Social Engineering

Accessibility Notice

This document is also available in HTML format at:

Link: https://aholdengouveia.name/InfoSec/labs/socialengineering.html

The HTML version provides enhanced accessibility features including keyboard navigation, screen reader support, responsive design, dark mode support, and high contrast options.

As we do these activities, remember these rules.

1. Don't make anyone feel victimized or targeted.
2. Treat information gathered in an ethical manner.
3. Don't break any laws.
4. Don't abuse this knowledge.

Learning Outcomes

By the end of this lab, you will be able to:

• Identify social engineering attacks and the human behaviors they exploit, using real examples
• Analyze body language and dominance in conversations you observe
• Recommend ways a person can protect themselves from social engineering

Lab Instructions

Part 1: Real-World Examples

Find and describe two real-world examples of social engineering attacks. Explain how each attack exploited human behavior to compromise security. Your examples can be from the news or something you saw in person. Recent attacks that used AI, such as deepfake video calls or tricking an AI support chatbot, are good choices.

For each example from the news, include your source with the following. My guide to evaluating sources, linked under Resources, shows how to do the CRAAP test, with a good and a bad example.

1. A citation, and a CRAAP test checklist or paragraph: Currency, Relevance, Authority, Accuracy, and Purpose.
2. A screenshot of the source, showing its title and date.
3. One direct quote from the source, and where it appears, such as the paragraph or section.

Part 2: Observation Game

The way people greet and talk to each other says a lot about who feels dominant. For example, when someone shakes your hand and turns their hand so it's on top of yours, they're showing dominance. So is grabbing your upper arm during a handshake, or touching your arm or shoulder.

Watch at least 3 conversations. You don't need to hear what's said:

• 1 between family members or friends you know well
• 1 between strangers
• 1 of either kind

If you don't have a safe way to watch conversations in person, watch a show or movie instead. Watch at least 30 minutes on mute for each conversation, or listen to something in a language you don't speak. Pick a drama or comedy with lots of people talking, such as a Shakespeare or Jane Austen remake like Hamlet or Pride and Prejudice. No animated videos, and action movies won't work well.

Don't be creepy. Social engineers watch people, and you're practicing the same skill, so do it respectfully:

• Only watch people you know, or people in public places, from a normal distance.
• Don't follow anyone, stare, or listen in on private conversations.
• Don't take photos, video, or audio recordings of anyone.
• Don't write down names, or anything else that could identify a stranger.
• If someone notices you and seems uncomfortable, stop and move on.

Body language checklist. Use my body language checklist, linked under Resources, to guide what you look for. It has examples for handshakes, posture, eye contact, touch, personal space, talking, position, facial expressions, gestures, mirroring, feet, and tone. Read its notes first: body language is a clue, not proof, and people's culture, disability, and comfort all change how they move.

For each conversation, write down the date, the time, and the general setting, such as “campus café, Tuesday afternoon” or the name of the show and episode. Then answer:

1. Was it a happy conversation? Sad? Tense? What led you to that conclusion?
2. Which items from the body language checklist did you see? Describe them.
3. Who was dominant during the conversation? Did dominance switch?
4. Could you see facial expressions? What did you see, and what do you think they meant?

Part 3: Video

Watch the 60 Minutes segment on how con artists use AI and apps to steal (linked under Resources, with a transcript). An ethical hacker uses an AI copy of a reporter's voice to trick a coworker, and a family describes a grandparent scam. Answer these questions:

5. What information did the hacker find before making the call, and where did she find it?
6. What made the call believable? Which human behaviors did it take advantage of, such as trust, helpfulness, or rushing?
7. What could the coworker, or the grandparent, have done differently? What should they do in the future?
8. What are 2 resources you would recommend to them? Include the full links.

Screenshots

Each screenshot should have your name, term, and year. One of the easiest ways to do that is make a text document with your name and term/year on your computer and save it to use all term. Any screenshots that don't include this information won't be counted.

Deliverables

One file that includes:

• Part 1: your 2 real-world examples, with a citation, CRAAP check, screenshot, and quote for each news source
• Part 2: your notes on all 3 conversations, each with the date, time, and setting, and your answers to the 4 questions
• Part 3: your answers to the 4 video questions

Explain why you think what you think. Even if you're pretty sure of an answer, include a source that agrees with you.

Resources

References, a video, a PowerPoint and some notes are available at my website Link: https://www.aholdengouveia.name/InfoSec/DoSandSocialEngineering.html

My body language checklist, for Part 2 Link: https://www.aholdengouveia.name/InfoSec/labs/bodylanguage.txt

60 Minutes (CBS News, 2023): Con artists using AI, apps to target parents, grandparents for theft, the video for Part 3 Link: https://www.youtube.com/watch?v=z9zaMw6VLJg

The transcript of the 60 Minutes segment Link: https://www.cbsnews.com/news/how-con-artists-use-ai-apps-to-steal-60-minutes-transcript/

My guide to evaluating sources Link: https://www.aholdengouveia.name/Howtos/Sourceeval/sourceEvaluation.html

The CRAAP test, with questions to ask about each source Link: https://web.archive.org/web/20250814000638/https://guides.lib.uchicago.edu/c.php?g=1241077&p=9082343

Another explanation of the CRAAP test Link: https://libguides.butler.edu/c.php?g=117303&p=1940068