Social Engineering

and

The Great Indian Jugaad

Case Study: Titanic 2 - The Surface

Link: http://www.youtube.com/watch?v=vD4OnHCRd_4&feature=fvst

Quick facts:

• A movie trailer that was and is so popular that many people still “swear” to have seen it if it had been made into a movie. • 8 months after launching the trailer, 100% people in comments believed it was “real” •2 years after it was launched, still 70 % people furiously believed that it was real deal and refused to accept it was a fake trailer. • It took the original author to accept the fact publically on 2010 by updating video on Youtube that it was indeed a fake “trailer”

Case Study: Titanic 2 - The Surface

Case Study: Analysis

• Why the trailer became so popular? • Why did people refuse to accept the fact for so long that it was a fake trailer ? • What made people change their mind? • Why trailer is fake or not is still debatable among the “first time viewers” ? • Why makes people who know it is a fake trailer still want to see it again ?

Case Study: Scene-wise Analysis

Case Study: Scene-wise Analysis (contd..)

Case Study: Scene-wise Analysis (contd..)

Social Engineering

Agenda for Social Engineering:

• What is Social Engineering (SE) ? • Fundamental principals guiding the success of SE • Case Study Demonstration • Macro-expressions • Micro-expressions • Techniques used during Audit or SE Testing • Counter Measures for SE

What is Social Engineering? Act of influencing a person to take action that may or may not be in target’s interest.

Good Social Engineers:

Parents, Doctors,

Criminal Psychologists Negotiators

Salespersons Diplomats

Whistle-blowers Magicians

Bad Social Engineers:

Fraudsters, Confidence tricksters Malicious Insiders, Espionage Agents, Double-Agents, Blackmailers, Human Traffickers, Terrorists

Fundamental principals guiding the success of SE

Reciprocation:

Commitment and Consistency:

Social Proof:

Liking:

Authority:

Scarcity:

We are hard-wired to respond to a favour, often not in direct proportion to the size of the favour done to us.

Once we have made a choice or taken a stand, we will encounter personal and inter-personal pressures to behave consistently with that commitment.

One means we use to determine what is correct is to find out what other people think is correct. The principle applies especially to the way we decide what constitutes correct behaviour.

As a rule, we prefer to say yes to the requests of someone we know and like

The real culprit is our inability to resist the psychological power wielded by the person in authority.

The influence of the scarcity principle in determining the worth of an item.

Case Study: Reliance Canteen episode

During our graduation days, we planned have food from the canteen without paying huge bills when our friend group grew large in size.

We gave the 2 sims to canteen serving boy for having him to talk “as much as he desires” to his village. We made an understanding that whenever our friend circle was visiting canteen, he will bring extra samosas or cold drinks without charging us extra on them.

We used to get almost double the food for the price of few items or the half of the price. This went on un-noticed for 7-8 months.

Those days, Reliance had launched an offer that enabled you to talk free between 2 sims if you buy them.

The Opportunity

Objective

The SE Attack

The Effect

Case Study: Analysis

• Why did the plan work?

• What could have caused failure of plan after 7-8 months?

• What could have happened if we were caught earlier ?

Macro-expressions / Body language

• Feet/Legs • Torso • Hands • Neck • Mouth • Face

Communication consists of :

• 7% of what we say • 38% vocal(tone, accent, dialect) • 55% Non Verbal

Non Verbal behaviour is depicted fundamentally by some body parts and how they act:

(Most Accurate)

(Least Accurate)

Macro-expression / Body language is a form of mental and physical ability of human non-verbal communication, which consists of body posture, gestures, facial expressions, and eye movements. Humans send and interpret such signals almost entirely subconsciously.

Macro-expressions :An Analysis

Pop Quiz: Identify this expression?

Micro-expressions A micro-expression is a brief, involuntary facial expression shown on the face of humans according to emotions experienced.

Characteristics of micro-expressions:

• They are very brief in duration, lasting only 1/25 to 1/15 of a second. • Highly Accurate in depicting the "actual" thought of the person. • Almost involuntary reflexes barely felt by the subject • Express the seven universal emotions: disgust, anger, fear, sadness, happiness, surprise, and contempt • It is difficult to hide micro-expression reactions

Techniques for controlling Micro & Macro expressions

If you are stuck during conducting a social engineering exercise, the following tips might help for successfully carrying out testing:

• On confronting an anti social or angry person; frown a bit and tilt your head by relaxing your shoulders. This indicates you are interested to hear him/her out and are not confronting directly. • Enter with a sad expression, the subject will involuntary feel sympathetic for you and will offer to help in most cases. • A friendly and warm reception always has higher chances of information retrieval than a rash or unfriendly behavior • Do everything in confidence even you know you are trapped. • Dress up nicely and walk in short sure steps. It gives an impression of authority and people are much likely to yield under this charismatic effect.

Source: www.hackers5.com

Counter Measures for Social Engineering

Must Have Resources • Social Engineering: The Art of Human Hacking by Christopher Hadnagy • The Art of Deception: Controlling the Human Element of Security by Kevin Mitnick • Influence: The Psychology of Persuasion by Robert B. Cialdini

Links • Video: Nonverbal Human Hacking Derbycon 2012 http://www.irongeek.com/i.php?page=videos/derbycon2/2-1-2-chris-hadnagy-nonverbal-human-hacking • Body Language – Expressions on Google Android App Store: https://play.google.com/store/apps/details?id=com.Mazuzu.ExpressionTraining&hl=en

The Great Indian Jugaad

• Introduction to Jugaad • The Indian Advantage • Effects of Jugaad and Hacks • Examples of Jugaad • Can Jugaad change lives?

Agenda for Jugaad:

Introduction to Jugaad

• An innovative fix or a simple work-around used for solutions that bend rules or conventional approach

• A person who can solve a complicated issue.

Clever, creative and smart manuovore or workarounds to get the job done often by multipurpose or removing non-essential parts of a given tool.

Basically Jugaad signifies creativity to make existing things work or to create new things with “meagre" resources.

Jugaad also frequently refers to:

The Indian Advantage

Because of the above factors, India is uniquely positioned to take advantage of Jugaad and to play a pioneering role in it.

• Large educated population • Unemployment issues • Young dynamic work force raring to think “out of the box” ideas • Popularity of the social networking tools spreads ideas faster • Strong family ties and relations helps nurturing social cause • Heavy political influence and the thirst for power / influence • Competitive spirit due to large educated population

Effects of Jugaad

• Increasingly being accepted as a management technique (in recession times ) • Recognized worldwide as a form of frugal engineering pioneered in India. • A practice to reduce research and development costs by companies in India

Jugaad and Hacks

Similarity

Difference

Both concepts express a need to do what needs to be done, without regard to what is conventionally supposed to be possible.

• An Indian pioneered concept vs a western intellectual term for applied innovation to get things done when required.

• A jugaad can be thought of more as a survival tactic, whereas a hack is used in context of intellectual form.

Examples of Jugaad / Hacks Popular examples

Personal Jugaad(s)

Personal hacks

In Movies

• What an idea, Sirji !! (idea Cellular Ad concepts) • “Lassi” churners used in washing machines • Bisleri 600 ml lead shot filled bottle used as dumbels • Disha maidan purpose bisleri half cut bottle

• “Ergo” film concept diagrams for convincing airport security Iranian officers • “Lord of War” flag sideway swap (from France to Dutch) • “Catch me if you can” various fraud scenes

• Hotmail Junk Filter manipulation to keep account activated • Cassette player song transfer to MP3 files • Admission form of UCER, UCEM • 8 marks increase by changing - to + signs in maths paper

• Hutch multiple group mail at same rate (security misconfiguration) • BSNL UP(W) range swap to UP(E) • Telephone line detector to notify the free Internet line availability

Examples of Jugaad / Hacks Commercially Accepted Jugaad(s)

• Tata Nano • Jaipur Foot • Aakash Tablet & Simputer • Radio Tuk Tuk (Gurgaon) • EcoCabs (Punjab) • Android, iOS, Windows Apps for locating restaurants & text translators by camera scan, • Cooperative bank working (for vegetable, fish vendors) • QR code scanner for buying grocery (South Korea)

Can a Jugaad change a life ?

Sudha Chandran

Jaipur Foot

Sudha Chandran, an Indian actress and dancer, lost her limb in an accident in 1982. She subsequently overcame her disability with the help of a prosthetic 'Jaipur foot', becoming one of the most highly acclaimed dancers of the Indian subcontinent. Soon after she garnered fame and recognition by venturing into the world of films and television notable being “Kaahin Kissii Roz”, with her character of Ramola Sikand.

THANK YOU !!!

Presented By: Manasdeep