-: Motivation factors.
So the backbone of social engineering
is being able to trick a user
into doing something for you.
Well, what motivates the user to fall for those things?
That's what this lesson is going to talk about
because you need to know these for the exam.
Now, the first one is authority.
People are much more willing to comply
and do what you tell them to,
if they think it's coming from somebody who's in authority.
So pretending to be a boss or the boss's boss
or the CEO or some high level manager
can get some lower level employee to do what is needed.
You might also pretend to be an important client.
And hey, I need you to do this because I'm the client,
you need to do what I say, right?
You can pretend to be a government agency.
I get voicemails all the time
from somebody pretending to be the IRS saying,
if you don't call us in the next 24 hours,
we're going to come arrest you, right?
They're using that government authority
and that government agency trying to scare me
into making that phone call,
when really, the IRS never calls you
and leaves a voicemail that way, right?
This is just a scam attempt that somebody is using.
The other thing is financial institutions right?
You saw the phishing example from Bank of America.
Your account has been hacked,
click here to reset your password.
I saw a lot of PayPal scams like that as well.
These are very common.
They're using that authority
something you really just trust like your bank,
your police department, your government
your CEO, your managers, your important clients,
all of those things, that all falls into authority.
Now, the next one that we have is what's called urgency.
And urgency is all about
the fact that people know that we're in a rush
a lot of the time,
we're busy these days, right?
And people want to help others by nature.
It's just in our human nature.
You ever walk up and you hold the door open
for somebody, right?
That's just being nice, right?
And if somebody is really busy
you might, you know, help them get through really quickly.
Well, that's the whole idea with urgency.
Maybe you say, hey, I've got a couple of minutes
and I really need this printout.
I've got to be in the conference room in five minutes.
Here's my thumb drive,
can you print out this PowerPoint for me,
and on that thumb drive is a bunch of malware, right?
All of these things type of things.
It's trying to push somebody to go and bypass the processes
because this has to be done right now.
You call up and you say,
hey, this is John and my account's locked down,
I really need you to reset my password.
And the IT guy in the other end says,
no, no, you got to come down and show me ID.
Well, no, no no, I've got to make this next meeting,
I've got to get this email,
please please, you just got to reset this right now.
And they try to force them into doing it
by the sense of urgency
that there's this approaching deadline, right?
And that's the way that they you can start using
that motivation as part of your attacks
in social engineering.
The next one we have is social proof.
Let's say that I put up a website out there
that was fake and scammy, right?
And I was trying to fish people to get them to go there.
Well, if I can get some social engineering done
through Facebook or Twitter
where I get people to like that site
or share that site for me,
that starts showing social proof
and people are more likely to click on it, right?
People are much more likely to click on things
that have a lot of likes,
a lot of shares and a lot of their friends doing it.
So if I can trick one friend,
that friend might turn it to the second friend
and the third friend of the fourth friend
and maybe I'm not going after the organization directly
but I'm going after a friend
who works in that organization, right?
People have this craving to be part of a social group.
They want to have social interaction
and they have this need to be included.
And so sometimes you can use that social
against them as well.
Hey, join this Facebook group
and be a part of this thing, right?
And then you can start building trust
with that person, right?
Sometimes we don't really understand
what is being asked of us as part of this inclusion
but, or even why we're performing an action.
I mean, how many of those different scams have gone on
and then passed around through Facebook and Twitter
and all these other things that attackers are using
because we all just feel like we have to share it, right?
Some of these are good, some of these are bad
but you have the social proof that gets built up
because so many people like it.
I mean, when you decided to buy this course
you probably looked at the statistics
and you said, well, if there was zero people
enrolled in this course,
you might've thought it was horrible,
but if there was a 100,000 people who bought this course
you might go, wow, this must be a great course.
That's social proof, right?
We can use the same thing as trying to make it
so that while everybody else is doing it,
it must be okay for me to do it too.
So that's the idea here.
The next one we have is scarcity.
Now, scarcity is when you use a technique
to get people to act quick, much like urgency,
but the difference here is that usually you're going to do it
through like an email campaign or phishing, right?
You go sign up now, supplies are limited.
We only have five spots left,
you've got to sign up right now,
if you want to get part of this, right?
And so you'll get this email and you'll be like,
wow, this is a really good deal
on a new MacBook computer.
Instead of $2,000, they are just selling for 999.
Well, I better click now
'cause there's only three left, right?
That kind of a thing.
And then you click it and you're putting your information
and now I've got your credit card information
and your email and everything else.
And maybe you never even get your Mac computer, right?
So that's the idea here,
is scaring somebody into acting really quickly
because there's very limited quantities.
And again, this is very common inside phishing,
spear phishing and willing scams.
The next one we have is likability.
People want to be and interact with people they like.
Social engineers are some of the most friendly
and likable people you will ever meet.
You don't have these crusty, angry people
as good social engineers.
It just doesn't happen.
You have friendly people,
you have pretty people.
One of the things that a lot
of my pen testing teams like to do
is they will take a very pretty woman
and put her on the team,
because a lot of the people who work in IT are men.
And so she can get her way
and get them to do all sorts of things
that they would never do for a guy who looks like me.
And so likability is important, right?
Sometimes it's about finding common interests.
Sometimes it's about sexuality.
Sometimes it's about shared interest
in common ground, right?
Maybe you and I start talking
and we start talking about football
and you know how my favorite team is X, Y, Z,
because I know that's your favorite team.
Now that would never happen with me
'cause I don't like sports, but you know,
maybe we're going to talk about my favorite video game.
And if I find someone else who likes that video game
I can say, oh, well, I've got some great content for that.
Let me send you this file,
it'll give you this great new skin for your character.
And now I've got to weigh in
because I embedded some malware in that, right?
It's all about likability.
It's all about making that friendship, right?
And some of these become long cons,
some of them become short cons,
just depends again on your scope and scale of your pen test.
Now, the last one we have here is fear
and fear is a great motivator if used properly.
In fact, ransomware and any virus scans,
they live off fear, right?
It's if you don't do this,
then this other bad thing is going to happen.
It's a threat or a demand.
So here's an example on the screen, right?
You see the pop up and it comes up and says,
your computer has been locked.
You've been found guilty by the FBI of piracy.
If you enter click here to pay your fine of $200, right?
And you'll go and click there
and that way they don't come and arrest you.
This isn't really the FBI, right?
It's a scam, they're using fear.
If you don't do this, you're going to get arrested.
That's the whole idea here.
And they can see as some of these get combined, right?
Because this also has that authority tinge to it,
because FBI is a government organization
but we're now using them in a fearful way.
And so a lot of these motivations start overlapping
and working together
to make an effective social engineering campaign.
(upbeat music)