Social Engineering 101

0:00Being a serious business owner takes hard work, patience, and a drive to keep moving forward. So it's important to find a serious business card that goes the extra mile. With the VentureX Business Card from Capital One, you earn unlimited double miles on every purchase. And with big purchasing power, you can spend more and earn more. This is your sign to take your business to the next level. The Capital One VentureX Business Card. What's in your wallet? Terms apply. See CapitalOne.com for details. Your daily supplement routine doesn't need to be managing a handful of different bottles. Onnit's Total Human brings key research-based vitamins, minerals, herbs, and amino acids together in convenient day and night packs, one all-in-one product designed to make supplementation easier.

0:45The day pack supports cognition, focus, and cellular energy production. At night, the night pack helps you wind down and supports a calm, relaxed state. Less time managing your supplements, more support for your day and night. Shop Total Human now at onnit.com. Mod.com is changing the way people battle excessive fatigue. Ever hit a wall in the middle of the day and a third coffee just doesn't do it anymore? Here's what's actually happening. Coffee only briefly blocks adenosine, the chemical that tires you out. When it stops working, your system is flooded and you crash. Modafinil is a prescription treatment that works in a completely different way.

1:28Modafinil works by stimulating multiple receptors in the brain associated with wakefulness, including dopamine, serotonin, norepinephrine, histamine, glutamate, and orexin. It's a more complete solution that gives you 10 to 12 hours of steady focus and energy. To learn more, go to mod.com. Fill out your intake form, meet with a licensed provider, and if approved, ModAlert ships straight to your door. Go to mod.com to get started. That's M-O-D dot com. Losing weight can feel like a roller coaster, full of ups, downs, and being thrown for loops, like when someone brings donuts into the office or your kids' dino nuggets start giving you that look again.

2:14That's why there's Noom. They combine GLP-1s to quiet the food noise with healthy habits that help you keep it quiet, even if you get off the meds. Their program is designed to make weight loss a smooth ride, helping you understand what drives you, so you can build better habits to not just lose weight, but keep it off. Noom. Lose for keeps. Get started at Noom.com. Not all customers will clinically qualify for medications. Individual results may vary.

2:52Welcome to a special DTNS weekend edition gratefully provided to you and thanks for your support of this show and it's Cybersecurity Awareness Month in October. Yeah, I know it's also spooky month, but there ain't nothing spookier than getting hacked. And so we are kicking off a three-part series over the course of these next couple of weekends with Mr. Brian Brushwood. uh uh how do you want to be presented in this light brian i'll tell you what i've put together a public facing a lot of folks know that brian is involved with tricky deceptions that kind of stuff but if you want to show something to your boss you probably don't want to show me and justin on great night you probably don't want to show them teaching how to win free drinks at the bar on scam school just send them on over to scampocalypse.com how about that yeah and you've been doing something where you're training folks on security in an interesting and very important way.

3:48And that's kind of what we're going to be talking about over these next three episodes. We're going to talk about your wolf masking stuff. We'll get to that. We are going to talk about the changing world next week. But this week, we kind of want to give everybody a basis in social engineering. What is social engineering and what has worked to hack you with it up until now? Yeah. And this will make sense to a certain subset of audiences and everybody kind of comes to similar intuitive understandings through different things. If you work in marketing, you'll understand that a strong marketing message is more likely to cause a human to hit that buy button.

4:29If you work in magic like I do, you know that a superior narrative story will do better at distracting people from noticing the mechanical aspects of a magic trick. And in cybersecurity, superior social engineering techniques are what get people to grant what seems like a smaller, innocuous favor inside of the organization that gives them outsized access and allows you to steal all the money, do all the bad things. Sometimes I think social engineering is bad because it sounds like something you can easily resist when the whole point of social engineering is to get past your ability to resist it.

5:04Well, and keep in mind, social engineering, we're talking about, for example, Nobel Economics Award winner Richard Thaler's work with the nudge unit. A small opt-in versus opt-out design nudge has meant, has saved countless lives when it comes to organ donation. Countries that the default status is you're going to donate your organs unless you say otherwise, those people, a lot of people are able to live many, many more years because of it. So social engineering is quite simply, if we're going to be kind of mechanical about it, it's a little bit like thinking of humans as little wetware LLMs that are not, they're complex systems, but largely nudgeable and largely, I don't want to say predictable, But certain actions will produce reproducible actions in other humans.

5:54Yeah, yeah. I think when the vast populace thinks of security, they think of malware that is creeping into their machines somehow or maybe clicking on a link, which is the barest form of social engineering. Give us some examples of what we mean when we're talking about social engineering and why it isn't something your antivirus or your firewall can take care of. Well, so we're going to couch this entirely in, let's say, pre-2010s days, right? I would say that the difference between an injection attack or a software attack would be simply one set of software trying to brute force its way to guess the right password to get around.

6:35Whereas a social engineering hack, the canonical example that we love to point to is Kevin Mitnick wrote a computer virus. And to get it inside of a system, that would require a lot of brute force to walk your way past security, stick something into a computer or whatever. But if ultimately you just want somebody to hit go on an executable, it's much better to use seductive reasoning. So in this case, he just put it on a floppy disk and labeled it salaries.xls. And then when somebody put it in, they hit an EXE and it got inside the system. That is pure social engineering. It is setting up incentives so that a complex system, a human, does their own thinking through the calculus and then makes the decision to whether it's clicking the hyperlink or clicking go on the executable.

7:24At some point, what you need is to produce an action from another human. And again, in magic, we see it because we need them to pick the right card, not just any card. We need them to pick the right card and we need them to think it was their idea. That's exactly how big Ponzi schemes work and, and, and, and, and. Yeah, yeah. So if you're out there thinking like, okay, when someone comes at me to social engineer, I'll be ready. The point is you won't. What are the back doors? What are the ways they get around your even awareness that social engineering could happen? Well, just to catch everybody up, if you haven't read it, Nobel Award winner Daniel Kahneman wrote a book called Thinking Fast and Slow.

8:07And he talks about the difference between your system two brain and your system one brain. System one thinking is your kind of thoughtless gut reactions. And the example that he gives is a standard question is a bat and a ball cost a dollar and 10 cents. How much more was the bat than the ball or the bat is a dollar more than the ball? How much was each? And your gut reaction, the first thing you want to say is, okay, a dollar difference, it's$1.10, 10 cents and a dollar more. That would add up to$1.20. So now that went from the initial system one reaction to now we're burning the calories doing the cognitive work to realize, oh, wait, the only way to get to$1.10 is it would have to be five cents plus$1.05.

8:53sense. Okay, I got there. So you notice those two moments really engage two different types of thinking. One was purely connective. You have a data set. Your gut just wanted to blurt out. Numbers line up. But of course, then you think it through and numbers don't line up. So in this case, once you know that there's kind of two different modes of thinking, one thing that you hear from everybody who ever got scammed after the fact, they all say the same magic phrase. I knew it. Every single person is able to point to all of the signs beforehand that should have let them see it coming a mile away.

9:29But oftentimes, it's the rationalization after the fact that gets us in trouble. Gavin DeBecker, in his book, The Gift of Fear, says we love to make fun of system one because we're able to fool it with word puzzles like the bat and the ball example. But humans conquered the planet and we did it despite the fact that we don't have scales or fangs or claws. we got one thing, the world's most finely honed system one intuition, the most finely honed sense of when something just isn't right. So as a result, when somebody does get scammed, oftentimes there's a bunch of tricks, social engineering tricks that have been used to disable a lot of your critical thinking cognition.

10:10Maybe they're using the trappings of authority. You're scared because you think it's an FBI officer who's calling and making these demands. Maybe they're using this emotional pull. You think that you're about to win the lottery and your life is about to change. Maybe it's a deadline. All of these are levers that change the calculus. So they rob you of all of your critical thinking cognition. They rob you of the ability to ask other people to check in, to distance yourself from the moment. And as a result, when you go for it, You go for it only using your system one thinking. And so my job is to teach you guys how to build the habits so that your system one has a louder voice to pipe up when something just isn't right.

10:56Now, in future episodes, we're going to talk a little bit about how this has changed from where it has been. But I think most DT &S listeners are probably aware of social engineering. in defense of the old social engineering, which still happens from time to time. What can you tell folks like up until now, it was good enough to do this? Episode prep gets messy when research, Slack threads and script trackers are all in different places. That's where ChatGPT work comes in. Give it the goal and connect to the tools where work happens, like apps and files, and it can help pull the pieces into a draft you can review without you having to re-explain the project at every step.

11:40For example, ChatGPT work can gather team feedback from Slack and use it to suggest updates to a project brief in Google Docs. You stay in control reviewing the draft and deciding what moves forward. Put ChatGPT to work on your most ambitious ideas and projects. Get started at ChatGPT.com by selecting work mode. Available on Plus and Pro plans. Being a serious business owner takes hard work, patience, and a drive to keep moving forward. So it's important to find a serious business card that goes the extra mile. With the VentureX Business Card from Capital One, you earn unlimited double miles on every purchase.

12:19And with big purchasing power, you can spend more and earn more. This is your sign to take your business to the next level. The Capital One VentureX Business Card. What's in your wallet? Terms apply. See CapitalOne.com for details. This is the story of the one. As a shipping manager, he's running the dock, stocking supplies, and making sure every order goes out on time. And Grainger helps him stay prepared. From shipping supplies to PPE to hand tools, he counts on Grainger to keep products moving and trucks rolling. So his operation runs smoothly no matter the shift. Call 1-800-GRAINGER. Click grainger.com or just stop by.

12:57Grainger. For the ones who get it done. When demand slowed for HydroJug, Amazon Ads rising star Hayden Wadsworth pivoted. When our bank account hit near zero, my brother Jake and I had one last shot to save HydroJug. So we engineered the Traveler, a leak-proof, cup holder-friendly Tumblr. Amazon Ads enables a business to be able to expand their product shelf because of the visibility and the reach you can get. Each week, our new-to-brand customers make up about 95 % of all of our sales. Watch HydroJug's story at advertising.amazon.com slash rising-stars. Losing weight can feel like a roller coaster, full of ups, downs, and being thrown for loops, like when someone brings donuts into the office, or your kid's dino nuggets start giving you that look again.

13:44That's why there's Noom. They combine GLP-1s to quiet the food noise with healthy habits that help you keep it quiet, even if you get off the meds. Their program is designed to make weight loss a smooth ride, helping you understand what drives you, so you can build better habits to not just lose weight, but keep it off. Noom. Lose for keeps. Get started at Noom.com. Not all customers will clinically qualify for medications. Individual results may vary. well first of all let me enhance the importance on learning the old methods because we are and this is a little bit of futurism the kind of thing we normally reserve for our patron bonus uh corn killers talk but but uh it looks an awful lot like humanity is about to kind of break out in if not into multiple strata then at least into multiple modalities ways of being there'll be times that we're at our computers thinking computery thoughts, leaning on computers to do computery things, but then we'll go to a festival over the weekend or we're going to go someplace where essentially we're fully unplugged.

14:51And right now we exist in kind of a hybrid ability because we know to be on guard against all these things. But as we learn to trust external systems with robots, we're going to relax that trust and we're going to have weaker system one intuitions on here. So in many ways, we're kind of going back to the old fashioned days of the 1960s, where if you were a raconteur and you had an exceptional speaking presentation, you could swoop into a small town, dazzle everyone, collect a big paycheck and go on to the next. And it would evaporate like it never happened. We're kind of getting back to that now with the level of saturation of video content alone.

15:30We are so exponentially growing that it is easier to be forgotten than ever before. People are able to rehabilitate their reputations in ways that wouldn't have worked 10 years ago. Now you could just judiciously, you can use a fire hose to blast away things that you don't want on your permanent record. You could do takedowns. There are legal moves. So in many ways, what's old is new again. Whereas the scam artist 100 years ago could come in with what appeared to be a fancy suit, as long as you didn't notice all the cheap shoes and all of the trappings that we associate with 1950s con men. And he could snow people into making an emotional decision all at once.

16:13We're gonna start seeing more of that as the way we think transforms. Yeah, so this is basically getting us, here's where we've been, everybody. If somebody has been listening to this and they're saying, okay, I kind of get the system one, system two thing. I understand vaguely what social engineering is. What would you leave them with? What are the things they really need to know to be grounded in an understanding of social engineering? Okay, I'm going to reveal three very simple psychological backdoors that can be used from everything from getting out of a speeding ticket to get somebody to close the sale to get somebody to let you backstage at a concert.

16:50These are all situations where somebody has discretion and they're not so deeply invested in the interaction that they're using all of their high-minded cognition. They're not, their job isn't on the line for this stuff, right? So you get pulled over for a speeding ticket, maybe it's 510 over the speeding limit. And you know it's a small town and this is the 12th time the guy's done a day. the first psychological backdoor, these are called fixed action patterns by Robert Cialdini in his book Influence, which is fantastic. Fixed action pattern number one is liking. If you like somebody, you're more likely to grant them a favor.

17:27And when it comes to this, the old methods are the best. You can read how to win friends and influence people. You get some bromides like there's no sweeter sound than the sound of one's own name. So make sure to notice somebody's name and use it liberally, not in a disingenuous way, but in a sincere way that shows that you pay attention. Second of all, nobody hates being reminded, congratulations, it's your birthday. Now, that was cheapened for a little bit. For a while, Facebook made that a perfunctory button click. But of course, it's an arms race of displaying that you care about the other person.

18:00So about 10 years ago, instead of clicking that perfunctory button, I would notice somebody's birthday and I would sit down and budget five whole minutes to write a thoughtful letter about what I am thankful for in my relationship with that person. That creates a big emotional swell in somebody. You've given them a gift instead of asked for something. And so in this, when you do that, for example, in the case of a speeding ticket, you might get pulled over. In my experience, you don't want to cry because now you're making them do the moral calculus of, am I letting this person off because they're crying?

18:35I'm not allowed to do that. And as a matter of core identity, they will write the ticket and stoically deal with the fact that you're having a miserable day and crying. But meanwhile, they also don't want to let you dictate the stop. They're the police officer in charge. So instead, what you want to do is create a narrative wedge, an intrigue window. You want to create a second interaction layer to what's going. We all know what's going to happen. He's got to pull you over. He's got to tell you how long he's got to run your license and all that stuff. So the question is, is there going to be a second layer on top of that?

19:11Because that part is written in stone. If you can, you can maybe open the door to it. There's an intrigue window. For example, a lot of times when I get pulled over, as fast as I was able to say it, I'd say, I just got done doing a magic show. And then, of course, that's hard to walk past and act like that's not interesting at all. And oftentimes the questions would, as soon as they would ask, you ever see how so-and-so does the thing? Notice how the power dynamic has shifted. All of a sudden, I have something he wants. Now, we're not going to directly tie this to the ticket that he may or may not write, but all of a sudden, that dynamic changes, and we'll get into that in the second one.

19:50But in the meantime, I found that every time you get pulled over, you got about three minutes to make the cop laugh. There's never been a time I've been able to successfully make the cop laugh, and then he gave me a ticket. So instead, what I do is he'll ask for my license and I'll say, here's my license. I used to have a very goofy license photo that would make everyone smile. And then if they asked for insurance, I'd say, oh, officer, this is a rental. I don't have my insurance on me, but I'm told this will help. And I'll hand them a get out of jail free card from Monopoly, which will usually get a chuckle.

20:23My friend, Mike Super, he takes it as a point of pride. He's a touring stage illusionist. He has gotten pulled over so many times, he is not afraid at all of the interaction. All he cares about is getting another notch on his belt. So he has a full stand-up comedy routine. Before the cop can even talk, he'll say, officer, I am so sorry. I'm certain I was over the limit. We'll find out about that. But you've got to understand, sir, I had, there's a very good reason for all of this. My wife left me last year. And I'll be honest, sir, she left me for an officer of the law. And when I saw your car, when I saw the lights come on, when I saw you zooming up behind me, I was afraid you were bringing her back.

21:07So the whole point here is that they're doing the let's make you like each other sort of thing, right? Correct. Correct. And all of that should be calibrated to your confidence in doing that. And in case I would never do that with a cop, but he has done this so many times he wants to push it over the edge. But if you can get them this file, now you have leverage, which brings us to the second fixed action pattern, the second psychological backdoor that we can all take advantage of. Number two, reciprocation. Reciprocation says, there we go, that humans, boy, do we hate to be in debt to other humans.

21:43We want to settle the score no matter what in a good way. When somebody gives us something of value, they've earned real estate in our mind. And it makes us just a little bit uncomfortable. We don't feel right until we've given something back. The best example of this, again, this is from the book Influence, are the Hare Krishnas. They used to do a wonderful job at grabbing attention by beating on drums, playing music. As they went up and down the street, everybody looked, but nobody wrote them a check. Nobody gave them a dollar. until they figured out that they were legally allowed to go to public spaces like airports.

22:19And then they didn't try to get people to take a copy of their manifestos or what have you or ask for money. Instead, they just walked around saying, here's a flower. That's where that cliche, that moment from airplane comes from. They give the gift of a flower and then they would just wait a little bit. They'd talk and say, here's a flower so that you could think about how beautiful the world is. 1 ,000, 2 ,000, 3 ,000, would you like to donate a dollar to our cause? Humans on system one activity are deeply congruent creatures. It is very difficult to hold a gift, to say the words, thank you, and then say no when they ask if you would like to give a dollar to the cause.

23:00So instead, the easiest path, the one of least friction is to reach into your pocket, hand them a dollar. They hold on to the dollar. You throw the flower in the trash. They walk over to the trash, pick up the flower, go to the next guy and say, excuse me, here's a flower. This is being a serious business owner takes hard work, patience and a drive to keep moving forward. So it's important to find a serious business card that goes the extra mile with the Venture X business card from Capital One. You earn unlimited double miles on every purchase. And with big purchasing power, you can spend more and earn more.

23:36This is your sign to take your business to the next level. The Capital One VentureX Business Card. What's in your wallet? Terms apply. See CapitalOne.com for details. Meet Amazon Ads rising star Daryl Spencer, who set out to redefine men's self-care with his brand Crown Skin. Amazon Ads helped him grow. I walked away from big tech to build a luxury brand in a category that no one was paying attention to. With the help of Amazon Ads, I'm reaching relevant audiences and competing with the biggest names in men's grooming. We've scaled to over$500 ,000 in monthly revenue. Watch Crown Skin's story at advertising.amazon.com slash rising-stars.

24:18So I think one of the most interesting things about what you're talking about is when people think social engineering, they may jump to the conclusion of like, ah, they're gonna try to come at me. And both of these so far are like, no, these are things you don't immediately react negatively to. So it's good to be aware of. What's our third one? The third one is the supercharger. It's the one that short circuits a lot of your system to thinking. It is the trappings of authority. Study after story. Study after study shows that the trappings of authority have an outsized important pressure on your thinking process.

24:59When I do live shows, I'll make sure to casually at the beginning, flash to however many millions of subscribers are on this thing or that thing or whatever. Because later at this point in the talk, I reveal what a house of cards it is. I put on my business card, laurel wreaths next to what look like awards that may not be awards that are. I take quotes from Jay Leno that are implied that they're about me, but they don't necessarily need to be. All of these things establish authority tea. For example, right now, I'm on Daily Tech News show. We don't know if this is because Tom Merritt has a deep gambling debt that he's trying to make, right?

25:36All we know is that a trusted voice is on a trusted place speaking from authority, everything from my body posture to the casual practiced way that I'm not saying any ands. We both went and put on collared shirts specifically to have a little bit of the trappings of authority. Well, and studies show this. There There's one study at the University of Texas that found out that the trappings of authority could be as simple as a well-tailored suit. They got two people undercover under the A condition. They were dressed in plain wore clothes and the B condition. They had a fancy power suit. And then they just they wanted to know whether or not they could induce random citizens to commit a crime.

26:15And in this case, the crime was very simple. It was just jaywalking. But they had him cross the street and they wanted to count how many people would see somebody else follow. You've been in that situation, Tom, right, where you're kind of at the cusp. You're like, I don't want to go. But then somebody else goes and it kind of feels like it's fine. No, in fact, it's one of the most frustrating things about friends and family. And I'm not even thinking about any specific person when I say this is that I am aware of this. And so when everybody's like, oh, we should eat there. Or if I know a place is good and it's empty and like, well, I don't know.

26:50I'm like, this is just the trappings of authority. You're thinking because no one's there, it's not good, but it'll be busy later. Or I bet if we go in, it starts to get busy because everybody sees us in there sort of thing. Well, and in those moments, you know that what the party needs is somebody who knows for a fact that you're willing to be on the hook for the next hour and say, no, I'm making the call. We're going. And everybody will thank you for making a bold decision in that place. So understand that these impulses, this isn't broken wetware. These are just trappings and echoes of evolutionary pressures that was passed down through tribal generations.

27:26Yeah, we survived as a species because somebody with authority knew what they were doing and was like, don't go in that field. Go in that field. That one has berries. That one has a tiger. And we all live if we go to the berries. How well would society work if the inverse was true? What if we had a revulsion to authority? We can get anything done. Right. Well, this is fantastic. And I think really gives people a perspective, not only on how to be aware of these psychological backdoors in their own daily life, but also to remember that when social engineering is going to try to get you to do something, it may not look the way that you thought it would look.

28:05Well, if they're doing it right, you'll never notice it. Although that's a good exercise for the next week for everyone to do is whenever there's something that you might want to buy, when somebody is selling at you, when somebody is trying to hassle you to get something done, just notice those three psychological backdoors, whether or not they're looking for the liking, reciprocation or authority. Yeah. And in fact, it's one of the ways social media works. I'll just slip that one in under the door as well. Brian, this is fantastic. Next time, next week, we are going to talk about what's changing now.

28:37And while you need to be aware of all the stuff we talked about today, how the current technological landscape is changing the importance and the reactions that people need until that episode. if people want to follow up with you, find out more about what you've been doing in this space, where should they go? Yeah, just head on over. If you want to book me, I'm doing a lot of talks these days. If you want to try to wrangle me for an in-person event or live over Zoom, just head on over to scampocalypse.com or just write me directly, brian at schwood.com. That's B-R-I-A-N at S-H-W-O-O-D.com. Thank you, Brian Brushwood.

29:15We will talk to you again next week. Don't disappear between now and then. I was implying that I disappeared. Oh, right. But I didn't take you away. Okay. Look, uh, there. What? He's gone. Uh, thank you everybody for supporting the show at patreon.com slash DT and S have a wonderful weekend and I'll talk to you soon.

29:41The DT and S family of podcasts, helping each other understand. Diamond club hopes you have enjoyed this program.

29:53This episode is brought to you by Capital One. Capital One's tech team isn't just talking about multi-agentic AI. They already deployed one. It's called Chat Concierge and it's simplifying car shopping. Using self-reflection and layered reasoning with live API checks, it doesn't just help buyers find a car they love. It helps schedule a test drive, get pre-approved for financing, and estimate trade in value. Advanced, intuitive, and deployed. That's how they stack. That's technology at Capital One. Hi, this is Brooke DeVard from Naked Beauty. I am always looking for ways to elevate our daily rituals.

30:29And the Kohler Smart Toilet is proof that design changes everything. It's this stunning sculptural piece that feels like quiet luxury for your bathroom. It totally transforms your daily ritual into something elevated with customizable cleansing and touch screen controls. It's functional art that makes your space feel cleaner and more intentional. A modern home deserves a modern toilet. Experience the difference of Kohler smart toilets. Find more at Kohler.com.