-: In this demonstration,
I'm going to show you how pretexting works
as part of a larger,
social engineering campaign.
Now, to help me with this short example,
let's call up a company
on my speakerphone here,
and see if we can trick the receptionist
into giving me some details
about the model of printers that they have,
and maybe I can figure out
a good attack vector,
to use against them as part of my pen test.
(telephone ringing)
-: Hi, Big Old Corporate Headquarters.
This is Sally, how may I help you?
-: Yes, hello.
My name is Bob Smith
with Ink and Toner Express.
Our offices received your order
for toner last night,
but we're having a slight delay
in shipping your printer's toner cartridges.
Now, I'm pretty sure I can get you
an alternative shipped out this afternoon,
and to your offices by the morning,
but I need to verify your printer model.
I would hate to send you a couple of cases
of the wrong toner, you know?
Are you guys still using the HP LaserJet
as your multi-function printer?
Could you double-check the model number for me?
-: Uh, let me check.
Hold on one second, please.
Alright, now while she's off looking for that,
let's talk about this pretext
for a second.
I have no idea what kind of printer
they're even using,
but I bet she has no idea either.
So, if I just pick one of the big brands
like Epson or HP or Lexmark,
hopefully she's going to go check for me,
and if I get it wrong,
she's going to fill the details in for me.
-: Mr. Smith, I just checked,
and it says it's a Konika Minolta C368,
not an HP.
-: Oh, right! I see that now.
I'm sorry, I had your order mixed up
with somebody else's.
They have the HPs over there.
You've got those wonderful
Konika Minolta's last year.
I remember that.
Let me double-check my system a second here.
Ah, yes, yes, yes!
I see it now.
The Konika Minolta Bizhub C368.
Perfect, perfect.
I see your order was for two cases of black,
one case of cyan, one case of magenta,
and only half a case of yellow.
Now, here is where I'm going to try to
push my luck and get
some additional details from her.
So Sally, you know that normally
the printer sends us the request
for auto-shipment as it gets low on supplies.
But unfortunately, I was surprised
when Jimmy called us yesterday
to tell us that you guys were running low.
It seems our connection between
your system and ours
is not working quite right.
I was wondering if you could
do me a really, big favor
so we can get this fixed?
I just need you to double-check
the IP address on the printer,
and make sure that I have it
right in our system.
I would hate for the company
to run out of supplies when you're
up against a deadline.
Do you think you have just a moment
that you can help me out real quick?
It'll just take a second.
-: Uh, yeah, I guess so.
How do I check the IP address on a printer?
-: Oh, it's really, really easy.
All you have to do is go over to the printer,
on the touch screen, press the 'I'
in the upper-right corner.
When that comes up,
just snap a picture with your cell phone,
bring it back here, and you can read me
the details of what I need.
Do you think you could do that for me?
-: Oh sure.
That seems easy enough.
I'll be right back.
-: Alright, so that's the basic idea
of a pretexting call.
I didn't know anything about the organization,
but giving this receptionist
some kind of likely facts,
like the fact that she's running
an HP system or a large printer in the copy room,
which most businesses have,
that I can trick her into giving me
some kind of information.
Now if you've ever gotten one of those calls,
that says, "Hey, this is John from Microsoft,
and your Windows machine has been reporting
that it's been infected with malware.
I'm calling you to help clean it up.
I just need you to do step one two and three,"
this is a pretexting call.
In fact, this is one of the more common
pretexts out there.
The reason why I even use this example
of a Windows machine calling out with Malware,
is because I had the conversation
with my mom earlier this week.
She had gotten one of these calls
a couple of days ago,
and they were telling her that her computer
was infected with malware
and that her Windows machine was calling out.
And so she started playing along with them
for about 20 minutes, eating up their time
because she knew it was false.
She knew it was a pretext and they were trying
to get to a scam.
And try to coerce her for money,
or to get remote control of her computer.
Now how'd she know this?
Because she's one of those people
in the 10 percent that doesn't run Windows.
She has an iMac.
And so for her, it wasn't something
that she was going to fall for
because she knew she didn't have a Windows machine.
You want to make sure that you do
good user training with your staff
so they understand never to give information out
over the phone.
Even information that seems innocent,
like a model number for a printer
or an IP address of a printer,
can be used as part of a further attack.
And so we want to make sure
we train our employees to not fall for pretext
and don't fill in the gaps for other people
when they're calling you
or even if they're doing it in person,
because pretexting is a way that we give
some amount of information that seems true
so that you'll give us more information
to fill in the gaps.