This is dedicated to all the hackers and the crackers, to the hackers and the crackers.
I see in binary, I speak source code, step on my toes, I'll post a million jpegs of you
and a fag pwned.
In your digital stance, getting firewalled ho, cause I'm riding the net in my six-fold.
I was a dick with my 56, now with my cable I'm able to get that stable.
On the out, my name is Ace and I'm a Leo. On the digital highway, my name is Neo and I'm a hero.
In a flash, I'll screw you on burning Dreamcast. You need some ISO? Let me through my hard drive rifle.
Our exchange you could never stifle. In a digital hug, you just caught the love bug.
I bootlegged your CD, I caused a fight between Un and Jay-Z.
Your CG, it's all gonna be free, whether we take it by force or we take it nicely.
You feel that rattling your bones? When I tell you we just hacked out Jones.
And NASDAQ leaves you flat on your back, cause I am he who loves to hack and crack.
Cause I am he who loves to hack and crack.
This is dedicated to the hackers and the crudents.
Serial codes, source codes, ISOs, RANs, SIFs, SIFs.
This is dedicated to the hackers and the crack.
We are finally back with an episode of Binary Revolution Radio with you this week for episode 194.
I am StankDog.
And you are listening to this on May 15th, 2007.
Once again, episode 194.
And to jump right into the show, first thing this week, I'll go ahead and introduce my co-host for this week.
Some of you may recognize the voice because he actually hosted the show last week.
Face Man is on the show with us this week.
Welcome to you.
Hello, StankDog and everyone else.
And we have a topic that we're going to cover later today that I've been kind of putting off and putting off and putting off for a long time on the show
because it's just one of those topics that could go on and on forever.
Kind of like me, when I start talking, I can go on and on forever.
But we think we've got it nailed down to some bullet points, some topics that we can cover on the show and still do it justice.
So, I guess let's go ahead and do some housekeeping before we get into too much of that and then reveal the topic later.
I have a couple things to talk about in housekeeping.
One of them, let's see, we have some updates to Bell's Mind that I wanted to mention on the air.
Some people who use Bell's Mind regularly, of course, bellsmind.net.
If you're using it regularly, you might have noticed that there's a few new features that have popped up here and there.
And if not, you might want to go check them out.
Go over to the NPA NXX lookup.
You'll see a few extra tabs on there.
Those of you who may have some accounts on Bell's Mind, if you log in, you might find some other cool things.
And a big, mysterious circle at the bottom.
Anyway, I'm not going to go into too much details.
Pretty much the new features there are self-explanatory.
But there's also some features on there that may help in some future projects.
So, we'll talk about that more when the time comes.
And the only other thing I wanted to mention is we spent some time recently creating a new group in the forums.
Actually, I got two.
I have one thing that's not on the notes here, Faceman.
I'm going to throw in here.
One thing, though, is we added a new group in the forums called Agents of the Revolution,
which is a new group that we've given some more access, some more benefits and features in the forums.
And we've moved people in there who are long-term, and not even necessarily long-term,
but people who are productive members of the forums who post on-topic intelligent posts in the forum and articles
and replies to people that are helpful, that get what it's all about,
that people that stay out of the drama, stay out of the off-topic forums.
People are actually producing content, I guess, is the way what it always comes down to.
People are actually trying to help and who get what it's all about.
So, those people, we're moving them over time, and this is an ongoing thing.
We're moving them into a new group called Agents of the Revolution.
And what that is is we have a special forum where the only people in that group have access
where we can talk about things that maybe we don't want the Google Spider to pick up yet,
so we put it in kind of a special forum that only we have access to.
We talk about a few things that we may not want the forums at large to know about yet.
Maybe we want to discuss maybe even things related to the forums,
as well as just some information that we might not necessarily want to share with everyone
because, well, when you post certain things out there,
they have a tendency to get abused and destroyed quickly,
so we want to try to keep that within a certain circle of trust, if you will.
So, how do you get to become an agent of the revolution?
Well, like I said earlier, post on topic and intelligently, you know,
act like you've got some sense in the forums, which seems to be pretty rare these days.
We won't go into dropping names or anything, but basically don't post or stay on topic
and be helpful to the community and you will certainly, most certainly, be added to the group.
Unless you absolutely don't want to, which is, you know, I guess entirely possible.
Another thing, too, and I kind of mentioned I might want to add this in there, Faceman,
is that, I don't know, the forums the last couple of weeks, at least for me personally,
as many of the listeners may know, I don't, unfortunately, have as much time as I used to
to go in and read everything in the forums.
But there are certain, if something catches my eye, it means it's pretty doggone extreme
because I can't see everything that's going on.
So when I see something that's annoying the hell out of me in the forums,
that means it's probably annoying the hell out of a lot of other people.
So I just wanted to make note that we have acknowledged that we have some problem children
in the forums, for lack of a better word.
And once again, we won't drop any names, but people who do nothing but post the just
inane topics and some of which don't make sense, some of which they simply are too lazy
to Google and Faceman.
You know what I'm talking about here, right?
Yeah, I know what you're talking about.
And it wouldn't be that hard to figure out who you're talking about either.
Yeah, exactly.
We don't have to throw any names out there because I think people know.
And I just want to acknowledge that we have, we acknowledge this situation.
And it's gotten a little annoying even for me.
So we're working on a solution to that, trying to come up with the best way to handle those people.
You know, one of the things about BinRev and part of the revolution is we want to be open.
And we want people to feel welcome.
We want people to come in and be able to learn and be able to interact with people and learn
from people and learn from each other.
But you've got to try.
And there's been a lot of people in the past that have come in and started off, quite frankly,
as not the best members, not the best hackers or anything.
But over time did actually learn.
They may have started off and made some mistakes or, I don't know, some noob comments, for lack of a better word.
I hate throwing that around, but people who have come in and didn't know any better.
But because we were accessible and because we're friendly and we're helpful and because we have the new BHQ,
they did actually learn and they did improve.
I think right now we're just on a little bit of a bad streak where people just don't seem to care to listen
or learn or want to improve themselves anymore.
So at some point you have to, and I hate saying this, but you just have to cut your losses with certain people
and move on because they're detracting from everyone else's experience of the forums.
So there's been some discussion of that in the moderating team and even the Agents of the Revolution.
We've talked about that, of how we're going to handle it.
And sometimes the band hammer swings low.
That's all I can say.
So if you're in that category, you might want to step it up real fast.
And if you're worried that you might be in that category, you probably want to step it up as well.
So just throw that out there.
I don't know, face me on my being a little harsh there.
I'm trying to be polite.
I don't know if it's coming across that way.
No, I think it's about time.
Yeah, I mean, we try to be...
You know, it's hard.
You want to be...
I'm getting it from both ends because...
I'm just going to call them klubies.
I mean, the klubies, the klubies, the clueless newbies that come in are annoying on one hand.
And I'm getting attitude and stuff from them.
But also, on the opposite hand, I'm getting attitude and anger from the other members of the forum who are pissed off because of all the drama and all the stupidity that's going on.
And it's easy to say, just ignore it and read the rest of the forums, but it's just there's too many of them right now.
So we're probably going to be doing a little house cleaning.
I wonder if it has anything to do with the fact that summer is just starting.
You know, I honestly think you're right because we went through this a little bit last year about this time.
And I think it really is some summer stuff.
I, you know, I don't want to say that all people of a certain age or anything, but certainly it seems like a higher percentage come in the summer.
So take that statistic for whatever it's worth.
We'll leave it at that.
Well, not everybody can be as old as you.
Yeah, well, not many people live to be as old as I am.
I'm not that old.
Jeez, you make me sound like a complete dinosaur.
Just because I remember punch cards doesn't mean I'm obsolete yet.
Doesn't mean I still use punch cards.
Although I could.
Anyway, I guess that would be, do you have anything you want to talk about in housekeeping?
No, I'm good.
I think the only, we, we, we did put up episode 193 on the, on the podcast and everything, right?
So we're good there.
Yep.
All right.
So why don't we take some email?
And when I say some email, I guess I should have said one email because we only have one email to talk about this week.
And Faceman, this may be for you.
I'm not sure.
Let me just read it and we'll figure it out.
This email comes from Fireworm.
Fireworm, W-Y-R-M, as in the dragon.
On your last show, you guys talked about the guy who hacked the New York Times and made over 3,000 searches.
Well, okay.
He says NYT.
I assume that's New York Times.
And made over 3,000 searches.
His name was Adrian Lamo.
I just thought I'd let you know since you guys couldn't remember.
Anyway, thanks for the show.
I try to listen as much as I can.
Keep it up.
So thank you, Fireworm, for the email.
And I'm going to kick it right over to you, Faceman.
Did you guys talk about New York Times at all or somebody searching anything 3,000?
Did that...
I have no idea what he's talking about.
Well, I sure as hell don't.
Yeah, I'm wondering if he was listening to another show.
Okay, to apply some social engineering here, which is what our main topic is going to be, it's too detailed for him to have made that up.
He heard somebody say something about searching over 3,000 times.
So he heard it somewhere.
But you know what?
Maybe...
Well, he even says on your last show.
I was going to say, maybe he's listening to an old episode from the archive or something.
But he says on the last show, maybe one of the other guys threw it out there or something.
I don't know.
But I'm sure Adrian Lamo's not the only person who hacked the New York Times.
But he was one of the most well-known, I guess.
The homeless hacker, as he is commonly referred to.
And that's been quite a while ago.
That's been a few years ago.
You mentioned the homeless hacker on the Java episode.
Did I?
You did.
See?
I'm going to file that under early senility then, I guess.
I'm going senile in my old age.
I don't remember, but I don't think I've ever struggled to remember Adrian Lamo's name.
But I guess I did.
Well, there we go.
We have it straightened up.
Adrian Lamo searching 3,000 times.
I really do not remember the context.
But, Fireworm, thank you for calling in to correct us of that.
I appreciate the email.
Now, we have got a main topic that we want to make sure we do justice.
And as I said a second ago, it is social engineering.
Now, that is just a really, really, really big target, I guess, to try to cover everything.
And Faceman and I talked through this a little bit.
And we've come up with, I think, a good structured way to talk about it.
We're certainly not, and let me preface the whole thing, we're certainly not going to be able to cover everything.
There's no way we're going to be able to cover everything.
There's enough information on this topic to write multiple books on the topic.
So, don't, the other thing is there's no definition for this.
This is the other thing.
It's a very intangible term, to believe it or not.
Social engineering doesn't really have, it has, I guess, a definition.
But it's not like a set list of things that you can go down a list of bullet points.
Now, normally when we do topics on the show, it's very technical and we can take you step by step through some things
and explain exactly how a system works because it is sequential in nature.
It does have steps to it.
Social engineering is not like that.
It's very, just completely arbitrary, random.
It's different every time.
It's a shapeless void.
Yeah, it's a shapeless void.
That sounds very Star Trek-y.
It is a shapeless void of techniques, of different situations, goals, all kinds of things rolled into one.
And the part of being a good social engineer is being able to navigate through that shapeless void.
Now, see, you see how I took your shapeless void and kind of worked that all into the thing on the fly like that?
See?
Perfect example.
That is social engineering applied right there.
You have to be able to adapt and flow with whatever happens in front of you.
So, I guess let's start off a little bit.
Actually, let me say this.
It's the reason that I specifically wanted to do the show with Face Man.
I really wanted to do the show with you because Face Man had sent me some show notes of the topic of the idea.
And there was one line in those notes that just caught my attention that is something that I have –
Basically, my pet peeve about this subject is that certain people have this mindset that social engineering means lying to people on the phone.
I mean, really, there are a lot of people.
A lot of people.
A lot of really, I don't know, very well-known people who claim to be great social engineers.
I'm an expert social engineer for the record.
What's that?
I'm an expert social engineer for the record.
Of course you are.
Of course, that's a joke because, as we were saying before we started recording,
anybody who claims to be an expert social engineer is not an expert social engineer.
They're not.
I mean, you may think you are and you may want to be,
but most people that say that's because they have in their mind that social engineering means lying to somebody on the phone.
So, if you can call up the operator and lie to her and say,
oh, I'm technician number 61741232B, can you transfer me?
That's one – I mean, I guess you'd have to classify that as one part of social engineering.
You are manipulating the system.
You are using knowledge to circumvent a human system.
So, that is a small part.
But too many people believe that's it.
They believe that it's about knowing a certain buzzword to drop on an operator.
Oh, yeah, give me trunk, tandem, blah, blah, alpha, bravo, whatever the fuck.
You know, drop a certain word to somebody or know the right number to call or the right code to drop or something like that.
And that's social engineering.
Well, no, that's research.
That's researching and learning how a system works and then applying said research
and using some social engineering techniques to do it.
But social engineering to me – and Faceman, I don't know.
I'm going to drop this as a global statement and see what you think.
But social engineering to me is any – is altering, affecting, manipulating any interaction with any other person.
Not sure how you think – how you feel about that one.
But it's not just on the phone is what I'm trying to say.
Yeah.
There are multiple places and forms, and I think we're going to talk about that.
There are many, many different goals.
It doesn't necessarily mean you're lying to someone to get information or to trick them into doing something.
And there are many different techniques that can be applied that, once again, have nothing to do with lying,
that have to do with usually 99% of the time getting information or getting yourself in or out of a situation.
It may not have to do with information at all.
Now, I'm not sure if you're going to go with me on that tangent, but sometimes a lot of social engineering, for example, you can social – if I could speak – let me see if I can social engineer my way through this episode.
Social engineer yourself out of a speeding ticket, for example.
Yes.
You know, see what I'm saying?
You can get yourself into or out of a situation.
Social engineer yourself into the VIP area at the club.
Social engineer yourself and upgrade to first class on the airplane, something that I'm very common, very good with.
Things like that that are also part of social engineering to me.
Okay, well, let me throw out this possible definition.
Sure.
Anytime you are more knowledgeable of the conversation on purpose than the other person.
To a certain extent, I agree with that.
It's not always more knowledgeable, but you may know one thing that they don't.
Yes.
You may not be more knowledgeable in general, but if you know something that they don't know – and truthfully, that's not all of the time either.
Sometimes they can know everything.
You just use a little wordplay and a little trickery to make them still give up that information or do what you want them to do.
You know, one of the –
Well, even if you're going to trick someone, then you kind of pay attention to the conversation a little bit more and, in essence, no more.
Yeah, and that's one – actually, that's one good key point to say right now.
One of the most important things is paying attention.
Yeah.
One thing I like to say to people is that every word has meaning.
Every single word in a conversation has meaning.
And I know that sounds kind of strange or kind of silly, or even when you're writing, I choose the words that I write and that I say very carefully.
And maybe now that I'm revealing this on the air, people might actually hear me pause sometimes before I speak or hear me think or take that little hesitation before I say what's on my mind.
It's even easier and better when you're typing something up in the forums, how I word things in the forums.
There's a lot of subliminal – not subliminal messages, but there's a lot of subliminal things that are inferred by using a certain set of words and by the way you phrase things.
Let me give a simple example.
One simple example would be, oh, my boss is such an ass or something like that, as opposed to somebody saying, my boss is such a bitch.
Now, those two sentences are basically saying the same thing, but you can infer a little bit of extra information just by paying attention and listening to what they're inferring, what that subliminal message is behind there, what that unspoken pronoun that exists in that sentence.
And social engineering is picking up on those type of things and realizing that the first example had a male boss and the second example had a female boss.
In most circumstances, there's probably – we could go into a gray – yeah, we could go into a gray area and then fall through with that.
None of these rules are hard and fast.
Oh, that's probably a bad choice of words.
No, none of these rules are set in stone, we'll say.
But majority of the times, you can infer a lot of information like that.
I would agree.
I concur.
And we will continue.
And you know what?
And actually, you're being silly, but truthfully, right there, what you just said, you can infer two different things from those statements that you said.
I agree and I concur.
What kind of person says I concur?
If you ever hear somebody say I concur, that says volumes about that person.
You know, it says that they have a vocabulary, you know, as opposed to somebody who just says I agree.
That may not mean anything.
I say I agree all the time, but if I ever said – if I was in a certain scenario with certain people, I might choose to say I concur because it sends a different message.
It shows a different part of me.
It makes people think something differently when they hear me say that, and therefore, they will react and treat me different and speak to me differently because of that.
So choice of every word is important, even something as off the cuff as I agree.
So that was a good example.
And along with I concur or I agree, depending on the tone of voice that it was said with, it could also mean that professionally you have to agree, but you don't really want it to go with that particular way.
Yeah, there's a – you know, and we probably – let's – we're going to come back to some tips that are more along those lines towards, I think, the end of this topic.
So why don't we – I guess as we start to delve in here, the other thing I wanted to talk about up front is that a lot of people seem to think that they are these great social engineering experts, et cetera, et cetera, that I talked about before.
Actually, I'm going to – I'm not going to drop any – I'm not going to say any names, but I just got to tell you, I've got somebody – I've got people in mind, a couple of people that just bug the hell out of me.
I hate people that come up to me and they claim that they're a hacker and they're an expert at social engineering.
First of all, if you think you're an expert at social engineering, you're probably not, like I said earlier.
Secondly, using my social engineering skills and reading between the lines there, what you're really telling me is you're a hacker who doesn't know how to hack.
So you're going to fall under the social engineering.
You don't know anything technically, apparently, or you're not strong enough technically, so you're going to brag about your social engineering skills
because you have that mindset of lying on the phone, traditional, simplistic mentality, that that's all there is to social engineering.
And you think you can fit in by putting yourself in this niche.
Some people are experts at Java.
Some people are experts at penetration testing.
Some people are experts at stack smashing.
Whatever your expertise or area of interest is, you think that you're going to fill a little niche by saying that you're a social engineer.
Well, nobody specializes.
I mean, some people may be good at social engineering, but that doesn't make you a hacker necessarily that you can lie on the phone.
So it's kind of a pet peeve of mine, people that claim that they're social engineering experts.
However, somewhat related to that point, I want to make it very clear, and again, FaceTime, I don't know if you'll agree with me on this,
but social engineering is definitely something that some people have a gift.
Some people are good at it naturally.
You just have the gift of gab.
You can just talk and manipulate people just in the way you choose your language.
Maybe it's an experience thing.
Maybe it really is just an innate gift that some people have.
But that being said, I do believe, and FaceTime, whatever you think here,
I do believe that social engineering is something that can be taught and can be learned.
I think there are absolutely techniques that anybody listening right now can pick up on and become a better social engineer,
even by the end of this show.
Yes, I would agree with that as well.
It might help if you do have that gift of gab, so to speak, that you can be quick, off-the-cuff, impromptu, improvisation,
whatever, all these things that you want to throw, all these turns you want to throw around that mean the same thing.
If you're quick-witted and quick off your feet and can recover and catch anything that's thrown at you,
then you might be better at it.
But there are definitely techniques that anybody and everybody can learn,
and we're going to talk about some of them now actually,
that will make you accomplish things that you never really thought about or realized before through social engineering.
So, in that mindset, let's kind of move on now.
And, Facebook, while I'm going to get a drink here,
and I'm going to let you talk about some of the different forms of social engineering.
We've kind of alluded to them earlier, but different forms or mediums or, I don't know, places or types,
I'm not even sure how to label this.
So, why don't you talk about some of the different types of social engineering or forms of social engineering?
Yeah, I know what you mean about labeling these,
because when I was throwing together the talking points, I had no idea what to call them.
Exactly.
So, these are by no means terms that everyone should adopt as law or whatever.
We're going to start off with kind of social engineering over the phone or in person.
These both are types of attack generally used with impersonation of an employee or a customer
or anyone that should have access to the information,
whether it be a third-party repair technician or just somebody that comes in off the street.
That's generally what's used there.
The most commonly used form of social engineering is most likely the phone,
as it's the easiest way to do it.
You don't have to maybe get dressed up or go to the location of where this might be going on.
You know, you just call somebody up and there you are.
Whether it be the operator, operator on a special, dial a number for me.
Or call up your local high school and say,
this is a telco employee.
We need your PA number so we can access your PA.
We've had a server crash or something.
And get something there.
You know, if you're younger, like myself, that's an excellent way to do that
because they don't have to see your face.
You could possibly use a voice changer if you have a high squeaky voice
like some of the 12-year-olds I know or younger people, I should say.
And so the phone is just an excellent way to do that.
There's no, you don't have to really worry about body language that much.
It's a much easier way to start off with.
And it's an excellent way to start with.
You can maybe start with some prank phone calls.
Which seems childish, but it really is the most efficient way
to kind of learn how to use some of these techniques.
And, of course, along with this is in person.
Well, actually, I'm sorry.
While we're still focusing on the phone part of it,
I think everything you said is correct,
and it's exactly what most people think of the phone,
impersonating somebody to gain some information,
which is all well and good.
But not even necessarily only prank calls, like trying to be funny,
but just calling anybody.
And this is one of the things that I really liked
and wished more people would have explored on Freak Factor,
was just calling anywhere.
And I know the joke about Walmart,
everybody trying to get on a Walmart intercom was what all the show was.
But, you know what, calling stores, calling other people,
calling whatever.
I mean, you don't have to call the bowling alley
and ask if they have 10-pound balls.
You can call and ask a lot of other things like, you know,
just any type of information.
Even if it's not something you care about or want,
the phone is a good place to practice.
Call people up and you don't even,
as a matter of fact, do it to yourself on purpose.
Call somebody with no goal.
Just make it up as you go along.
Impromptu, just adapt, just to kind of train yourself,
get yourself that ability to think on your feet.
Call them and just make up some topic off the cuff.
Ask if a certain person is there.
And what does that tell you?
If they say, no, they're not there.
Oh, they're not working today.
Oh, now you know this person works for that company,
so you've gotten a little bit of information.
Oh, what time do your deliveries come?
I need to know what time to drop this stuff off.
Or, you know, just any, it doesn't have to be a prank call
is what I'm trying to say.
It doesn't have to be humor.
Just call and practice social engineering with people.
Call asking questions and just learn information,
you know, just learn from them.
Yeah, I was just throwing prank phone calls out there
as a suggestion.
Oh, yeah, I know.
That's the way I kind of learned to do it,
and it seemed to work well for me.
So, yeah.
And then in person you were about to talk about.
Yes, I was, yes.
So, in person is pretty much the same way.
If you're younger, like myself, it's not the easiest way.
But you could say you're part of the junior city safety inspectors
or something, and, you know, you just come up with something.
You come up with a story to make it plausible that you can be there,
whether you're younger or whether you're older, like Stank,
or just whatever would make it work.
You come up with a story on the spot or prepared or however,
so that it fits that you should be there or that the information should be given to you
or that they should even be talking to you.
Right, and, you know, this is why it's probably easier on the phone than in person
because you can disguise your voice easier.
No one sees you physically what you're looking at.
So in certain age brackets, certain age categories,
you're going to be much more successful on the phone than you might be in person.
It's going to be hard for you to come up with an excuse or a reason to say
why you're trying to check yourself into an old folks home or something like that.
And me, on the other hand, I might be able to get away with that.
But, face man, maybe not so much.
I'm very talented. I'm sure I could come up with a way.
Well, maybe you could come in and, you know, do a juggling and singing act
to entertain us old folks in our rocking chairs.
But, you know, there's ways to get in there.
But point being, you know, if you come up and you're claiming that you're the telephone system repair person
with 20 years of experience but you're only, you know, 15, 17, 18 years old,
people aren't going to really buy that as much.
So it's going to be tougher for you.
It's not impossible by any means, but it's going to be much,
it's going to be a lot harder for you.
So in person is very tough.
And also, another thing about in person,
and I'm going to mention this here instead of saving this for tips later because it fits,
is you've got to play the part.
You've got to be the part.
And, I don't know, just because I said it earlier, let's use that example.
If you do claim, if you're going into a,
and, of course, we're not condoning or saying you should do any of these.
These are examples for educational purposes only.
But if you were, let's steal a scene out of the movie Hackers
when serial killer goes in to repair the phone lines in the office.
If you are going in to do something like that, you know, look the part and dress the part.
You know, I know it's kind of funny, the movie Hackers in general,
but he's got his hard hat on, he's got his tool belt on.
That kind of helps sell it.
Now, that particular guy still would never get away with that, truthfully.
Not with those, that weird hairdo and the way of talking and that kind of thing.
But, you know, do that, take those extra steps to be prepared
and look the part and sound the part.
If you're going in to try to sneak into a, I don't know,
a convention filled with physicians and surgeons and stuff like that,
you better go in and sound intelligent.
You better go in and know some terminology.
Don't, you can't go in and, oh my gosh,
there's a gross picture of a liver on the wall and freak out.
That's not, it's going to blow your cover.
You know what I'm saying?
You have to be able to look, act, and speak the part.
And those are all things that you really need
when you're doing any kind of in-person social engineering.
Don't act surprised, use big words.
If it calls for it.
I have been in many cases where...
If it calls for it.
Yeah, in many cases where, believe it or not,
you want to dumb yourself down.
You don't want to sound intelligent.
You want to come across very simplistic.
Um, without getting too pervy,
you know, if you were talking,
believe it or not,
you might want information from a child.
Or, or a young person.
Nah, not, don't get any weird pervy
luring somebody in the car situation.
I mean, you know,
hey, what time does your mom get home from work?
Or, what company does your dad work for?
If you wanted to find that out
for some godforsaken reason,
you know, you're going to have to speak down
to whatever your target audience is.
Boy, that, I don't know,
that whole, that whole children's analogy
is really going to not sound very good on the air, is it?
We're going to leave it in anyway.
Well, it's...
Want some candy, little girl?
It's a viable means of getting information.
Correct, correct.
That's the point.
It's kind of hard to come up with examples off the cuff, but...
And, on the child point,
come down to the child's level.
Exactly.
You know, squat down, eye to eye.
You know, or you may be talking to someone
who's not, doesn't have the same education that you do
or doesn't have the experience that you do,
things like that.
So, yeah, whatever the audience calls for.
And that's true of writing, too,
but that's a whole other tangent.
Always write for your audience.
Always speak for your audience.
And you might also want to dumb yourself down
to get something explained to you.
Yeah, and actually, hmm,
I got a story here, if you want.
I mean...
Yeah, I used...
Well, yeah, I guess I can...
I'll just say it's a...
This is a generic technique or an idea is...
You know, one of the things that I had problems with
with some hosting companies recently
who shall remain nameless
is that I will contact them
and I like to think
I'm pretty technically competent,
at least to a certain extent.
And one thing that bothers me
more than anything
is people that lie to me.
You know, I know what I'm talking about,
so if I tell you
that this is the problem that's happening
and it's most likely
because of this, this, or this,
I can narrow it down
because I know what I'm talking about.
I was in a situation
with a recent hosting company
who we no longer use
and so one of the reasons
we left this hosting company
is because
a couple of times
I opened up tickets
and their responses were just
didn't make technical sense to me.
I'm like,
that doesn't really sound right.
So finally,
I decided to test them
and I basically
reported something
that I knew completely
what caused the problem.
I knew how it worked.
I knew every detail about it
and I played dumb.
I intentionally talked down
even though I could have,
even though I knew
what the situation was
and I knew I was talking
to people that were
supposedly technically competent,
I kind of pulled
the switcheroo on them
and put them on the spot
to see if they
could actually speak up
to my level.
So,
telling them,
here's what the problem is,
do you think it might be this,
and listening to them
lie to me
or try to talk.
If you're going to play the part,
kind of what we were saying earlier,
know what you're talking about,
know the buzzwords,
but realize that in some cases,
you're going to get called out
because of it.
Somebody out there
always is going to know
more than you
and if you,
there's a phrase my father
used to say to me
when I was younger,
he'd always say,
you can't bullshit a bullshitter.
So,
if somebody knows
what they're talking about
and you try to social engineer them,
you're going to hang yourself
out to dry,
you're going to get totally caught,
so you might get yourself
into an awkward situation.
I guess that's the moral
of the story.
Well,
along with the
you can't bullshit a bullshitter,
I kind of have a story
that's not technically my own,
but I'm going to take it
as my own.
Okay,
go for it.
Nobody will know the difference.
I can't tell it from first person
when it's really not.
Nobody knows the difference.
Go for it.
Okay,
so,
I went,
my mother made these cookies
and I went in
and got some
and,
you know,
it's in the cookie jar
that you're not supposed
to come into
and,
you know,
stay out of these cookies
face,
man.
So,
I get a cookie
and,
you know,
it's real good.
I come back
and I get another cookie
but I want a glass of milk
this time.
So,
I get a cookie
and a glass of milk.
I come back
the next night.
Lo and behold,
my sister's there
getting a cookie
when she's got
a glass of milk.
I come up to my sister
and I say,
cookies are good,
aren't they?
She says,
yes.
That's your second one,
isn't it?
Yes.
So,
that is
kind of a story.
So,
pulling some extra
information out of there.
Once they're caught,
you can kind of
manipulate that situation.
Yeah.
Now,
you know,
phone and in-person
are the two most,
what I would say
are the most successful
and where you're going
to get the most information
and the most results.
But there's other,
again,
forms,
for lack of a better word,
of social engineering
or,
I guess,
medium.
Yeah,
I can't come up
with a term for this,
but another way
to social engineer people,
another way
to approach people,
and that's via mail
or email.
Which is commonly
used for phishing.
Yep.
Actually,
that's pretty much
the heart of phishing,
isn't it?
I actually
didn't even think,
that word didn't even
pop into my head,
but it's absolutely phishing.
But,
it's not only for phishing.
All the things
we said earlier
could apply just as well.
If I were emailing,
say,
and again,
this is what I mentioned
earlier about in writing
as well.
Write to your audience.
Speak to your audience.
Write to whoever
you intend
to get information from.
If I'm writing to a,
for example,
a chief security officer
at a company,
I've got to stay brief
to the point.
I'm not going to get
into technical detail
because it's probably
going to confuse them.
As opposed to writing
an email to tech support
where I might explain
details about their server
and give them
an error message
of the problem
that I'm having
and things like that.
So,
first of all,
write towards your target.
I think that's one technique
to talk about in email.
And,
probably more along
the lines of phishing,
which is what you were
talking about earlier,
and I don't,
I think this is,
phishing is just
using social engineering
techniques for a
nefarious purpose,
unfortunately.
Yeah.
but that's not,
you can also write
phishing emails,
I guess,
to try to get
other information
out of people.
But you can also
phish through the phone
or in person,
so.
And that's,
that's true too,
that's true too.
For an example
of phishing
or social engineering
would be email
like,
oh,
I don't know,
you find somebody
on MySpace
or something like that
and you want to
get more information
from them,
you can email them
and say,
hey,
didn't you go
to this high school?
I think I remember
you from high school.
We had an English
class together.
What high school
did you go to again?
And you basically
set them up
for a familiar situation
that,
oh,
hey,
maybe this is
somebody I went
to school with.
Yes,
I went to
George Washington
High School
or whatever it
happens to be.
You phished information
out of them
via email.
Again,
by applying some
techniques and stuff
that's been
pretty successful
for me in the past
starting off
with a false
relationship.
But we'll come back
to that in some
of the tips section.
But you can phish
for information
that may or may not
be,
you don't always
have to phish
for credit cards
or banking account
or things like that.
You can phish
just for information.
Now,
that example,
I don't know why
I would care to know
where they're going
to high school
or went to high school.
Maybe I'm
a nut job stalker.
Maybe I'm
trying to find people.
It would develop
a level of trust.
Yeah,
it may just be
the first step
in something bigger
that I'm trying to get.
Maybe I'm trying
to become friends
with this person
or friends
of another friend
of this person
and I'm just trying
to step my way
into the whole
relationship.
So there could be
a lot of different
reasons for it.
I guess that will
leave up to the listener
whatever their reasons
and motivations are.
It's irrelevant,
honestly.
We're giving a lot
of these explanations
of why we would
do things,
but I think
we should focus
on the methods
and techniques
because the why
is going to be
on a case-by-case basis.
Yes.
So no more
little girl references.
So where do you
want to go from there?
Do you want to talk
about anything else
for email?
Do you want to talk
about some others?
Well, with mail,
just kind of a tip
on that is anything
notarized, people
tend to believe.
True, or printed
on letterhead.
Yeah.
And even silly
little things.
And this, again,
social engineering
is sometimes about
the little things.
Printing something
in color versus
in black and white,
believe it or not,
makes a difference
to people.
People get something
printed in black and white,
it's so easy,
so disposable,
but if you print
something in color,
put a color logo
at the top,
letterhead at the top,
it just looks
and feels different
to people.
Now, there are
different levels of that.
You can make it
look really good
by notarizing it
and things like that,
but little things.
But you want to
stick to the level
of what would fit
with the letter
you're writing.
Right.
Exactly.
There's actually
an interesting,
I don't know,
this kind of
popped in my mind.
Sometimes I'll get
spam,
not email spam,
but just junk mail.
And one of the things
that I see sometimes
in there is
it's total junk
wanting to sell me,
wanting me to get
a new credit card
or wanting me
to buy something
or whatever.
And when you open it,
which I do sometimes
because you can learn
a lot from them,
and one thing
that I've noticed
is a trend lately,
and I don't know
if you've seen this face,
ma'am,
or if any of the listeners
probably have,
is you open up
the letter that's inside,
and of course
it's nothing but sales.
Hey, you can get
this great interest rate.
But one thing
I've noticed more common
in the past year or two
is a little post-it note
stuck on there
that's using,
it's obviously
not handwritten,
but it's using
a handwriting font
to make it look like
it was written by hand
and posted on there
to make it feel
more personal.
And that is a brilliant
social engineering technique.
It's a brilliant tactic
that when you open it
and you unfold it
and you see,
oh, it's a form letter
they're trying to get me
to take another
freaking credit card,
blah, blah, blah.
But it's got
this personalized note.
Notice,
this offer is
specially for you
because of your
great credit rating.
Respond immediately.
And a post-it
on top of there.
Now, again,
it's transparent
to those of us
with some intelligence.
But sometimes
that's the difference maker
between people.
They're like,
wow,
I can get this card
because I have
a good credit rating.
Maybe I should go ahead
and do it now
while I've got the chance.
They definitely work.
These companies
do huge studies
on what works
with advertising
and there's so many
social engineering techniques
in advertising
that it would blow your mind.
So when you get junk mail,
even phishing and spam,
I know Savant and I
a lot of times
will trade phishing emails
back and forth,
do some analysis
and some study on them
because some of them
are doing interesting techniques
and things that are
a little bit different
that make you think,
oh,
that's clever
the way they did that.
That's interesting.
They approached it differently.
They didn't come out
and say,
oh,
congratulations,
you have won
the Nigerian lottery.
Please send me
your credit card information.
They're not always
that transparent.
Some of them
come across
and they're very,
very clever.
I mean,
I win the lottery
three or four times a day
if my email was true.
So they're not always
that simple.
I've won the British lottery
at least five times today.
Oh, yeah.
No,
you couldn't have won it
five times
because I've won it
five times today.
I guess we split it.
Anyway,
there's a lot of things
and even the physical snail mail
is even more to the point.
They spend a lot of money
sending that stuff out
so they do studies
and they know techniques
that work.
So you'll see a lot of things
in there
that you can actually
kind of steal the idea.
If you wanted to
send something out
and pretend it to be personal,
try that little post-it idea.
That's kind of a neat thing
that a lot of people
are going to fall for.
It's going to make it
a little bit different.
The way you word things
to people,
what they put in bold
is interesting.
I've had a couple
writing classes.
I've taken a technical
writing class
and I've taken
a business writing class
and they absolutely
teach you techniques
of how to write things
and how to use
proper use of white space,
quote unquote white space.
The way you put things
and lay things out
in the paper,
believe it or not.
You're not going to put
a bunch of narrative
and just a bunch of text
over and over
and over and over again
because people get bored
and throw it away immediately.
But you throw a paragraph
of information
and then put some
bold bullet points.
Bam, bam, bam.
Kind of breaks things up
and they get a summary,
they get a bullet.
Then you can put
another paragraph
of information,
then a graphic
with a seal of approval
on the right hand side.
You have great credit.
And then another paragraph
explaining what the offer is.
Kind of break that up
and scatter it around
on the page
in such a way
as to make it
visually appealing
and try to get people
to read past
that first paragraph.
So there are a lot
of social engineering techniques
that go into those.
As well as it just being
mail itself
seems almost more official
than, well,
it would seem more official
than an email.
Oh, absolutely.
Or, yeah.
Yeah, no,
that's a very good point.
Actually, you know,
there's one.
I can't think of the company.
I can't think of the company's name,
but there's Internet
Business Corporation.
I don't know.
It's some fake company.
I get snail mail from
that's basically a letter
saying that your domains
are expiring.
You need to pay this much
or you will have lost them
but we can recover them.
It's obviously fake BS.
Anybody who knows
and has registered sites
knows that's not the way
the system works.
Nobody's going to mail you
and say your site's already lost
but we can recover it.
No, it's not the way it works.
However,
because you get it
in physical mail,
it makes you go,
wait a minute.
Did I miss an email?
Did my spam filter catch something?
Is this real?
Oh my goodness.
Here's a check for $40.
Save it for me.
It's absolutely
what Faceman says.
It's absolutely different
getting something
in the mail
versus through email.
Well, along the domain
at expiration
when I first got
my domain
which will remain nameless
about a week
after I got it.
Come on.
We all know
it's ilovethecock.com
You don't have
to be embarrassed.
You don't have
to be embarrassed.
You can be open.
Oh, okay.
I'm sorry.
Dot org.
You got it.
You know,
the first sex domain.
Dot orgy.
Or dot org
if you listen to
Black Ratchet.
Anyway.
Anyways.
Dot org.
You know,
this is my first
real experiment
with domains.
I'd never
done anything
with them before
and I get this letter
in the mail
saying that
I owed 80 bucks
to protect my domain
which
and they have
the name of the company
that I used
to register it with
and
Well,
they're the ones
that sold it
to them
probably.
Especially if it was
GoDaddy.
Anyway.
Fucking bastards.
It wasn't GoDaddy.
Okay.
I still hate them.
Anyway,
go on.
Yeah.
Well,
I mean,
this is my first time.
It scared me
to make me think
that,
hey,
I have this 80 bucks
that I missed
something here.
You know,
who's trying to
cheat me out of my money?
You know,
these guys have
credit card information
for when
to pay for hosting
and
the original
registration
of the domain.
It's like,
hey,
are they going to
just take this?
Right,
right.
Well,
and,
you know,
and the same thing,
it's vice versa too.
Some things are better
sent via email
than snail mail.
So,
if you get,
you know,
for example,
believe it or not,
I know we all laugh
and joke at the lottery
and stuff like that,
but,
I don't know,
if you got
a pyramid scheme
letter in the
snail mail,
it might be more
transparent than it is
in email
because they can
phrase it in the email
to make it sound like
it's a new technology
or something that's
different
and you might fall
for it a little bit
easier than you would
if it were snail mailed.
You'd be like,
oh,
wait a minute,
this is that same
old Amway crap
or whatever
from,
you know,
years and years
and years,
these old pyramid schemes.
So,
again,
your choice
of what you're
trying to do
is the best medium
for it
and we probably
ought to pick up
a little bit
and go through these.
I think the only
other thing worth
mentioning was
maybe text messages
or,
I don't know,
would you throw
instant messages
in here as well
or?
Well,
I might throw
in instant messages
but mainly
text messaging
but mainly
as another
form of communication
for something
that you've
already started
if you were
to send
an email
to someone
on MySpace,
you know,
get their
cell phone number
and start text
messaging them
and just kind of
to build on
what you've done
already
but it could be
used as a
social engineering
of its own.
Right.
Well,
and you know,
the way some
text messaging
is set up,
you know,
you can send
a text message
to somebody's
phone directly
by sending it
to their phone
number at
Verizon Mail
or Verizon Wireless
dot whatever,
you know what I'm
talking about.
Yeah.
And if somebody
got a text message
saying your bill
is due,
please send back
your phone number,
a lot of people
won't pay attention
or realize because
they're not used
to such a thing
and I'm surprised
there's really not
a lot more
of that type
of phishing
going on
to be honest
with you.
I'm sure it's
happening but
I'm surprised
we haven't heard
some big,
big news about
something like
that by now
or if there has
been maybe I
just haven't
heard it myself.
If anybody
knows any good
stories of that
I would love
to hear them
because I'm
surprised that's
not something
that's much,
much more
prominent,
people getting
phished via
text messages
on their phones.
Yeah.
And when I put
text messaging on
here I have
never heard of
anyone being
social engineered
through a text
message or
any type of
phishing or
anything through
a text message
but I was
thinking of
the different
forms of
communication
because any
form of
communication can
be used for
social engineering.
Right, right.
And you know
sometimes it's
once again you
want one small
tidbit of
information or
something like
I don't know
you may want
to get back
a, oh my
gosh, trying to
think of an
example off the
cuff here.
You might email
somebody blindly
not knowing who
their name is.
Let's say you
found a phone
number, somebody
posted it in
the forums or
somebody on a
website somewhere
that they thought
was interesting or
they thought it
was somebody famous
or they thought it
was, I don't
know, any number
of things.
Sending it, you
know, calling it,
they might not
answer it, you
know, but if you
were to send a text
message to it
saying, hey, is
this Mary?
Well, if it's, you
know, make up an
arbitrary name that's
more than likely
wrong because you're
blindly guessing.
But they may
respond back going,
no, this is Sue or
this is whatever.
You have the wrong
number or something
like that.
But you've gotten
the response back,
you've gotten some
information you didn't
have before.
So, I mean, any type
of medium that we've
talked about, all these
different things, and I'm
sure there's some we've
forgotten too.
Instant messaging once
again, lots of things.
You can get a lot of
information through any
of these different
forums.
It's just a matter of
sitting back and
thinking, how could you,
what can you use about
these different mediums,
these different points of
attack or whatever?
Again, once again, this
is like a hard word to
define these things is
what would be the best
thing depending on what
your goal is?
Would it be better for
you to dress up and
show up at the store in
person?
Would it be better for
you to send an email or
snail mail or text message
or call, et cetera, et
cetera?
So, whatever.
It's kind of the right
tool for the job sort of
thing.
Absolutely.
And I think we should
probably burn through
some of these techniques
we've already talked
about before, but we're
kind of starting to run
long because I just keep
talking and can't shut
up.
So, I'm going to try to
speed up and talk about
some of these techniques.
And the first one is what
we started off talking
about at the top of the
show talking about, and
that is lying.
And I, as much as you,
you know, we have to be
honest and say that lying
is certainly a technique in
social engineering.
Yes, and most likely the
most common technique.
Probably.
Because it's just so easy.
Yeah, and it is.
And that's why so many
people, you know, think
that they're a great
social engineer because
they can call up and lie
to somebody.
And, yes, most prominent.
And, hell, I might even go
so far as to say it's the
most successful.
You know, but, it's
certainly not the end
all and be all.
And, even though it may
have the highest success
rate, it's still a small
overall proportion to
social engineering.
It's definitely easier to
lie on the phone than it
is face to face in real
life.
Definitely tougher to do
that because people can
look into your eyes and
you can feel.
I like to think, I'm not
going to say I'm an expert
social engineer, but I
like to think I'm pretty
good at reading people,
body language, and the
way they look at me, and
the way they talk,
averting your eyes.
A lot of people have
heard those old stories
about you tell if someone's
lying because they'll look
away from you, they can't
maintain eye contact, they
will move their fingers or
their hands, clench their
fists, things like that.
The giveaways, these poker
tells, if you will, you know,
and social engineering is
certainly a part of poker
as well, that will give you
away.
So, lying is definitely
something that is only
going to work better in
non-face-to-face
situations, mail, phone,
etc.
And if you watch
enough of the cop shows
on TV, they'll talk
about the direction your
eyes go when you look
away, tells, you know,
like if you look down at
the left, you're accessing
memory, and if you look up
and to the right or
something, you're accessing
your creative portion of
your brain.
And while the TV may not
get that right all the
time, that is true that
you can look at the way
your eye moves and see
that type of stuff.
Yeah, there have been
studies on that sort of
thing.
I'm not sure how much
validity I put into those,
but there's definitely
some studies that are put
into it that show some
sort of patterns.
But you know what, the
thing about lying, though,
is that, you know, I don't
want to harp on it too
much, but that becomes a
moral dilemma.
That becomes a moral issue
at this point, too.
Because, you know, one of
the things that I try to
teach, and I've got an
article that I've written
and haven't released yet,
called Social Engineering
While Maintaining Integrity.
And it's basically about
social engineering without
lying.
You don't have to lie.
You can get a lot of great
information by using a lot
of these other techniques
that are not necessarily
lying.
Now, I know Rax would give
me a hard time with this
and say that, yeah, but
you might as well be lying.
Or, yeah, but you're still
manipulating someone, you're
still alleging something
differently, you're still
avoiding something, but
you're not, it's a little
bit different to out and
out lie.
Maybe it's a technicality to
not directly lie to somebody,
but there's certainly
something to be said for
trying not to anyway.
You don't necessarily have
to sell your soul to be a
social engineer.
Well, as Rax would put it,
lying by omission.
I don't necessarily agree
that you do have to lie
even by omission, that
some of these different
things can easily be used
in social engineering,
whether it be to get
information or to just
make a conversation easier.
Yeah, well, and you know,
something can be said for,
believe it or not, it's a
social engineering technique
to tell the truth.
Sometimes, telling the truth
will get you the information
you need.
And it's up to you to
determine the best approach.
Do you need to tell the
truth?
Do you need to choose your
words carefully and
question, ask the right
questions?
Do you need to out and out
lie?
Do you need to read
between the lines and not
even directly ask anything?
There's all kinds of
different things that can
come up that you don't have
to out and out lie.
And that's, to me, a really
good social engineer who can
get information without
out and out lying.
That's harder and that's a
little bit more impressive.
To me, anyway.
A perfect example was I
social engineered my way
onto BinRev Radio.
You know, I didn't tell you.
I have no idea what I'm
talking about here, but I
made it on, didn't I?
Ah, but as I said, I'm a
good judge of character and I
can tell by the show notes
that you sent me that you
do know what you're talking
about, so there.
No, no, no, no, no.
Not pulling that one on me.
Well, and I think we kind of
talked about this earlier,
manipulation technique.
That's kind of, your word is
that it was the basis of
social engineering?
Mm-hmm.
It's not always used, but I
think that it is used, whether
you're lying or not, pretty
much all the time.
That there's few exceptions
that you're not manipulating
someone on some level.
Yeah, and I think that's, most
of the time, is the goal.
You're trying to manipulate the
person to give you information
in some way, shape, or form.
If otherwise, I guess it just
falls under the category of
conversation.
I mean, social engineering is
about getting information.
Sometimes it's getting
information you didn't even
know existed or didn't even
know that you wanted, but it's
about getting information or
finding information in a
conversation.
Mm-hmm.
So, manipulation is pretty
much a clear part of it, and
again, kind of goes, you know,
there's that gray area with
morals and stuff, and probably
the next thing that you wanted
to talk about was
impersonation, which that is, to
me, a form of lying.
You know, you're pretending to
be somebody that you're not.
Most definitely.
So, I mean, that's fine, and
it may be, maybe the only
technique or the only way to
get the information you want
is to call and say, hey, I'm
an AT&T field technician.
I need you to do a look-up on,
reverse look-up on this number
or something.
You know, I don't know.
I'm whatever, making up
something, but you may need to
impersonate.
Tell a technician who needs a
place to test call.
There you go.
That's what it is.
Anything.
I mean, it could be any number
of things, but, you know
what I mean, impersonating
somebody, that's, again, kind
of easy.
I think you said it was the
easiest.
Yeah, I said it was the
easiest, because, I mean,
anybody can impersonate
somebody.
You know?
Yep.
It's just, it's really easy
to do.
And using the techniques we
talked about earlier of
sounding the part, knowing
the part, knowing the
technology and the words,
and knowing the information,
there are levels of how well
you can do this and how good
you are at impersonation, but
generally, it's pretty
straightforward.
And the next thing you have
on here, as I kind of just
said a minute ago, and
that's just paying attention.
Yeah.
Paying attention.
And, again, and this is my
favorite.
I mean, this, using subtle
words and body language I
kind of referred to earlier,
these, to me, are those
little things that can
sometimes speak volumes
about people.
This is how I catch a lot
of people in things, and
how I can tell what makes
somebody uncomfortable, what
somebody may or may not
like talking about, the way
they choose their words,
like the example we have
earlier of choosing one
particular vocabulary word
over another one that tells
you a lot about the person.
So, subtle words, the body
language, just pay attention
to everything.
And see, in general, I would
recommend that all hackers
should do that as a survival
skill.
Always pay attention to what's
going on around you.
I know it sounds cliche and
corny, but you should always
be aware if there's any vans
with tinted windows around
you.
You should always be aware
of that.
You should always know, if
you're in a coffee shop or an
airport and you're using
wireless, you should always be
paying attention around you to
see if somebody is sniffing
your traffic, or whose traffic
you might be sniffing if you
were doing such a thing.
Not that we're condoning that.
Well, along with paying
attention, subtle words, and
body language goes looking at
how someone dresses.
You know, you might want to
check out their shoes, what
kind of socks they wear.
Those are the big things that
people generally miss when they
go to try something like
social engineering.
Or maybe how they carry their
hands is another big thing.
Well, and it also says a lot
about that person.
If you see somebody who's
dressed really well and
wearing expensive clothes and
alligator shoes and Rolex and
all that, you just already have
a one-up right then and there.
You've already got useful
information that this person
obviously has money.
So, you've already got one
thing that you know is not
going to be successful for
you.
There's no way you're going to
manipulate this man or this
woman, this conversation, by
using money in any way, shape,
or form.
You're not going to bribe
them.
You're not going to make them
worry about something costing
too much.
Hey, you have to do this now
or it's going to cost you
twice as much.
They don't care.
That technique will not work
with someone like that.
But for someone else, it may
be the motivating factor.
Oh, I can't afford to have
this.
Oh, is that your car out
there?
It might be being towed.
I'll watch your things while
you go check it.
You know, I hate that.
It's another bad example of
something dangerous that can
be done.
But they may realize, oh my
gosh, I can't afford to have
my car towed.
But I've got to go check it.
And they're gone and they
leave all their stuff there
with you.
Now, you know, that's a bad
example.
Especially, hell, it could be
Al-Qaeda and have a bomb and
set you up to be in a bad
situation.
So, point being, I think I was
self-explanatory.
Yeah, that's a very bad
example.
Just, you know.
I think it worked.
I think the point got
crossed.
A couple other things that I
wanted to mention in here too
is, and this is, again, this
is something that it takes a
lot of practice to do, but one
thing that I do a lot is
sometimes, and this usually
happens when you're in longer
conversations.
If you're in a short
conversation, you're trying to
get somebody to do something,
it's usually you doing the
talking, you call up, you're
trying to get something done,
and that's the end of it.
They're either going to do it
or not do it.
A lot of times, pulling
information out of people is a
long-term conversation, and or
argument, and or sometimes
you're, again, and if it goes
back to the practicing, I go
and practice with people, even
though I'm not on the phone
with somebody to get
information, sometimes I will
try to just for the heck of
it, just for the challenge.
If there's a girl on the
other line, chat her up.
See if you can get the
digits, talk to her, whatever
you've got to do.
That's all, all these kind of
techniques when you're
practicing.
Well, one of the things that
you should also throw into your
repertoire, I have a wonderful
French accent there, is the
ability to dodge a question
that's asked of you.
You're asking questions to
them all the time, but what
are you going to do?
You call and you say, oh, I'm
a field technician, can you do
a, pass me through to this
call?
They're going to come back to
you and say, what is your
field tech ID number?
You've got to be able to,
first of all, you should
expect that question, you know,
again, that's experience and
practice, but you've got to be
able to either answer that
question if you know one, or
you know the format and you
can make one up or something
like that, or you need to be
able to sidestep the question
and change the subject
somehow, instead of just
giving up and hanging up and
counting it as a loss.
Just because something's
been thrown back at you, you
haven't lost yet.
Sidestep it and change the
subject a little bit.
Oh, well, I don't have that
with me right now, can you
just go ahead and patch me
anyway?
It's probably not going to
work, but just sidestep it and
avoid answering it altogether.
Or, oh, you know what, it's
out in the truck right now,
can't you just look up my
name, Smith?
Just sidestep the question and
throw it back at them.
Make them do the work.
Act like you're cooperating,
but make them do the work.
The worst case scenario is,
yes, you have to hang up for
one reason or another.
If they really call you out
and just go, sir, I don't
believe you're an agent, can
you prove to me something?
You can always get another
call on the other line, an
emergency happens, someone's,
oh, I can't hear you anymore,
operator, I'll call you back,
something's wrong.
You can always, worst case
scenario, hang up and give up
and lose.
But make it, don't give up
right away.
Challenge yourself and see if
you can still get the
information by working with
that person.
And along with that, I would
say, I would bring up the
subjective follow-through.
That once you get the
information you need or you
realize that you're not going
to get it on that phone call,
don't just hang up or say,
you know, I have another
call right when they ask
this question.
You have to kind of lead up
to that so that it's not
blatantly obvious.
So, follow-through.
Probably also we can throw in
here along the same section is
to answer one question with
another question.
You don't always have to
sidestep their question and
redirect it with a different
topic or something like that.
sometimes you need to answer
their question with another
question.
Oh, I need your technician ID
number.
Which ID number do you need?
I have four different ones.
May or may not be true.
Again, this is based on
experience.
Throw the question back at
them.
And sometimes you will just
get them so off-kilter or so
confused that they won't
really know how to respond.
Well, which one?
The one that...
Okay, I'll just go ahead and
patch you through now.
You know, sometimes you'll just
get them so off-kilter that
you will still succeed with
what you're doing.
Ask them another question as
a follow-up or as a
distraction or as though you
don't understand the original
question.
Distract them and put them on
the defensive and make them
the one who has to take some
sort of action.
Push it back to them as much
as possible.
Now, we're really running
short here.
So, I think we can...
Let's talk about goals a
little bit.
What are some of the things
that you want to accomplish,
Faceman, when you're...
What do you...
Why are we social engineering?
Well, you could be looking
for specific information like
a password or login or work
hours or anything like that
that's very specific information.
Or you could be looking for
any information that you don't
know what you're looking for,
but you want a little bit of
more...
You want more information
before you go and do
something else or, you know,
anything that might be able
to help you guess someone's
password or anything like that.
You just want to maybe
footprint a business by calling
them up a couple of times
and just chatting up, coming up
with something on the spot.
You don't know what you're
looking for.
And actually, I would suggest
that as a way to kind of
practice social engineering is
just call up a business
and start talking to them.
Yeah, or, you know, and
actually you made a couple
good points there.
One, like, you may not know...
Most places nowadays put up
their standard password
policies or things like that
on...
You can easily figure them out.
But if you might not know
that, you might call and
pretend to be a user,
even though you're really
not.
Say, yeah, I'm having
problems logging in.
I can't remember what my
password is.
Can you...
Do you have a hint?
I mean, what is the
standard password?
I don't remember if I put
numbers in it or not.
I don't remember if I...
If it was 10 characters or
12...
You know, they may tell you,
well, sir, our standard
password has to be 10
characters and it may...
It has to include at least
one number.
You know, you've got a
little bit more information
than you had before.
So you're getting some
information that you may
then apply somehow for
whatever reason.
So that's definitely a good
point.
AOL.
Yeah, that one's not even
challenging these days.
If people still use AOL,
I can't...
I'm still amazed by that.
I can't believe they're
still in existence, but
that's a whole other topic
altogether.
Yeah, well, AOL is my
pet peeve.
Just...
Yeah.
Yeah, they've been...
They were...
Yeah, we won't go there.
A whole other topic,
a whole other show.
All right, well then,
you know, those goals
being said, I think it's
pretty clear.
We've made it clear over
the course of the show
that it's always about
getting some sort of
information.
Or one of the other
things you mentioned that
I wanted to follow up on
too was you might be
getting information that
you can use later to get
other information, to get
more information.
For example, you might
call up a company or a
radio station and say,
I'm interested in doing
some research or
interviewing someone
about your company or
about your new product
or doing a story.
who would I contact
for that?
What are your policies
for visiting?
What requirements do I
need to be able to
come onto your
company's property?
And they may say,
oh, well, you have to
be approved first.
Or, oh, no, you can
just show up and talk
to the secretary.
They'll tell you
information that can be
the second part of
your, I don't know,
your social engineering
odyssey, if you will.
And with that, you
don't even have to lie.
Do you know about that?
Absolutely.
See, so many of these
things that just, you
don't have to lie.
That always should be
your last resort, next
to last resort.
Your last resort would
be to hang up and run
like hell.
And or run like hell.
But, so, I think we
should, we've probably
got about ten minutes
or less, so, let's
talk about a few tips
here to kind of wrap
it up.
We've been using some
examples and talking
about some of these
tips throughout the
whole thing.
But there are a couple
tips here, and I
think, why don't you
go ahead and start off
with a couple here
that we alluded to
earlier, but go into
a little bit more
detail.
Well, I would think
that the absolute
most important tip,
well, depending on
what you're doing,
would be confidence.
You know, you've got
to have that, I belong
here, asshole.
Appearance.
You know, just kind
of get out of my way,
I'm in a hurry, or,
you know, I belong
here.
Yeah, especially in
the in-person, face-to-face,
I mean, you've got to
look the part, you've
got to feel like, if
you're going to go
into the, you know,
what was the example
I used earlier, going
into a doctor's convention
with all kinds of
medical, you better
look like you belong,
you better look like a
confident doctor, you
better be in there
looking like, not
looking like you're out
of place.
Got to have that
confidence, and
believe it or not,
it's easy to give an
in-person example, but
believe it or not,
people can hear it on
the phone.
People can hear when
you're bullshitting on
the phone.
You can even tell
sometimes in the tone
of your email.
So, try to avoid
things like, well, I
think it might be this,
or I heard it might be
that, or maybe it's
this.
That's not confident.
You know, be confident
with whatever you say.
Even if you are
unfortunately lying, be
confident in that lie,
damn it.
And if you do get
called out on it, you've
got to come up with a
story for why you may
have been wrong, or,
oh, I misspoke, you
know, I didn't mean to
say that.
Right, don't freak out.
Don't panic.
Never panic.
The worst that could
happen is they throw
you in jail for a
couple of years.
Right.
Always, even when the
situation does turn on
you and you are busted,
even then, don't panic
completely.
You know, if you feel
like your cover is blown
or you're not getting
what you needed, make up
some excuse to get
yourself out of there
in a tasteful manner
without drawing
attention.
Your phone, oh, my
phone is ringing, my
page is going off.
Oh, my gosh, I've got
a meeting in five
minutes, I'm late for
it, I'll come back and
we'll finish this
conversation later and
excuse yourself.
Try things like that
first.
Don't, you know, throw
everything up in the air
and go, run!
You know, don't bust
out the potato gun or
anything like that unless
you're really at your
complete, you're in a
dangerous situation,
obviously.
You can usually get out
of situations even if
they've gone bad.
Only when, you don't
want to, you want to try
to get out of there
before they call
security or anything
like that on you.
Or you could always
say, well, there was a
man around the corner,
he paid me $50 to come
do this.
Well, it's always an
option.
You never know.
Yep, whatever fits
the situation.
And then just point at
some guy randomly,
that guy did it!
Swarm!
And then run while
they're not looking.
Yeah.
No, you're pretty much
screwed if you're in
that deep, though.
So, another thing
that's a tip to use
is use the situation
that may be going on
if you've seen
what's the one
movie
they're going through
and they have
a delivery guy
Well, that only
narrows it down
to...
Thinkers.
Oh, okay.
Like I said, that
narrows it down to
every porn movie
ever made.
a pizza delivery guy?
Yeah, well, it's
Snickers and they
send in one guy
first and he's
trying to get
these pizzas up
the stairs and
the security guy
won't let them
through and then
you get Martin
Bishop coming
through and he
has balloons and
a cake and he
says, hey, buzz
me through.
You know, the
security guy's
worried about the
delivery guy that
doesn't have a
work order.
So, that's a
created situation
you might want to
use.
You know, you're
in a skyscraper
and you decide to
go roofing when
you start to see
security get mad
at somebody.
You know, if they
leave their post,
you walk by.
Well, and you
know, also right
in along with that
is sometimes you
can create that
situation yourself
like, you know,
one of the most
common ones and
people probably
don't consciously
realize or think
to plan this ahead.
It's usually
impromptu but,
oh my gosh, I've
got to go to the
bathroom.
I'm about to shit
myself or something.
You know, if you
really sell yourself
that you're about to
shit all over their
floor, they're going
to let you come in
and use the
bathroom.
And that's a
simplistic example
but, you know, it
can be something like
walk in with your
fake blood on your
hand or real blood
if you really got to
get in that bad and
hold your hand.
Oh my gosh, I got to
get in.
I think I hurt my
finger.
I broke my hand.
Something like that.
create a situation
where they're going
to be in, put them
in panic mode, the
person in question.
Put them in a
situation where they
have to make a
split second decision.
Don't give them time
to think things out
and go, wait a
minute, you don't
have a pass.
I can't let you in.
No, if you walk up
there and you've got
your blood gushing
out of your hand,
real or fake, or
you've got to go to
the bathroom, or
you're carrying a
bunch of stuff and
you're about to
drop it, they're
going to try to get
you in and avoid
the accident happening.
So, sometimes you
can create the
situation yourself.
Sometimes I
really want to help
other people.
Yeah, it's human
nature most of the
time.
Human nature has
gone downhill these
days, but you can
also create the
situation by going
in groups or
numbers, too.
Go with a large
number of people,
and believe it or
not, there is such
a thing as brute
force.
You can all rush
and one or two of
you might get
through, depending on
what your goal is.
I've been to
and I might date
myself here, but
I've been to
Grateful Dead
concerts where
halfway through the
concert, every
hippie in the
parking lot just
stormed the
concert arena and
started ripping
slats off the
fences until the
cops knocked a few
down and threw
tear glass, but
quite a few got up
and got into the
concert.
It's a brute
force attack.
How is that?
You never thought
you'd hear a
Grateful Dead
concert story on
BinRev Radio.
Bizarre.
But not only
that, sometimes it
doesn't have to be
brute force, sometimes
you can just have
four or five
friends all approach
within seconds or
minutes of each
other and get the
guard or whoever so
distracted that he's
like, okay, what did
you need?
What did you need?
Where were you at?
And you might just
be able to slip right
on by without him
even paying attention.
Too much on his
plate.
A couple other quick
things.
We're really running
low on time.
I'm glad we gave
ourselves plenty of
time to do all these
topics.
We're barely going to
get through it.
And again, I could
stretch this out to
three, four more
episodes, but a
couple quick things
if I may.
Oh, go ahead.
Okay.
One tip along with
using a situation is
I believe it was
Chessire Catalyst at
Hope 6 had said
that a hard hat, a
clipboard, and a
tool belt will get
you anywhere.
Just about.
And again,
confidence.
And confidence.
And throw that
confidence in there.
A couple other
quick things.
I'll jump through
these really fast
is, and this is my
favorite thing, is
ambiguity.
Such an important
word to social
engineering, and to
me, that is pivotal.
That's what separates
you and makes you
really able to handle
situations off the
cuff a lot easier.
Don't give anybody
direct answers to
anything.
Never answer anything
directly.
Kind of what I said
earlier.
Dodge the question.
Sidestep it.
Change the subject.
Answer their question
with another question.
Be vague.
Be ambiguous.
Somebody asks you a
direct question like,
are you really
John Smith?
It's a very
straightforward question.
You can lie and
say, yes, of course
I'm John Smith.
I'm absolutely
John Smith.
You can sit there and
lie to somebody.
Or, you can be
ambiguous, answer it
in such a way that
you don't, and
again, this is, you
know, I know Rax would
probably say that
this is still a lie,
but answer it in such
a way you choose your
words to say something
like, would I really
be here if I wasn't
John Smith?
So you're inferring the
answer.
Or rather, you're
letting them infer the
answer.
Who would come here and
try to get into this
room if they weren't
John Smith?
Does that make any
sense?
That's such a silly
question.
Make them feel silly or
stupid about themselves.
And you didn't answer
the question.
You didn't lie.
You let them infer
an answer.
That's on them.
If they're that weak
minded that they can't
figure that out or
that they're going to
be manipulated like
that, you've kind of
thrown it over to them
somewhat.
So ambiguity is such a
huge thing.
I can never over
emphasize that.
Never answer anything
directly.
Be as vague as
possible.
The more information
that you throw out
there that could
possibly be wrong is
more information that
they might be able to
call you out on.
Right.
Or they may be
able to come with
more follow-up
questions.
Oh, you are?
When were you born?
Fuck if I know when
he was born.
I don't care.
You know, you can get
yourself trapped.
So, a couple other,
here's kind of a funny
thing that I wanted to
point out and that's
simply the fact that
you can annoy somebody
to death.
There's nothing wrong.
It is an absolutely
valid technique to
just annoy people until
they give up.
So, I've been on, I've
called before and let's
see, how can I
carefully say this?
I've had a situation
before where I tried to
get information from
somebody and when they
asked for the password,
I did not know my
password.
I don't remember it.
Was it, is it in my
email?
Oh, can you email it to
me now?
Oh, I can't get into my
email.
Can you send it to my
other email?
Oh, I forgot that one's
discounted.
Oh, let me check this
email.
Can you send it again?
Oh, it's probably in my
spam folder.
Let me check that.
I'm sorry, what did you
say you sent it to?
Just annoy the hell out
of them until they
finally give up.
Believe it or not, a lot
of these times you're
talking to people that
are making minimum wage
or close to it.
They hate their jobs
anyway.
They're just not that
picky and they just
want to get off the
damn phone with you.
So, but it's perfectly
valid to have a
technique where you
want to annoy somebody
until they give up.
Just be stupid.
Complain a lot.
You can even cross a
line to threatening.
I don't like doing
that because it's, I
don't know, maybe it's
a moral thing, maybe it's
a personality thing.
I don't like being mean
to people if I can help
it.
But sometimes you might
have to raise your
voice and be abusive
and threaten to take
your business elsewhere,
threaten to cancel your
account.
I've never paid a late
fee on a credit card in
my life because as soon
as you elevate and
threaten to take your
business somewhere else
and take your card,
of course you have to
have a little bit of
something to back that
threat up, back that
threat up too, then
they're willing to do
whatever it takes to not
cross that line and not
lose a customer.
So you can threaten
people, complain, be
annoying, whatever the
scene calls for and
whatever's appropriate for
what you're trying to
accomplish.
Quoting of laws help too.
Even, you know, and
that's the other thing is
a lot of people don't
know them so that's
where you really can't
fake a lot of stuff and
people would never know
the difference or be
vague.
Try to relate to your
target.
A lot of times, and
this is surprisingly
effective, you don't
know how many times I
have gotten information
from companies by
pretending to be,
pretending to have some
relationship with the
person.
I call up and I hear
that the person on the
other line has a
southern accent.
Well, he's a fellow
good old boy.
He's another redneck.
I can kind of talk to
him in such a way as
to make him feel more
comfortable with me.
Make him feel, and
over the course, it
doesn't take long, a few
minutes.
You're going to be on
the phone a few minutes
with most calls.
By the time you get to a
certain stage, you can
joke with him, you can
laugh with him, you make
him feel like you've been
best friends for years,
and then when you're like,
yo man, how about you
hook me up with this?
So, same thing, whether
it's a southern thing, it
can be that you're both
from New York.
Hell, you can even make
it up.
Even if they don't
have an accent, ask them.
People always like to
be asked.
You know, you have a
little bit of an accent.
I can't quite tell where
that comes from.
Where are you from?
Oh, you're from Boston.
Really?
I grew up there too.
I went to college there.
Oh my gosh, small world.
Make a connection with
people.
Relate to your target
somehow.
And along with relating
to the target, I've never
had that fail.
Yeah, it always works if
you do it right.
And along with that too,
and I'm going really fast
here, it's to stroke the
ego, tell them how
great and helpful they
are too.
That's another thing is
when they're doing stuff
for you, go, oh, thank
you so much.
You don't know what a
lifesaver you've been.
I never would have been
able to log into this.
I couldn't remember my
password.
I don't have my email
with me.
If you give me that
number, you would be the
best thing in the world.
I would appreciate it so
much.
I will write an email to
your boss and tell them
how great you are.
People like to have their
ego stroked and told how
great they are.
And, in a certain way,
bribe them by telling
them you're going to send
email or you're going to
follow up.
And you know what?
Sometimes you might want
to be sincere about that
if they really do help
you.
So, we're really low on
time, so I'm going to
wrap it up right there,
I guess.
I think the moral of the
whole story, and I guess
moral is a good choice of
words, is everybody has
different morals and what
they're willing to do and
not willing to do in lines
that they are and are not
willing to cross.
I mean, do you have a
good closing sentence or
something to sum the
whole thing up?
I did, but I forgot it.
Crap.
No, I don't.
Okay, then.
Well, I guess we will
close up the main topic
and do our closing points
here.
Let's see.
What do we have?
Reminder to everybody,
the BIDREV meetings are
this Friday, except for
the BR-407.
We will not have our
Orlando BR-407 meeting
because I will be out of
town, out of the state,
out of the country.
So I will be completely
unreachable, and
coincidentally, so are all
of our other regulars.
They all happen to be out
of town at the same time,
so we will not have a BR-407.
But everyone else, your
BIDREV meetings are this
Friday.
Shouts from me, I'll just
give shout-outs to the
Agents of the Revolution,
everybody in the forums.
I would love for this group
to grow, for people to
participate more.
So by all means, we're
keeping an eye out for
people like that, and we'd
like to see everybody get
into this group, and
everybody to kind of step
up the game a little bit.
And what do you got for
shouts?
I want to give shouts to
Enigma, Zal91, Drake
Anubis, Black Ratchet, and
everybody in Pound
BIDREV.
Very cool.
And you know what?
I've got to take a second
here, too, because I've
been, because I'm not doing
the show, I've kind of
fallen really far behind
here, but I haven't
officially announced that
Enigma is actually an
official DDP member now,
and has been for probably
a month or two, and I
haven't had time to do a
show, let alone get him
on.
We've been actually trying
to do a show together,
and we kept putting it
off and putting it off,
but I should definitely
officially announce it
and welcome him to the
DDP officially.
He's working on several
projects for us, and he's
a great guy, so totally
second those shouts.
And everybody, the guys
that did the show last
week, definitely give
shouts out to all of
them.
And let's see, hosting
for Binary Evolution
Radio is provided by
caro.net, C-A-R-O.net,
carolina.net.
Carolina Networks, I
should say, if you need
dedicated hosting, they
have been very good to us
so far.
Our site of the week, this
week, is
savenetradio.org.
Go check it out.
What was it you said
earlier, internet radio?
It has 62 days left or
something.
62 days or something, 28,
I don't remember what it
was, days to live.
So, check out
savenetradio.org and see
what you can do to help.
Email us, feedback of any
kind, good, bad, ugly,
flames, or pictures of
faceman naked.
Oh, wait a minute, we
can't do that one because
I get in trouble.
Oh, minor.
Radio at
binrev.com.
And our closing music this
week is from The
Mr. Move.
God, this guy rocks so
hard.
This song is called
Ass Shaken.
So, I don't think I've
used this on the show
before, but guys, go buy
this album, themrmove.com.
That's T-H-E-M-R-M-O-V-E
dot com.
Go buy his album, Easy.
I just got it, been
listening to it in the
car, been pumping it.
It is awesome.
So, that is it.
I guess, I gotta think
about this, we will see
everybody sometime in the
future, maybe or maybe
not next week, but it
will be Same Hack
Time.
Same Hack Channel.
I just want to let you know
you got a real steady
dumper.
Hold up, wait up, stop
for a minute.
I doubt I'm behind, don't
mind being in it.
I sent it and I meant it.
I'm going straight to
hell.
I'm looking at your bucket
that you feel so well.
You're working in a good
way, shaking like you
should wait.
So many things I couldn't
say, but nothing but
show up.
Give me credit from these
things on which I sing.
Lead, wind, and run, and
all it took to be king.
Ground by world, shaking
ground with stopping beat.
Ass wiggle to the beat.
You bend, pretend repeat.
Take a seat.
Well, I'll take two.
Trying to figure out what's
going on with you and
you.
Both plus me equals three
let's see that I got one
something about how it's
going to be.
Me first, no, me first.
Girl, I'm going to get your
bubble burst, but I want
her the worst.
And if that ass ain't
shaking, then I must do
a stake.
Must have done something
wrong when I was on.
And if that ass ain't
shaking, then I must do
a stake.
Must have done something
wrong when I was on.
She got cheeks for weeks.
Let me see, compete now.
She got cheeks for weeks.
Let me see, compete now.
Hugsy kisses, kisses and hugs.
The only reason that we
fuck with you and both like
drugs and you're looking
pretty, pretty.
I can claim this to seem like
I'm looking for the dirty.
You don't know, buggy,
in the way that you're gonna.
Me and Ed wanna talk a little
farther when it's time to
get your flower.
Poetry in your way for a
play for an hour.
I know you big words
cause I ain't no scholar,
but I do got a doctor
in making you holler.
I throw parties and you
catch disease.
Like permanent ass
when it doesn't think you
were pleased.
Just sit back, relax,
and enjoy my pleas.
And you know it ain't
go home to give a
fickle a squeeze.
It's tense moments like
things that I know and
will seize while I wax on
that ass of the greatest
of these down here.
Now when that ass ain't
shaking, then I must
be mistaken.
Must have done something
wrong when I wax on.
Cause if that ass ain't
shaking, then I must
be mistaken.
Must have done something
wrong when I wax on.
She got cheeks for weeks.
Let me sneak a peek now.
She got cheeks for weeks.
Let me sneak a peek now.
Now when I僕 work for weeks.
Let me hehe.
I guess she got cheeks for age.
Let me jeep.
I must have done something wrong when I wrote the song.