Using The 36 Stratagems For Social Engineering

I attended several great presentations during last week's BSides and Defcon. HD's VxWorks, egyp7's phpterpreter, and David Kennedy's SET talks were a few of my favorites, with great content and demos, but one that I found especially refreshing and fun was Jayson Street's "Deceiving the Heavens to Cross the Sea: Using the 36 Stratagems for Social Engineering."Jayson started the talk with a demo stating he could guess what you ate for dinner by simply asking five questions. Instead of guessing what the volunteer ate, he social engineered her into answering three of the questions that led to the compromise of Sarah Palin's Yahoo e-mail account last year. It was a great demo and not unlike so many examples we see in daily life, such as drawings for free gym memberships and e-mail asking you to sign up for a webinar with the chance to win an iPad.

The talk went through some of the history surrounding the 36 stratagems, social engineering, and how social engineering techniques vary by the target's country. Jayson then dug into examples of how the stratagems can be applied to social engineering.

The first stratagem Jayson covered was "#3: Killing with a Borrowed Knife," or in other words, let the employee be the attack vector. Some of the examples included tailgating employees by inserting yourself between a man and woman, then holding the door open for the woman in order to tailgate right in after her. And then there's the poorly sanitized BreakMyNetworkDesign.com examples (need I say more?).

The second stratagem covered was "#13: Scheme with Beauties," during which Jayson covered using Facebook with an attractive profile picture to gain more information about a company by becoming a fan of the company and "friending" its employees. When it's time to communicate with the user via voice, he recommended the World of Warcraft USB headset with preconfigured voice changing capabilities -- his demo of the headset's usage was hilarious.

A few more stratagems were covered, and Jayson also showed off his "vest of doom" that he wears to penetration-testing engagements. It's filled with USB flash drives, USB hard drives, screwdrivers, USB wireless adapter, voice recorder, and much more. When the videos from Defcon are posted, I highly recommend you watch this particular talk, which contains good, practical advice for using social engineering in penetration testing.

You know where I'm going with this? That's right! If you're not doing social engineering during your penetration testing, then your clients aren't getting a true picture of their security posture and likely don't want you to do it because they know it's a common area of weakness. To illustrate my point, here's a story David Kennedy used in his Social Engineering Toolkit (SET) talk at BSidesLV. During his Notacon talk, he asked who was using SET. One person raised his hand and said he's not allowed to use it anymore at work. When Dave asked why, the audience member stated management was tired of a 100% success rate!

Also, Jayson was kind enough to donate copies of his book, "Dissecting the Hack: The F0rb1dd3n Network," to Hackers for Charity and the Electronic Frontier Foundation. Each copy was signed by many wonderful members of the infosec community, and I was the lucky winner of the Hackers for Charity copy. Thank you, HfC and Jayson.

John H. Sawyer is a senior security engineer on the IT Security Team at the University of Florida. The views and opinions expressed in this blog are his own and do not represent the views and opinions of the UF IT Security Team or the University of Florida. When John's not fighting flaming, malware-infested machines or performing autopsies on blitzed boxes, he can usually be found hanging with his family, bouncing a baby on one knee and balancing a laptop on the other. Special to Dark Reading.