Social Engineering 101

Tom Merritt (0:08)

Welcome to a special DTNS Weekend Edition, gratefully provided to you, and thanks for your support of this show. And it's Cybersecurity Awareness Month in October. Yeah, I know, it's also spooky month, but there ain't nothing spookier than getting hacked. And so we are kicking off a three-part series over the course of these next couple of weekends with Mr. Brian Brushwood.

How do you want to be presented in this light, Brian?

Brian Brushwood (0:36)

I'll tell you what, I've put together a public facing. A lot of folks know that Brian is involved with tricky deceptions, that kind of stuff. But if you want to show something to your boss, you probably don't want to show me and Justin on great night. You probably don't want to show them teaching how to win free drinks at the bar on Scam School. Just send them on over to scampocalypse.com. How about that?

Tom Merritt (0:56)

Yeah, and you've been doing something where you're training folks on security in an interesting and very important way. And that's kind of what we're going to be talking about over these next three episodes.

We're going to talk about your Wolfmasking stuff. We'll get to that. We are going to talk about the changing world next week. But this week, we kind of want to give everybody a basis in social engineering. What is social engineering? And what has worked to hack you with it up until now?

Brian Brushwood (1:30)

Yeah, and this will make sense to a certain subset of the audiences. And everybody kind of comes to similar intuitive understandings through different things. If you work in marketing, you'll understand that a strong marketing message is more likely to cause a human to hit that buy button. If you work in magic, like I do, you know that a superior narrative story will do better at distracting people from noticing the mechanical aspects of a magic trick. And in cyber security, superior social engineering techniques are what get people to grant what seems like a smaller, innocuous favor inside of the organization that gives them outsized access and allows you to steal all the money, do all the bad things.

Tom Merritt (2:11)

Sometimes I think social engineering is bad because it sounds like something you can easily resist, when the whole point of social engineering is to get past your ability to resist it.

Brian Brushwood (2:20)

Well, and keep in mind, social engineering, we're talking about, for example, Nobel economics award winner Richard Thaler's work with the Nudge Unit. A small opt-in versus opt-out design nudge has saved countless lives when it comes to organ donation. Countries that the default status is, you're going to donate your organs unless you say otherwise, those people, a lot of people are able to live many, many more years because of it. So social engineering is quite simply, if we're going to be mechanical about it, it's a little bit like thinking of humans as little wetware, LLMs that are not, they're complex systems, but largely nudgeable and largely, I don't want to say predictable, but certain actions will produce reproducible actions in other humans.

Tom Merritt (3:10)

Yeah. I think when the vast populace thinks of security, they think of malware that is creeping into their machines somehow, or maybe clicking on a link, which is the barest form of social engineering. Give us some examples of what we mean when we're talking about social engineering and why it isn't something your antivirus or your firewall can take care of.

Brian Brushwood (3:33)

Well, so we're going to couch this entirely in, let's say, pre-2010s days, right? I would say that the difference between an injection attack or a software attack would be simply one set of software trying to brute force its way to guess the right password to get around. Whereas a social engineering hack, the canonical example that we love to point to is Kevin Mitnick, who wrote a computer virus and to get it inside of a system that would require a lot of brute force to walk your way past security, stick something into a computer or whatever. But if ultimately you just want somebody to hit go on an executable, it's much better to use seductive reasoning. So in this case, he just put it on a floppy disk and labeled it salaries.xls. And then when somebody put it in, they hit an exe and it got inside the system. That is pure social engineering. It is setting up incentives so that a complex system, a human does their own thinking through the calculus. And it makes the decision to, whether it's clicking the hyperlink or clicking go on the executable, at some point, what you need is to produce an action from another human. And again, in magic, we see it because we need them to pick the right card, not just any card. We need them to pick the right card and we need them to think it was their idea. That's exactly how big Ponzi schemes work and, and, and, and, and.