Defcon 21 - Social Engineering: The Gentleman Thief

Рет қаралды 370,078

HackersOnBoard

10 жыл бұрын

Apollo
August 1st--4th, 2013
Rio Hotel & Casino • Las Vegas, Nevada

Пікірлер: 169

@everettlogan2433 7 жыл бұрын

Anyone else amazed that a convention for people who speak to computers for a living had so much technical trouble?

@yissssss 6 жыл бұрын

You've clearly never been in a technical demo.

@t3mpl3guardian 6 жыл бұрын

I remember my favorite activities in high school. The first was Computer Programming. The second was the Audio/Video Club. Funny thing. They had almost nothing to do with each other.

@UCH6H9FiXnPsuMhyIKDOlsZA 5 жыл бұрын

It's a conference full of the world's most enthusiastic security professionals. It's incredible that things don't HCF.

@CautionCU 5 жыл бұрын

You must be new here jpg

@TheZigzagman 4 жыл бұрын

Nothing works at conventions. That's just how it is.

@smishdws 6 жыл бұрын

36:38 "When you know something, that's when you should be scared. When you feel like you know your techniques, your protocols, and you're absolute, that's when you should be scared because you have no room for doubt, and doubt is what makes us secure."

@psychedelicrelic2299 8 жыл бұрын

That was savage when he took the watch straight off the guy. Too good.

@lutze5086 7 жыл бұрын

Jake Neild in a fictional dramatisation? wowee. maybe I'm jumping the gun tho..

@ST-fp8jk 7 жыл бұрын

Jake Neild Apollo actually does things like that.

@Psychlist1972 4 жыл бұрын

@@lutze5086 He actually does it like 30 minutes in.

@ablindgibsongirl 9 жыл бұрын

This talk completely changed how I look at the world and how I think about multitasking.I will never forget the trick with the watch.

@JesusGreenBL 9 жыл бұрын

A little analogy for social engineering I've always liked is that of an iceberg - when you talk to someone they present you the above surface information, the tip of the iceberg, and our minds automatically try to fill in the blanks, assuming there's a lot more under the surface. The trouble is if the tip of the iceberg is presented to you well then you're going to assume that there's more to see below, i.e. you only have to give a few small credentials or confidence tricks but if all of those flag correctly in the mark's mind, they're going to assume automatically that everything else about you checks out too. I think one of the biggest mistakes people new to social engineering make is they try to give too much information, make that tip of the iceberg seem too big, with many claims that can be checked out quickly by the mark and proven to be false, instead you want to focus on a few little things that they can trust you on and let their subconscious fill in the blanks and assume you've got their best interests in mind. For people looking to protect themselves, the key thing to remember is that your mind is always going to fill in that bit of the iceberg under the surface without you choosing to put it there. If someone's wearing the right clothes, talking the right way, seemingly wearing the right badge, your subconscious has already said "Okay I can trust him!", so your job is now to be the fact checker and to always add an element of doubt/suspicion to any of your checks even if the person seems to be ticking all the boxes. Just because someone calling you up asking for information says it's urgent and you don't want to get in trouble, doesn't mean you need to start compromising on security and risking putting yourself in an even bigger mess. Whatever the tip of the iceberg looks like, assume there to be no substance beneath it unless you've verified otherwise. Another simple tip that's surely obvious to a lot of you but sometimes goes forgotten: Trust gut feelings when they tell you something's wrong, but don't trust them when it comes to assuming they're right - it's those feelings we play on when we're social engineering, and someone who doesn't know how to social engineer correctly will set off all those intuitive red flags, but advanced confidence tricksters really won't, so you need to be able to doubt even the people you feel most comfortable around when it comes down to it.

@MiddleClasshole77 7 жыл бұрын

JesusGreen You gotta give em "just the tip"

@obfuscated3090 5 жыл бұрын

There's a saying, "always question, never defend".

@ankhankh8798 4 жыл бұрын

1:57 The Con Artist 4:17 Entering someone’s Personal Space 9:46 Resources 11:41 Humor 14:18 The mentalist 16:55 Con Film 26:31 Grifter

@ethanwild3301 Жыл бұрын

Thank You

@Mythricia1988 7 жыл бұрын

The live stealing demo (31:15) actually rocked my world. I don't even know how to feel, other than fundamentally mind-fucked.

@asdfghyter 5 жыл бұрын

@skidrowsux1977 No, it was real. He even explained how he did it. Humans are really easily distracted.

@Alkis05 5 жыл бұрын

If you can't see that the questioner was planted, you wasted 42min of your life. Learn how to be a little more skeptic. It will do you good

@asdfghyter 5 жыл бұрын

Alkis05 Why would he be planted when he doesn’t need to be? These tricks work. Learn to be skeptical about your own reactions as well. Skepticism isn’t about assuming that everything you see is fake.

@ericsbuds 8 жыл бұрын

ohhh yeah the TED talk. I knew I saw him before. He does the one where he changes shirt half way through and you don't even notice.

@mydemon 4 жыл бұрын

Yep!

@IVChan 2 жыл бұрын

Who is he?

@Seth9809 5 жыл бұрын

"It's something the plane can't leave without." Holy shit, I didn't notice that the whole time?

@redteamtraining9277 6 жыл бұрын

A very good talk. Probably one of my favorites.

@Slecker95 9 жыл бұрын

Fantastic talk, very stimulating!

@angenicurtis8972 7 жыл бұрын

that short is so fucking good, do more!!!!

@Zed-Krule 2 жыл бұрын

Love seeing magic utilized in the tech scene. Makes me really happy.

@anbuddh 10 жыл бұрын

'Do the job, and walk in garden like a boss' : That's the Gentlemen thief . . . (Social Engineering)

@davidmusselwhite547 8 жыл бұрын

Why is it that every time. I watch one of these about all these smart people they can't get the projector to work

@FCoFix 7 жыл бұрын

Projectors, Printers, Bluetooth, some devices are the creation of the IT Devil

@el_nave3500 7 жыл бұрын

David Musselwhite I was about to comment about that

@swiftfox3461 7 жыл бұрын

David Musselwhite Especially inkjet printers. They can smell fear.

@om3g4z3r0 7 жыл бұрын

Smart people sometimes overthink obvious stuff, maybe maybe a dummie in the audience pull a wire off just to check how long it takes for them to figure it out.

@SteefHartman 6 жыл бұрын

murphys law

@d_k_n 10 жыл бұрын

A different level of security. Love it.

@wendys390 7 жыл бұрын

Oh, bravo to you on "multitasking"...I couldn't agree more! For dummies: There is no way you can give 100% of your attention to more than one thing at a time. Period. I mean, literally, you have to admit that as a fact, and once you do that, what else is there?

@mathieuclement8011 6 жыл бұрын

The question is, does multi tasking mean paying attention to multiple things at the same time or only being able to perform multiple tasks at the same time? Because in this case I think that you can multi-task as long as all the tasks, or all the tasks minus one are "automatic". For instance, let's say I'm waiting to make a turn at the light on my motorcycle (I'm using a motorcycle in this example as it requires more skills / tasks). The light turns green, my attention is focused on the pedestrians I have to yield to and where I am going and the road surface. But while most of my attention is focused on what my eyes perceive, I am, at the same time, operating the gas, clutch, gear selector, turning the handlebars, cancelling the turn signal, and keeping my balance. If multitasking means paying attention to multiple things at once, then I agree with you ; Humans cannot pay attention to two things at once, it's been researched by neuroscientists. Also if using this definition of multitasking, you are really only stopping one task, and then starting another, which is inefficient, takes more time, and will cause mistakes. One of the traditional experiments is to ask people, on a piece of paper, to write the alphabet on one line, and numbers on the next line. The assistants ask the subjects to do those two tasks in two different way and time them. The first time, they write the letters and then the numbers, so ZYXW, and then 1...3...5..7...11. The second time, they have to write one letter and then one number, e.g. Z1Y3X5W7. and as expected, the second method takes more time, and people are more likely to make mistakes. If we were truly able to multitask, then there would be no difference.

@XaetaCore 10 жыл бұрын

Great Video

@LordDragon1965 7 жыл бұрын

That film was 100% genius...

@8898samuel 9 жыл бұрын

That was amazing.

@rabbitofthefuture3234 2 жыл бұрын

so penises have no taste?

@onehappynegro 7 жыл бұрын

16:50 the movie. even with the slowmotion on it was hard to see whats going on.

@jassiel123 5 жыл бұрын

You call it social engineering, I call it cappin

@YoungLionC 6 ай бұрын

Hahahaha I also call it FLEXIN

@definesigint2823 6 жыл бұрын

This has perplexed me a long time: I "found" the photo difference instantly (1-2 frames), but I didn't see *what exactly* was different for several more; I just knew /where/. Same thing for spelling, or security anomalies; I tripped "right here" but "why" has a blasted delay. Anybody else do this / have a way to improve response?

@Outphase420 4 жыл бұрын

Amon Tobin in the soundtrack around 24:00. Nice.

@gardenzombie 9 жыл бұрын

I like how they used Amon Tobin - who himself is from Montreal.

@Da_maul 5 жыл бұрын

Ah, someone else who recognized 4 Ton Mantis playing in the background of that video.

@00011theman 10 жыл бұрын

The part in the short movie where the kid puts a magazine above the ladies purse when she throws the phone in and slides in down the magazine and into his hand is slick as fuck.

@Perrybezenar 7 жыл бұрын

Always with the audio problems!

@LogicBob 9 жыл бұрын

Seriously, what's the name of that damn podcast?

@MrLastlived 8 жыл бұрын

Logic Bob Ok so this is a little late. But I *think* I was able to find out what his podcast was. The man with the podcast was "Chris Hadnagy" - this can be confirmed by google images. A quick wiki search from there leads to the podcast name and looking about on the Podcast's site confirms its the one he is probably talking about. The podcast is called "Security Through Education". It's the first site that comes up when I looked it up on google.

@LogicBob 8 жыл бұрын

MrLastlived Actually (even later!) I found the podcast too and "security through education" is the tagline... Chris Hadnagy's podcast is actually the social-engineer.org podcast. Obviously, that's his site too. Heres a link: www.social-engineer.org

@matthewmcwane9569 3 жыл бұрын

What’s their podcast?

@nikkistar4263 10 жыл бұрын

I'm pretty sure Apollo played as a thief on Leverage in the episode "Too Live Crew"

@MichaelIGDE 10 жыл бұрын

I think so also. That show is amazing.

@l337pwnage 8 жыл бұрын

gotta love how they keep changing labels, kinda like how "garbage men" are now "sanitation engineers". Everybody is an "engineer" today, lol.

@xXMegaUltraNinjaXx 8 жыл бұрын

YOU GET AN ENGINEER YOU GET AN ENGINEER YOU GET AN ENGINEER EVEN YOU GET AN ENGINEER you get a gender studies degree...

@EddySmith85 7 жыл бұрын

l337pwnage Ye washing dishes for a living they consider you a ceramic engineer

@frobie54 7 жыл бұрын

Reminds me of an old '80s comic. "I'm a _waste management artisan._"

@Evildaddy911 7 жыл бұрын

I saw a job posting today for "liquor distribution technician" aka bartender

@HappyBeezerStudios 4 жыл бұрын

It's technically corecct, which is _indeed_ the best kind of correct, but still tries to make things more appealing than they are.

@Kadranos 7 жыл бұрын

I wonder how many people lowered their hands by the time he asked "does that answer your question?"

@officergregorystevens5765 7 жыл бұрын

I saw it even before he hinted about people looking at the windows, or counting them, etc... and I'm tired as hell right now with no amphetamine in my system.

@grackle8723 6 жыл бұрын

PSA: This is not the general public.

@whatabouttheearth Жыл бұрын

36:42 What apparently they didn't notice is the tail number/symbol is disappearing

@imjustczarina 5 жыл бұрын

What podcast are they talking about?

@emphasis170 5 жыл бұрын

i wish programmers were also magicians like me

@akash.trehan 7 жыл бұрын

Does anyone know where I can find that engine appearing and disappearing gif?

@harryassenbach 10 жыл бұрын

Very interesting and informative. Have you ever attempted to get the pistol off a cop or security guard?

@SliC3oFicE 10 жыл бұрын

ive seen a drunk idiot try it, however any one who has use a holster with a 3 stage release knows how hard it is

@CGoody564 7 жыл бұрын

yeah, you're not getting that fucker out

@obfuscated3090 5 жыл бұрын

The social engineer gets the guard to help them and doesn't need or want the pistol. See MANY other Defcon videos and take my word for nothing!.

@AlexZanderMuro 2 жыл бұрын

had a cop hand me his gun (after he unloaded it) in a locked and gated utility hut for a state owned cell tower site. just got to talking to him about guns, asked if what he had was X gun from Y mfgr, turns out it was Z gun from Y mfgr, said i had never seen one in person, asked what differences there were, since i owned model X and had no experience with model Z, and he pulled it out, started looking it over and saying he wasnt quite sure. i said i had heard there were some differences in the firing pin placement and some parts of the trigger bar mechanism, and he invited me closer to him as he unloaded it, handed it over, and let me inspect it (and disassemble it), all while i had my own gun on my hip, and he was completely disarmed. theyre not as smart as you think.

@Toalettduck 6 жыл бұрын

@HackersOnBoard Where do you find this footage? I guess it's not recorded by the uploader.

@COGSCNY 4 жыл бұрын

what is the podcast he has???

@dandymcgee 10 жыл бұрын

What maximum security prison doesn't have bars on the windows..? Lol.

@TheAtrocitus 9 жыл бұрын

OpenBSD

@mathieuclement8011 6 жыл бұрын

And what was he wearing? Since when do window cleaners dress like prisoners?

@mikahytonen929 5 жыл бұрын

I think it was that he was going to go in max security prison

@sadrien 5 жыл бұрын

he never made it to the prison, he was probably in some office building that the secret service seized in order to hold him until an armed escort could come.

@obfuscated3090 5 жыл бұрын

The mind. What do I win?

@brettlaw4346 4 жыл бұрын

Engineering is a lot like eating. Bite off more than you can chew and you risk choking on it.

@brettlaw4346 3 жыл бұрын

@Dr. M. H. Well, when the host dies, so do the parasites.

@DavidDouglasJr 9 жыл бұрын

@7:40-8:00 just realized I am watching an education video for the IMF

@4211video 10 жыл бұрын

Drew Pickles!

@mathieuclement8011 6 жыл бұрын

"If you are not attending to something, you cannot perceive it." I really have doubts about that. Why would you pay attention to something, if you didn't perceive it first? For example, a jet fighter flies above you, first you hear it, and then you pay attention to the sound, maybe raise your eyes and start looking for it.

@nickmisner65 5 жыл бұрын

I think the intention is more that you cannot tell me anything about that jet fighter without attending it. It is less that you are unaware of something: you know a person is there, or the jet is above, but more that you are unaware of the heading of the jet, what nation it is from, or whether it's actually a civilian craft. These details, including the heading, height, color, etc, are unknown to you without attempting to attend to the presence of a plane. Even if you're accustomed to judging planes by sound, you cannot hold a conversation and perceive those concepts without first stopping to focus on said plane. Just my two cents on a year old question

@anthonymaestas4863 4 жыл бұрын

there is something even simpler, have you say in a church and not remember a single thing that was said. have you driven somewhere and not realized how you drove there, not remember anything about the drive and wonder how you didnt wreck, its autopilot.

@MiaogisTeas 4 жыл бұрын

I have a question: How did he get his voice to sound like Tom Cruise sometimes?

@lockpickingparamedic2136 3 жыл бұрын

What's the name of "the Podcast"?

@FennecTECH 9 жыл бұрын

it took me about 2 seconds to notice the engine was gone but did anyone else notice the image on the tail changed a small bit?

@Imtotallydiggingthis 5 жыл бұрын

I noticed the image on the tail first and stopped looking so I didn't even notice the engine being gone until he dropped the hint.

@quantametric 5 жыл бұрын

I noticed the man closest to the shots bag changing constantly

@gardenzombie 9 жыл бұрын

Maybe somebody should teach these guys computer engineering...

@Wili0gui 8 жыл бұрын

gardenzombie you kidding? @defcon

@minnermin 5 жыл бұрын

C'est la vie

@DavidDouglasJr 9 жыл бұрын

@11:23 just realized this talk has some connection to that NLP/The Game shit

@In_swedish_the_jam_means_sylt 9 ай бұрын

learn how to use projectors in the hackerspace and be set for life

@zwhitchcox 5 жыл бұрын

what is the name of the speaker?

@4otko999 2 жыл бұрын

Apollo Robbins it seems

@13n1304 7 жыл бұрын

The moment the stole the things from the random guys lol wtf

@mariarahelvarnhagen2729 9 ай бұрын

last majordomo

@FacePalmProduxtnsFPP 6 жыл бұрын

What's great is that I work Security.. and yeah, my trainer's name was Frank... XD

@shoebert31 7 жыл бұрын

This guy sounds like Tom Cruise

@RichardDeVere 10 жыл бұрын

Hmmmm all seems very theatrical to me

@CameronHeard 10 жыл бұрын

Theoretical you say? Kevin Mitnick.

@RichardDeVere 10 жыл бұрын

Yes that too! As a working/employed Social Engineer I just find this all very far fetched, this isn't a stage show after all. If I was a security guard watching all this carry on I'd just say "right all you knobheads stay there, someone's having us for a laugh"

@CameronHeard 10 жыл бұрын

I could see some of this done over the phone, or going on under a hi-jacked email server. But not face to face

@RichardDeVere 10 жыл бұрын

Just hold a coffee cup it will be ok...

@CameronHeard 10 жыл бұрын

Oh bby

@HackersOnBoard 4 жыл бұрын

Hello dear friends The 2nd December 2019 we get notified of the censorship of our channel by the new KZfaq Guidelines (who change every 6 months) because of "Content reusing without including substantial original commentary or educational value" so in consequence the Monetization of our channel was disabled. This is a little bit tricky because these Guidelines wasn't there in 2013, 2014, 2015 and so on... It is abnormal to change the rules during a game ...even more before Christmas! Since 2013 we are trying to share the best Security Conference on our channel and we need your help to keep it up. As you already know I was fighting the disease since the last 2 years and it's difficult and without resource and support I wouldn't be able to keep up on this way. You can support us on Patreon if you find our work valuable. You can also express your dissatisfaction regarding our situation to KZfaq on Twitter, Facebook, Instagram and wherever you can. to help us regain our rights. Your support in anyway will be truly appreciated Thanks guys for taking time reading me and stay tuned! Merry Christmas to you all and God bless you all! www.patreon.com/HackersOnBoard Bitcoin Wallet: 1NWM4upgKj8iF7zknzmnHG8Mm2pvAyTHqc

@WrknOnLvnTheLvn 4 жыл бұрын

What happened?

@WrknOnLvnTheLvn 4 жыл бұрын

I don't mind patreon and I can support you, who submitted the claim? What was censored?

@HackersOnBoard 4 жыл бұрын

@@WrknOnLvnTheLvn We get notified of the censorship of our channel by the new KZfaq Guidelines (who change every 6 months) because of "Content reusing without including substantial original commentary or educational value" "Who submitted the claim?" -Nobody, there is no claim on our account. "What was censored? " -The monetization of our channel was disabled for the reason I described. I updated the first post, same here: kzfaq.infocommunity?view_as=subscriber

@saraessex8124 2 жыл бұрын

Apollo? Huh....

@adnanarnautovic3541 4 жыл бұрын

1:45 such a bad joke hahahahah, so not suitable for that situation.

@I_leave_mean_comments 7 жыл бұрын

Holy shit, that movie was HORRIBLE. I'm actually surprised how bad it was. Jesus Christ. Wow.

@SpaghettiEnterprises 5 жыл бұрын

The guy at the beginning sounds like Trump

@billygowhoop 7 жыл бұрын

Apollo's one of those dudes who Id imagine could talk the pants off of any woman

@ElRabos17 3 жыл бұрын

im dumb and i don't know how to speak your language

@Adhil_parammel 4 ай бұрын

27:20

@populartechnology 10 жыл бұрын

As soon as I saw the ridiculous over-acted and over-produced con video he made I knew he had to have something to do with the idiotic Leverage show. Yep, IMDB confirms he is a consultant. Leverage is a heist show for people who think they are smarter than they are, just like Robbins.

@RobertMorgan 6 жыл бұрын

Funny thing, that's what you always seem to hear from people who get pickpocketed or robbed without even knowing it, "How can this happen to ME?! I'm too smart for THAT!"

@mathieuclement8011 6 жыл бұрын

True, especially with the locking door.

@evka85 8 жыл бұрын

great talk! (except the fact that the guy with the strange voice was so annoying)

@MiaogisTeas 4 жыл бұрын

Oh, what a coincidence - my wife specializes in psychological manipulation, too! 🤔

@shawn_li 6 жыл бұрын

teach me how to get girls

@asdfghyter 5 жыл бұрын

First you distract them and then, when they're not looking, you steal their heart. It's as simple as that.

@daveb5041 6 жыл бұрын

Its called bullshitting. Social engineering is such an asbergers way of putting it.

@daveb5041 6 жыл бұрын

What are you contributing what with your comment; a comment that is devoid of all intellect and full of insults mind you. I'm the guy that would steal your girl friend but leave her hanging because shes too ugly and has lowered her standards to the like of you.

@TheEnmineer 5 жыл бұрын

You're the guy who leaves a reply on his own comment, and fights with himself.

@exchange4918 2 жыл бұрын

Really cheesy example

@daveb5041 6 жыл бұрын

Bullshitting is an art form not something you can read and book and get good at. If you have a hard time getting girls to go out with you , you a probably not going to be good at bullshitting. I ca learn everything abut you without asking you a single question about you. You just get people to make assumptions of what you know. People often ask me "How did you know that?" My response is always "You just told me." If you are reading this look at your posture right now. If you are slumped you are a potential target. Can you figure out why?

@Solarcrest95 6 жыл бұрын

Kelvin Klopper because OP literally bullshitted you with that spiel...that's why

@daveb5041 6 жыл бұрын

Its because sub consciously we see bad posture as weakness and not the alpha in the group. It shows that you are unsure of yourself and open an opportunity for someone to take over. ALL of our emotions trace back to survival methods from caveman days.

@JordanShackelford 7 жыл бұрын

This is bs

@jordanbarrett7754 7 жыл бұрын

Jordan Shackelford social engineering is a genuine technique and is proven to work

@esc0rtd3w 7 жыл бұрын

You are a moron

@asdfghyter 5 жыл бұрын

Oh, everyone, look here. A dream target for a con-man. Your confidence in that this is bs and that you wouldn't fall for it is exactly what a confidence artist wants, hence the name.