,880 --> 00:01:04,712
So if I just pick one of the big brands like Epson

37
00:01:04,712 --> 00:01:08,790
or HP or Lexmark, hopefully she's going to go check for me,

38
00:01:08,790 --> 00:01:09,690
and if I get it wrong,

39
00:01:09,690 --> 00:01:11,799
she's going to fill the details in for me.

40
00:01:11,799 --> 00:01:13,590
Mr. Smith, I just checked,

41
00:01:13,590 --> 00:01:17,874
and it says it's a Konica Minolta C368, not an HP.

42
00:01:17,874 --> 00:01:20,520
Oh, right, I see that now.

43
00:01:20,520 --> 00:01:23,010
I'm sorry, I had your order mixed up with somebody else's.

44
00:01:23,010 --> 00:01:24,510
They have the HPs over there.

45
00:01:24,510 --> 00:01:26,670
You've got those wonderful Konica Minoltas last year.

46
00:01:26,670 --> 00:01:27,600
I remember that.

47
00:01:27,600 --> 00:01:28,924
Let me double check my system a second here.

48
00:01:28,924 --> 00:01:31,590
Ah, yes, yes, yes, I see it now.

49
00:01:31,590 --> 00:01:34,590
The Konica Minolta Biz Hub C368.

50
00:01:34,590 --> 00:01:35,670
Perfect, perfect.

51
00:01:35,670 --> 00:01:37,860
I see your order was for two cases of black,

52
00:01:37,860 --> 00:01:40,140
one case of cyan, one case of magenta,

53
00:01:40,140 --> 00:01:41,492
and only half a case of yellow.

54
00:01:41,492 --> 00:01:44,824
Now, here is where I'm going to try to push my luck

55
00:01:44,824 --> 00:01:47,412
and get some additional details from her.

56
00:01:47,412 --> 00:01:49,890
So Sally, you know that normally,

57
00:01:49,890 --> 00:01:51,810
the printer sends us the request for auto shipment

58
00:01:51,810 --> 00:01:54,240
as it gets low in supplies, but unfortunately,

59
00:01:54,240 --> 00:01:55,860
I was surprised when Jimmy called us yesterday

60
00:01:55,860 --> 00:01:56,775
to tell us that you guys were running low.

61
00:01:56,775 --> 00:01:59,812
It seems our connection between your system and ours

62
00:01:59,812 --> 00:02:01,500
is not working quite right.

63
00:02:01,500 --> 00:02:03,600
I was wondering if you could do me a really big favor

64
00:02:03,600 --> 00:02:04,770
so we can get this fixed.

65
00:02:04,770 --> 00:02:06,570
I just need you to double check the IP address

66
00:02:06,570 --> 00:02:07,403
on the printer,

67
00:02:07,403 --> 00:02:09,210
and make sure that I have it right in our system.

68
00:02:09,210 --> 00:02:11,009
I would hate for the company to run out of supplies

69
00:02:11,009 --> 00:02:12,570
when you're up against a deadline.

70
00:02:12,570 --> 00:02:13,740
Do you think you have just a moment

71
00:02:13,740 --> 00:02:15,090
that you can help me out real quick?

72
00:02:15,090 --> 00:02:16,108
It'll just take a second.

73
00:02:16,108 --> 00:02:18,840
Yeah, I guess so.

74
00:02:18,840 --> 00:02:20,733
How do I check the IP address on a printer?

75
00:02:20,733 --> 00:02:22,650
Oh, it's really, really easy.

76
00:02:22,650 --> 00:02:24,510
All you have to do is go over to the printer,

77
00:02:24,510 --> 00:02:25,343
on the touch screen,

78
00:02:25,343 --> 00:02:27,390
press the eye in the upper right corner.

79
00:02:27,390 --> 00:02:28,260
When that comes up,

80
00:02:28,260 --> 00:02:29,935
just snap a picture with your cell phone,

81
00:02:29,935 --> 00:02:31,290
bring it back here,

82
00:02:31,290 --> 00:02:33,570
and you can read me the details of what I need.

83
00:02:33,570 --> 00:02:34,762
Do you think you could do that for me?

84
00:02:34,762 --> 00:02:36,840
Oh, sure, that seems easy enough.

85
00:02:36,840 --> 00:02:37,832
I'll be right back.

86
00:02:37,832 --> 00:02:39,712
Alright, so that's the basic idea

87
00:02:39,712 --> 00:02:41,640
of a pretexting call.

88
00:02:41,640 --> 00:02:43,470
I didn't know anything about the organization,

89
00:02:43,470 --> 00:02:46,225
but giving this receptionist some kind of likely facts,

90
00:02:46,225 --> 00:02:48,399
like the fact that she's running an HP system

91
00:02:48,399 --> 00:02:50,520
or a large printer in the copy room,

92
00:02:50,520 --> 00:02:52,770
which most businesses have, then I can trick her

93
00:02:52,770 --> 00:02:54,375
into giving me some kind of information.

94
00:02:54,375 --> 00:02:56,910
Now, if you've ever gotten one of those calls that says,

95
00:02:56,910 --> 00:02:58,470
hey, this is John from Microsoft,

96
00:02:58,470 --> 00:03:00,330
and your Windows machine has been reporting

97
00:03:00,330 --> 00:03:01,830
that's been infected with malware.

98
00:03:01,830 --> 00:03:03,120
I'm calling you to help clean it up.

99
00:03:03,120 --> 00:03:05,520
I just need you to do step one, two, and three.

100
00:03:05,520 --> 00:03:07,099
This is a pretexting call.

101
00:03:07,099 --> 00:03:09,711
In fact, this is one of the more common pretexts out there.

102
00:03:09,711 --> 00:03:11,820
The reason why I even used this example

103
00:03:11,820 --> 00:03:13,299
of a Windows machine calling out with malware

104
00:03:13,299 --> 00:03:15,240
is because I had the conversation

105
00:03:15,240 --> 00:03:16,980
with my mom earlier this week.

106
00:03:16,980 --> 00:03:19,350
She had gotten one of these calls a couple of days ago,

107
00:03:19,350 --> 00:03:20,760
and they were telling her that her computer

108
00:03:20,760 --> 00:03:22,170
was infected with malware

109
00:03:22,170 --> 00:03:24,330
and that her Windows machine was calling out.

110
00:03:24,330 --> 00:03:25,735
And so she started playing along with them

111
00:03:25,735 --> 00:03:28,020
for about 20 minutes, eating up their time,

112
00:03:28,020 --> 00:03:29,580
because she knew it was false.

113
00:03:29,580 --> 00:03:30,600
She knew it was a pretext,

114
00:03:30,600 --> 00:03:32,100
and they were trying to get to a scam

115
00:03:32,100 --> 00:03:33,540
and try to coerce her for money

116
00:03:33,540 --> 00:03:35,460
or to get remote control of her computer.

117
00:03:35,460 --> 00:03:36,498
Now, how would she know this?

118
00:03:36,498 --> 00:03:38,247
Because she's one of those people in the 10%

119
00:03:38,247 --> 00:03:41,070
that doesn't run Windows, she has an iMac.

120
00:03:41,070 --> 00:03:42,720
And so for her, it wasn't something

121
00:03:42,720 --> 00:03:43,680
that she was going to fall for,

122
00:03:43,680 --> 00:03:46,020
because she knew she didn't have a Windows machine.

123
00:03:46,020 --> 00:03:48,210
You want to make sure that you do good user training

124
00:03:48,210 --> 00:03:49,549
with your staff, so they understand

125
00:03:49,549 --> 00:03:52,110
never to give information out over the phone.

126
00:03:52,110 --> 00:03:53,475
Even information that seems innocent,

127
00:03:53,475 --> 00:03:55,111
like a model number for a printer

128
00:03:55,111 --> 00:03:56,970
or an IP address for a printer

129
00:03:56,970 --> 00:03:59,490
can be used as part of a further attack.

130
00:03:59,490 --> 00:04:00,685
And so we want to make sure we train our employees

131
00:04:00,685 --> 00:04:02,712
to not fall for pretext,

132
00:04:02,712 --> 00:04:05,040
and don't fill in the gaps for other people

133
00:04:05,040 --> 00:04:06,030
when they're calling you,

134
00:04:06,030 --> 00:04:07,470
or even if they're doing it in person.

135
00:04:07,470 --> 00:04:09,120
Because pretexting is a way

136
00:04:09,120 --> 00:04:10,770
that we give some amount of information

137
00:04:10,770 --> 00:04:13,299
that seems true so that you'll give us more information

138
00:04:13,299 --> 00:04:14,853
to fill in the gaps.