Top Banner
SESSION ID: #RSAC Zee Abdelnabi THE ART OF HACKING A HUMAN HUM-W04 In-Vehicle Security Engineer Major Automotive Company @Infosec_17
29

THE ART OF HACKING A HUMAN - RSA Conference · The Art of Hacking a Human 2 ... social engineering, ... social status and so on, more important is that on a human level we are the

Jul 29, 2018

Download

Documents

lengoc
Welcome message from author
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
Page 1: THE ART OF HACKING A HUMAN - RSA Conference · The Art of Hacking a Human 2 ... social engineering, ... social status and so on, more important is that on a human level we are the

SESSION ID:

#RSAC

Zee Abdelnabi

THE ART OF HACKING A HUMAN

HUM-W04

In-Vehicle Security EngineerMajor Automotive Company@Infosec_17

Page 2: THE ART OF HACKING A HUMAN - RSA Conference · The Art of Hacking a Human 2 ... social engineering, ... social status and so on, more important is that on a human level we are the

#RSAC

The Art of Hacking a Human

2

First Impressions: Based off perceived stereotypes

Humans can be programmed: They set up their own internal firewalls with interaction rules

Do we want to allow or block this person in our comfort zone?

Page 3: THE ART OF HACKING A HUMAN - RSA Conference · The Art of Hacking a Human 2 ... social engineering, ... social status and so on, more important is that on a human level we are the

#RSAC

Attack Path

3

External reconnaissance – internet searches, social

engineering, “dumpster diving”

Initial breach (breaking in) – scanning, open ports, services,

vulnerable apps, weak protection of data transit

Escalate privileges – exploiting a bug, design flaw or

configuration, taking advantage of programming errors

Persistence – breach undetected for a long period of time

Page 4: THE ART OF HACKING A HUMAN - RSA Conference · The Art of Hacking a Human 2 ... social engineering, ... social status and so on, more important is that on a human level we are the

#RSAC

Attack Path

4

Internal reconnaissance

Lateral breach – need users with more access, more admin

rights to relevant services and servers

Maintain presence

Achieve objective

Page 5: THE ART OF HACKING A HUMAN - RSA Conference · The Art of Hacking a Human 2 ... social engineering, ... social status and so on, more important is that on a human level we are the

#RSAC

Reconnaissance

5

Collecting information about an intended human target:

Do your research

Check their desk

Ask around

Watch them in the cafeteria

Look at previous work history

Page 6: THE ART OF HACKING A HUMAN - RSA Conference · The Art of Hacking a Human 2 ... social engineering, ... social status and so on, more important is that on a human level we are the

#RSAC

Initial Breach: Breaking Into The Human

6

Determine what “operating system” they are running:

What patches are in place?

What vulnerabilities can you exploit?

What “configuration issues” does this person have?

Page 7: THE ART OF HACKING A HUMAN - RSA Conference · The Art of Hacking a Human 2 ... social engineering, ... social status and so on, more important is that on a human level we are the

#RSAC

No Luck: Why?

7

Discover that there are different personality types

Learn the different types of personalities

Learn to adjust in order to know how to interact with that person

Page 8: THE ART OF HACKING A HUMAN - RSA Conference · The Art of Hacking a Human 2 ... social engineering, ... social status and so on, more important is that on a human level we are the

#RSAC

Understand how People Operate

8

Most people are social creature

Most people want to be a part of a group

How can you leverage that

Page 9: THE ART OF HACKING A HUMAN - RSA Conference · The Art of Hacking a Human 2 ... social engineering, ... social status and so on, more important is that on a human level we are the

#RSAC

Focus On You

9

The way you view things

Why you don’t like them

The way you communicate can change how you get along

“Be kind, for everyone you meet is fighting a hard battle.” ~ Ian MacLaren

Page 10: THE ART OF HACKING A HUMAN - RSA Conference · The Art of Hacking a Human 2 ... social engineering, ... social status and so on, more important is that on a human level we are the

#RSAC

10

Page 11: THE ART OF HACKING A HUMAN - RSA Conference · The Art of Hacking a Human 2 ... social engineering, ... social status and so on, more important is that on a human level we are the

#RSAC

Altering Perceptions

11

Different points of view will differ from the location and perception of the Subject.

Page 12: THE ART OF HACKING A HUMAN - RSA Conference · The Art of Hacking a Human 2 ... social engineering, ... social status and so on, more important is that on a human level we are the

#RSAC

Escalate Privileges

12

Taking advantage of their flaws.

Persuade the Target:Demonstrate Honesty and Respect By:

Meet with them – have a list of things you want to accomplish while on the same team

Ask target how you could earn their trust

Ask if they need help with assignments

Invite to lunch

Ask questions pertaining to them

Page 13: THE ART OF HACKING A HUMAN - RSA Conference · The Art of Hacking a Human 2 ... social engineering, ... social status and so on, more important is that on a human level we are the

#RSAC

Ego Defense Mechanisms

13

Different defense mechanisms helps identify the person.

Lash out: Get protective to protect their pride even though they know they’re wrong

No insight they are wrong. Or, they know there is a chance they could be wrong, but they won’t admit wrong

Page 14: THE ART OF HACKING A HUMAN - RSA Conference · The Art of Hacking a Human 2 ... social engineering, ... social status and so on, more important is that on a human level we are the

#RSAC

Micro Expressions

14

Clues people give up are on their face; impossible to control.

If you can read these clues, you’ll understand where the conversation is going

Are you connecting?

Are they comfortable?

Page 15: THE ART OF HACKING A HUMAN - RSA Conference · The Art of Hacking a Human 2 ... social engineering, ... social status and so on, more important is that on a human level we are the

#RSAC

The Reason They Don’t Like You

15

May not be valid

Could be stereotypes

Break those stereotypes

Page 16: THE ART OF HACKING A HUMAN - RSA Conference · The Art of Hacking a Human 2 ... social engineering, ... social status and so on, more important is that on a human level we are the

#RSAC

Persistence

16

Will not happen overnight; it is a gradual process.

Find a mentor and ask for advice

Network using target’s mutual friends

Page 17: THE ART OF HACKING A HUMAN - RSA Conference · The Art of Hacking a Human 2 ... social engineering, ... social status and so on, more important is that on a human level we are the

#RSAC

Lateral Breach

17

A hacker will need more intelligence that come from data points.

Mutual friends

Page 18: THE ART OF HACKING A HUMAN - RSA Conference · The Art of Hacking a Human 2 ... social engineering, ... social status and so on, more important is that on a human level we are the

#RSAC

Achieve Objective

18

As a User, you will be able to work with different Personalities based on what the Hacking results tell you

Page 19: THE ART OF HACKING A HUMAN - RSA Conference · The Art of Hacking a Human 2 ... social engineering, ... social status and so on, more important is that on a human level we are the

#RSAC

The Bad Boss

19

Goes by the book and micromanages.

Acts a certain way because they have not been shown respect and have received negative feedback.

Difficult to beat in a match, you can’t just flip the board and walk away.

Page 20: THE ART OF HACKING A HUMAN - RSA Conference · The Art of Hacking a Human 2 ... social engineering, ... social status and so on, more important is that on a human level we are the

#RSAC

Engage The Boss

20

Page 21: THE ART OF HACKING A HUMAN - RSA Conference · The Art of Hacking a Human 2 ... social engineering, ... social status and so on, more important is that on a human level we are the

#RSAC

8 Types Of Leaders

21

Page 22: THE ART OF HACKING A HUMAN - RSA Conference · The Art of Hacking a Human 2 ... social engineering, ... social status and so on, more important is that on a human level we are the

#RSAC

Throughout The Hacking Process

22

Remember that communication is the key

If you cannot help somebody at least don’t hurt them

“People fail to get along because they fear each other; they fear each other because they don't know each other; they don't know

each other because they have not communicated witheach other.” ~ The Dalai Lama

Page 23: THE ART OF HACKING A HUMAN - RSA Conference · The Art of Hacking a Human 2 ... social engineering, ... social status and so on, more important is that on a human level we are the

#RSAC

Winning The Hacking Game

23

Respecting all religious traditions

Exploiting and bullying will never win you any real friends

Kindness and compassion will give rise to self confidence, which empowers you to be honest, truthful and transparent.

Page 24: THE ART OF HACKING A HUMAN - RSA Conference · The Art of Hacking a Human 2 ... social engineering, ... social status and so on, more important is that on a human level we are the

#RSAC

We Are All The Same

24

“And while on a secondary level differences exist of nationality, faith, family background, social status

and so on, more important is that on a human level we are the same. None of us wants to face problems, and yet we create them by stressing our differences.

If we see each other just as fellow human beings, there'll be no basis for fighting or conflict between

us.” ~ The Dalai Lama

Page 25: THE ART OF HACKING A HUMAN - RSA Conference · The Art of Hacking a Human 2 ... social engineering, ... social status and so on, more important is that on a human level we are the

#RSAC

You Are Confined By The Walls You Build

25

Look at yourself, the stereotypes people notice

The way you talk to people

Your perceptions

Do you let the way people treat you become the way you treat others

Page 26: THE ART OF HACKING A HUMAN - RSA Conference · The Art of Hacking a Human 2 ... social engineering, ... social status and so on, more important is that on a human level we are the

#RSAC

You Attract

26

The only time someone can drive you crazy is if you are willing to be their passenger.

Reciprocal socialization: This is what parents to do teach their kids to be adults.

Employees: The way you talk is the way you want to be treated

Socialization – negative/positive

Any Company – Employees – Different Personalities – Success

Page 27: THE ART OF HACKING A HUMAN - RSA Conference · The Art of Hacking a Human 2 ... social engineering, ... social status and so on, more important is that on a human level we are the

#RSAC

Page 28: THE ART OF HACKING A HUMAN - RSA Conference · The Art of Hacking a Human 2 ... social engineering, ... social status and so on, more important is that on a human level we are the

#RSAC

Apply

28

This talk will help you realize that sometimes we are the problem and not that other person. Learn to gather your information about that person before jumping to conclusions of why they don’t like you.

Look at the cultural environment you are in, is this why that person is the way they are?

Use technical and non-technical techniques to get along better with people. Use positive energy

Page 29: THE ART OF HACKING A HUMAN - RSA Conference · The Art of Hacking a Human 2 ... social engineering, ... social status and so on, more important is that on a human level we are the

#RSAC

Apply

29

Look at the way you treat others.

Understand how people operate.

Be able to understand different personalities based on somebody's micro expressions, ego defense mechanism and understand that the way you socialize with people sets boundaries and limits on how they interact with you


Related Documents
Growth hacking: a black art?

Growth hacking: a black art?

Category: Marketing
Hacking the Human - How Secure Is Your Organization?

Hacking the Human - How Secure Is Your Organization?

Category: Business
Growth Hacking: The Human Operating System for Martech (Marketing Technology)

Growth Hacking: The Human Operating System for Martech...

Category: Marketing
Hacking the Human - kcaga-cgfm.org Y Hacking the Human... · Hacking the Human Social Engineering Attacks April 14 ... The art of intentionally manipulating behavior ... • Social

Hacking the Human - kcaga-cgfm.org Y Hacking the...

Category: Documents
The Art of Growth Hacking by Neil Patel

The Art of Growth Hacking by Neil Patel

Category: Marketing
Hacking Human Connection

Hacking Human Connection

Category: Technology
Hacking Human Language (PyData London)

Hacking Human Language (PyData London)

Category: Education
SOCIAL ENGINEERING · SOCIAL ENGINEERING: THE ART OF HUMAN HACKING Tyler Leet, Director of Risk and Compliance Services

SOCIAL ENGINEERING · SOCIAL ENGINEERING: THE ART OF HUMAN....

Category: Documents
Social engineering: A Human Hacking Framework

Social engineering: A Human Hacking Framework

Category: Engineering
Hacking Flow: Achieving Ultimate Human Potential

Hacking Flow: Achieving Ultimate Human Potential

Category: Self Improvement
Hacking Human Behavior

Hacking Human Behavior

Category: Technology
SOCIAL ENGINEERING - c.ymcdn.com · SOCIAL ENGINEERING: THE ART OF HUMAN HACKING Tyler Leet, Director of Risk and Compliance Services

SOCIAL ENGINEERING - c.ymcdn.com · SOCIAL ENGINEERING: THE...

Category: Documents