Hacking Minds not machines: How meetings not malware can compromise your controls

Hacking Minds not machines: How meetings not malware can compromise your controls

Speakers: Georgia Turnham

Conference: CrikeyCon

YouTube: https://www.youtube.com/watch?v=oa0QFp_CMN4

Overview

In the contemporary cybersecurity landscape, while much attention is often directed towards sophisticated technical exploits and malware, the human element remains a primary and often overlooked vulnerability. Georgia Turnham's CrikeyCon talk, "Hacking Minds not machines: How meetings not malware can compromise your controls," meticulously dissects the enduring power of social engineering. This discipline, rooted in psychological manipulation rather than technical prowess, exploits inherent human biases, trust, and social norms to bypass even the most advanced technological defenses. Turnham argues that the modern hacker is less likely to be a shadowy figure in a dimly lit room and more likely to be a personable individual adept at crafting believable narratives.

Turnham, a seasoned professional in the security domain, illuminates how social engineering consistently accounts for a significant percentage of data breaches, making it a critical area for both offensive and defensive strategies. Her presentation is a compelling call to action for organizations to shift their focus from purely technical safeguards to comprehensive human-centric defenses. By exploring historical precedents, psychological triggers, and practical attack vectors, the talk underscores the urgent need for robust security awareness, actionable policies, and continuous real-world testing to fortify the human firewall against increasingly sophisticated manipulative tactics.

The core message is clear: understanding and mitigating social engineering is not merely about implementing new tools, but about cultivating a pervasive culture of critical thinking and skepticism within an organization. Turnham emphasizes that seemingly innocuous details, when meticulously collected and weaponized through Open-Source Intelligence (OSINT), can be transformed into potent precision tools for attackers. This talk serves as an essential guide for security professionals, employees, and leadership alike, demonstrating how the subtle art of human manipulation can lead to profound security compromises, and more importantly, how to build resilience against them.

Background

▶ Watch: Introduction and social engineering definition (0:00)

Social engineering is not a novel concept; its roots stretch back through history, predating modern technology by millennia. Turnham illustrates this with a biblical example, recounting how Jacob exploited his father Isaac's poor eyesight and reliance on other senses by wearing goat skins to impersonate his hairier brother Esau, thereby securing a blessing intended for the elder sibling. This ancient tale perfectly encapsulates the essence of social engineering: influencing a person to take an action that may or may not be in their best interest, primarily through manipulation and the exploitation of trust rather than technical vulnerabilities.

The discipline fundamentally leverages human biases, age, and gender norms, among other factors, to encourage individuals to act without critical thought. Turnham provides a stark example, presenting a scenario where a social engineering team, comprising individuals of varying demographics, needs to gain entry into a building under different pretexts. The selection of a 27-year-old Latino male or a 40-year-old white blonde male for a janitor pretext, or a 43-year-old Asian female for a catering role, highlights how attackers exploit societal stereotypes to enhance the believability of their cover stories. This strategic alignment with perceived norms minimizes suspicion, allowing the social engineer to operate unchallenged.

In the contemporary context, social engineering remains an alarmingly prevalent attack vector. It consistently accounts for a significant portion of data breaches, demonstrating its effectiveness against even organizations with advanced technical controls. At the heart of virtually every successful social engineering engagement lies Open-Source Intelligence (OSINT). This critical foundation involves the systematic collection and analysis of publicly available data from diverse sources, including social media platforms, professional networks like LinkedIn, public records, and online forums. OSINT transforms these seemingly innocuous digital breadcrumbs into a comprehensive mosaic of an individual's or organization's characteristics, relationships, and potential vulnerabilities. Attackers skilled in OSINT can craft highly personalized, compelling, and credible narratives that bypass traditional human and technological defenses, exploiting psychological triggers such as trust, urgency, authority, and familiarity to manipulate targets into revealing sensitive information or taking detrimental actions.

Key Findings

▶ Watch: Google Dorking: A powerful OSINT tool (8:40)

Turnham's talk reveals several critical insights into the methodology and impact of social engineering, emphasizing its human-centric nature. The core finding is that social engineering thrives on the exploitation of inherent psychological triggers and biases, making human beings the most susceptible link in the security chain.

Firstly, OSINT is the indispensable foundation for any successful social engineering campaign. It provides a "real and visible depth" into a target's life, preferences, skills, and social circles. This granular information allows attackers to develop "curated and clean avenues of entry" into environments they might otherwise struggle to access. The speaker highlights the vastness of potential OSINT sources, noting that while Google indexes billions of webpages, this represents less than 5% of the entire internet, implying an even larger untapped reservoir of information.

A significant discovery presented is the power of Google Dorking as an OSINT tool. Turnham demonstrates how specific search queries, or "Google Dorks," can narrow down results to uncover improperly handled internal documents. For instance, combining parameters like intitle:confidential, site:target.com, and filetype:pdf can reveal sensitive PDFs marked confidential that were inadvertently exposed on a target's public website. This technique led to the discovery of a "strictly confidential" internal human resources document, providing deep insight into company expectations, ways of working, internal contact numbers, and even direct links to login pages for internal systems like SharePoint.

Further extending the intelligence gathering, Turnham illustrates the utility of EXIF data extraction. By running the discovered internal documents through an "XF tool," she was able to glean metadata such as the author's name, the document's annual review cycle, and crucially, the devices and operating systems used (specifically, Dell and Windows). These seemingly small details are pivotal, as they enable the social engineer to craft highly specific and believable pretexts. The speaker demonstrates this by outlining a spearphishing campaign where an attacker, armed with this knowledge, could impersonate a colleague, reference an upcoming annual review, and attach a malicious payload, all within a contextually relevant and highly convincing message.

The talk also underscores the prevalence and sophistication of pretexting, which the speaker describes as "perhaps the most intellectually sophisticated" social engineering technique. Citing the Verizon Data Breach Investigations Report (DBIR), Turnham notes that pretexting, particularly via email (phishing), remains a leading cause of cybersecurity incidents. This technique involves creating elaborate, credible personas and scenarios, often requiring weeks or months of OSINT-derived backstory development to withstand rigorous scrutiny.

Finally, Turnham identifies several other potent social engineering techniques:

• "Ishings": encompassing phishing (email), smishing (SMS), vishing (voice), and notably, quishing (QR code phishing). Quishing, in a post-COVID world, leverages the public's ingrained trust and convenience-driven interaction with QR codes, exploiting the lack of transparency regarding where a scan might lead.
• Baiting: A more tactile approach exploiting human desires for gain and curiosity, often involving seemingly innocuous objects like USB drives left in public areas or enticing online offers.
• Tailgating: Exploiting deeply ingrained social norms of politeness and helpfulness to gain unauthorized physical access. The speaker references Kevin Mitnick's famous RSA Security breach and provides a vivid hypothetical example involving carrying a large box of KFC to elicit help from an employee, demonstrating how social awkwardness can be weaponized.

These findings collectively highlight that the "devil is in the details" for both attackers and defenders. Attackers meticulously collect and synthesize minute data points, while defenders must learn to recognize the significance of these details and implement multi-layered defenses that account for human psychology.

Technical Deep Dive

▶ Watch: Practical tailgating example: The KFC box (21:20)

While the core of Turnham's presentation focuses on the human element of social engineering, she details several technical methodologies and tools that are indispensable for effective execution, primarily revolving around Open-Source Intelligence (OSINT). OSINT serves as the bedrock, providing the granular data necessary to craft believable pretexts and targeted attacks.

One of the primary technical tools discussed is Google Dorking, a technique that leverages advanced search operators to uncover information that is publicly indexed but not readily apparent through standard searches. Turnham explains that Google acts as a vast database of websites, and by using specific search queries, known as "Google Dorks," attackers can refine results to match niche requirements. She provides a concrete example:

intitle:confidential site:target.com filetype:pdf

Breaking this down:

• intitle:confidential: This operator restricts search results to documents where the word "confidential" appears in the title.
• site:target.com: This operator limits the search to a specific domain, ensuring that results are directly related to the target organization.
• filetype:pdf: This operator specifies that only PDF documents should be returned, often a common format for internal policies, reports, or sensitive documents.

Turnham recounts a real-world scenario where this dorking technique successfully uncovered a "strictly confidential" internal human resources document. This document, inadvertently exposed, provided critical intelligence, including insights into company policies, internal contact numbers, and crucially, direct links to login pages for internal systems like SharePoint. This exemplifies how seemingly simple search techniques can yield high-value targets and pathways for further exploitation.

Another key technical method highlighted is the extraction of EXIF data (Exchangeable Image File Format data). While EXIF data is commonly associated with images, similar metadata can be embedded in various file types, including PDFs and other documents. Turnham explains using an "XF tool" (a common utility for this is ExifTool) to analyze the metadata of the discovered confidential documents. This analysis revealed:

• Author's Name: Identifying the creator of the document.
• Document Review Cycle: Understanding the frequency of policy updates (e.g., "annual").
• Devices and Operating Systems in Use: For example, the analysis of four documents consistently showed "Dell and Windows" as the devices and operating systems.

This metadata, though subtle, is highly valuable. Knowing the author's name allows for more convincing impersonation in spearphishing attempts. Understanding the review cycle enables attackers to time their phishing campaigns to coincide with legitimate corporate activities, such as annual policy approvals. Identifying specific hardware (Dell) and software (Windows) provides insights into the target's IT environment, which could inform the selection of specific exploits if the social engineering leads to a technical compromise, or simply enhance the credibility of a pretext involving IT support.

The talk also briefly mentions other technical OSINT tools, acknowledging that while the focus is on human aspects, these tools are vital for reconnaissance:

• Recon-ng: A full-featured reconnaissance framework designed for web-based open-source reconnaissance.
• Maltego: A graphical link analysis tool used for gathering and connecting information for forensic analysis, data mining, and intelligence gathering.
• SpiderFoot: An open-source intelligence automation tool that integrates with a vast array of data sources to automate the collection of intelligence about a target.
• Wel: A tool name that the speaker admits to having "butchered the saying," indicating a potentially specialized or less common OSINT tool.

These tools, combined with human ingenuity, enable social engineers to move from broad information gathering to highly targeted, contextually relevant attacks, blurring the lines between technical and human exploitation. The ultimate goal is to arm the social engineer with enough verifiable detail to craft a narrative so compelling that the target acts "without thinking," bypassing both technological and human critical defenses.

Demo / Proof of Concept

▶ Watch: Developing actionable and realistic security policies (26:40)

While Georgia Turnham's talk did not feature a live, interactive technical demonstration in the traditional sense, she provided several vivid, practical examples and hypothetical scenarios that served as compelling proofs of concept for the social engineering techniques discussed. These illustrative "demos" underscored the effectiveness of her methods and the profound impact of exploiting human psychology.

The first significant demonstration involved Google Dorking as an OSINT technique. Turnham described a specific instance where she used the dork intitle:confidential site:target.com filetype:pdf to target an organization. This query successfully uncovered several internal documents, including one marked "strictly confidential." This document, an internal human resources policy, was inadvertently exposed on the company's public website. The speaker detailed how this discovery provided invaluable intelligence:

• Internal Expectations and Workflows: Insights into how the company operated and what was expected of employees.
• SharePoint Login Links: Direct URLs to internal login pages, highlighting a critical security control weakness.
• Internal Contact Numbers and Names: A list of personnel, which could be used for direct targeting or establishing credibility.

Building on this, Turnham outlined a spearphishing campaign that leveraged the intelligence gathered. After running the discovered documents through an "XF tool" (an EXIF data extraction tool), she identified the author, the annual review cycle, and the common operating systems and devices (Dell and Windows) used within the organization. With this precise information, she crafted a highly believable email pretext:

• Targeted Recipient: An employee responsible for final document approvals.
• Personalized Greeting: "Hey, Sam."
• Contextual Relevance: Referencing the annual review cycle, even if ahead of schedule, using the knowledge of the review process.
• Urgency/Helpfulness Appeal: "I know I'm ahead of our annual review cycle... but I've gone ahead and beaten the buzzer. would you please open this and cast your eye over it so we can get ahead of the game and you aren't bombarded all at once with policies to approve."
• Malicious Payload: An attached file containing a payload, made more likely to be opened due to the credible pretext.

This scenario vividly demonstrated how OSINT-derived details, no matter how small, can be synthesized to create an irresistible lure that bypasses typical security awareness training by triggering an automatic trust response.

Finally, Turnham presented a highly engaging and memorable "demo" of tailgating, drawing on her personal experience and understanding of social norms. She described a hypothetical scenario where, as a "youngish female," she could easily gain physical access to a secured building:

• The Prop: A large box of KFC, making it appear that she was struggling with a heavy load.
• The Scenario: Approaching a security door, feigning difficulty in holding the door open and reaching for her swipe pass simultaneously.
• The Appeal to Helpfulness: Relying on the natural human inclination to assist someone in apparent genuine need, especially when facing a "social awkwardness" situation.
• The Pretext: Briefly explaining, "I've got a shitload of KFC here for the team, but I'm just carrying it all, and I can't reach my pass. It's in my back pocket."
• The Outcome: A legitimate staff member not only holds the door but also swipes her up to any requested floor, completely bypassing security without a second glance.

This "KFC tailgating" example powerfully illustrated how social engineers weaponize politeness, empathy, and social norms to circumvent physical security controls, proving that the most sophisticated technical defenses are moot if the human element is compromised. These demonstrations, though illustrative, effectively conveyed the practical application and significant threat posed by social engineering.

Defensive Implications

▶ Watch: Conclusion: Critical thinking and security culture (33:00)

Turnham's presentation culminates in a comprehensive framework for defending against social engineering attacks, encapsulated in the "MAP" (Mitigation and Prevention Plan) model, attributed to social engineering expert Christopher Hadnagy. This map outlines four critical, interconnected steps for building a resilient workforce and organization.

1. Learn How to Identify Social Engineering Attacks: The foundational step involves educating employees on what social engineering is, what various attack types look like, and their key characteristics. This isn't about turning everyone into a cybersecurity expert, but about equipping staff with sufficient knowledge to recognize and respond to threats. Effective training methods include:

• Gamified Learning: Making security awareness engaging and interactive.
• Clear Policies and Procedures: Providing accessible guidelines.
• Awareness Campaigns: Continuous reinforcement of security principles.
• Real-World Incident Lessons: Applying insights from past breaches to prevent future occurrences, fostering a proactive rather than reactive stance.

Crucially, employees must understand the inherent value of their information (emails, phone numbers) and the potential consequences of seemingly harmless actions, such as holding a door open for someone without proper verification.

1. Develop Actionable and Realistic Policies: Policies are often perceived as restrictive and unappealing, but Turnham argues they can be transformed into effective behavioral guides. The key is to make them clear, actionable, and realistic, removing ambiguity and the need for subjective decision-making. Policies should:

• Take the Thinking Out: Eliminate scenarios where employees must make complex judgments, especially under pressure or emotional influence.
• Remove Emotional Bypass: Design policies that prevent empathy or politeness from overriding security protocols.
• Provide Insight into "Why": Explain the rationale behind a policy to foster understanding and buy-in, transforming it into a "consistent reaction for staff that then helps them react with muscle memory."

A strong example provided is: "All IDs must be checked to prevent unauthorized people from bypassing authentication and access controls and then accessing company and customer information." This policy explicitly states the action, the consequence of non-compliance, and the ultimate objective, making it robust against emotional appeals (like the KFC tailgating scenario).

1. Perform Real-World Checkups: Beyond traditional phishing campaigns, organizations must engage in comprehensive, real-world testing of their defenses. This involves hiring third parties to conduct exercises that simulate various social engineering attacks, going beyond just email-based threats. Recommended checkups include:

• Simulated Physical Intrusions: Testing physical access controls and employee responses to tailgating or impersonation attempts.
• Vishing and Smishing Campaigns: Assessing employee vigilance against phone-based and SMS-based social engineering.
• QR Code Phishing (Quishing) Tests: Evaluating awareness of malicious QR codes.

These exercises should have clearly defined rules, requirements, and objectives to accurately assess employee awareness and the effectiveness of existing policies and training.

1. Implement Applicable Security Awareness Programs and Campaigns: This final step involves continuously refining and augmenting existing awareness programs with new components tailored to an organization's unique needs and evolving threat landscape. It's not about a "set and forget" approach but rather an ongoing commitment to education.

• Focus on Gaps: If phishing awareness is strong, prioritize developing defenses against less-covered vectors like vishing or quishing.
• "What to Do When Something Bad Happens": Programs should not only teach what not to do but also provide clear protocols for reporting and responding to incidents.
• Engaging and Dynamic Delivery: Utilize methods like lunch-and-learns, simulations, or "choose your own adventure" scenarios to immerse employees in the learning process.
• Executive Support and Positive Reinforcement: Crucially, security awareness must be backed by tangible, high-visibility executive support and foster a positive culture of security, encouraging questions and skepticism rather than fear.

Turnham emphasizes that these four steps must be applied together, in "strong symphony," and continually updated, much like technical controls. Learning from both internal mistakes and the experiences of peers is vital for proactive safeguarding. Ultimately, the goal is to transform employees into the organization's "first line of security" by fostering a culture of critical thinking and vigilance.

Key Takeaways

• Social Engineering is Trust Exploitation, Not Technical Hacking: The core of social engineering lies in manipulating human psychology, biases, and trust, rather than exploiting technical vulnerabilities. It is a discipline of human hacking, requiring personable skills and an understanding of social dynamics.
• OSINT is the Indispensable Foundation: Open-Source Intelligence (OSINT) is critical for gathering minute details from public sources, enabling attackers to craft highly personalized, believable narratives and pretexts that bypass traditional defenses.
• Small Digital Breadcrumbs Yield Significant Intelligence: Techniques like Google Dorking can expose inadvertently public internal documents, and EXIF data extraction can reveal critical metadata (authors, devices, OS) that fuels targeted spearphishing campaigns.
• Human Psychology is the Primary Attack Vector: Social engineers weaponize inherent human traits such as politeness, helpfulness, curiosity, and the desire for convenience (e.g., QR codes) to manipulate individuals into actions against their best interest.
• A Robust "MAP" (Mitigation and Prevention Plan) is Essential for Defense: Organizations must implement a comprehensive four-step plan: identifying social engineering attacks, developing actionable policies, performing real-world checkups (beyond just phishing), and implementing applicable, evolving security awareness programs.
• Security Awareness Must Be Continuous, Engaging, and Executive-Backed: Effective defense requires fostering a pervasive culture of security awareness through engaging training, clear policies, learning from incidents, and consistent, visible support from leadership. It is not a one-time activity but an ongoing organizational mindset.

About the Speaker(s)

Georgia Turnham is a security professional with a deep understanding of social engineering techniques and their impact on organizational security. Her expertise lies in dissecting human-centric attack vectors and developing comprehensive defense strategies. Through her presentations, Turnham educates audiences on the subtle yet powerful methods used by social engineers, advocating for a shift towards more robust, human-focused security awareness and policy implementation. She demonstrates a practical grasp of both the offensive and defensive aspects of social engineering, making her insights highly valuable for mitigating these prevalent threats.