[00:00.000 --> 00:03.140]  Introduce an event close to my heart and some people close to my heart as well.
[00:03.860 --> 00:05.480]  And if that isn't social engineering, I don't know what is.
[00:06.120 --> 00:11.220]  Ladies and gentlemen, I'd like to introduce my friends, Emmanuel Goldstein and company.
[00:11.500 --> 00:13.340]  And this is the social engineering panel.
[00:13.560 --> 00:14.160]  Let's hear it for them.
[00:31.020 --> 00:38.360]  I just got to say, you have no idea how stressful it is to try and prepare for this and think of clever things to do on the telephone.
[00:39.180 --> 00:41.580]  For two years, I've been dreading this moment.
[00:41.580 --> 00:42.820]  The conference is easy.
[00:42.960 --> 00:44.340]  It's the phone calls that are difficult.
[00:45.140 --> 00:48.480]  And we're going to tell some stories and take questions and things like that.
[00:49.680 --> 00:51.160]  It's all about stories, really.
[00:51.280 --> 00:56.300]  It's all about adventures and figuring things out and trying new tactics and stuff like that.
[00:56.540 --> 01:02.220]  And I'd sort of like to encourage people out there, because I know you all have ideas and stories like that, to write some articles for us.
[01:02.260 --> 01:03.440]  We want to hear new voices.
[01:03.660 --> 01:10.500]  We have a lot of cool articles, but I know there are a lot of people out there that are doing really interesting stuff with technology.
[01:11.480 --> 01:13.340]  And 2600 exists for that.
[01:13.640 --> 01:16.680]  So if you're thinking of writing an article for us, please do so.
[01:16.940 --> 01:18.740]  Send it to articles at 2600.com.
[01:18.840 --> 01:20.440]  I hope we get like a thousand articles tonight.
[01:21.500 --> 01:24.340]  Because I've heard so many cool stories just walking through the hallways.
[01:24.380 --> 01:26.200]  And I would love to see those in print.
[01:26.560 --> 01:30.100]  And that's kind of how this community gets built, is just by sharing stories.
[01:30.900 --> 01:32.280]  Okay, I'd like to introduce everybody.
[01:33.360 --> 01:37.100]  Let's see, all the way down there on my left, your right, is...
[01:37.100 --> 01:38.300]  Well, no, not by the curtain.
[01:38.400 --> 01:38.860]  Hi, how are you doing?
[01:38.860 --> 01:41.560]  No, Bernie Hess.
[01:42.500 --> 01:42.940]  Welcome.
[01:51.260 --> 01:55.700]  Next to him is someone who's been on the scene for a little less time, I guess.
[01:56.180 --> 01:56.700]  Not Kevin.
[02:03.540 --> 02:07.280]  And next to me, from Austria, our friend Johannes.
[02:14.050 --> 02:15.010]  Good night.
[02:15.410 --> 02:22.610]  Now, I'd like to ask each of you to tell us something about maybe what you think social engineering is.
[02:23.110 --> 02:25.770]  What people here might want to learn about it.
[02:25.890 --> 02:32.350]  Maybe some stories that you might have encountered along the way.
[02:33.130 --> 02:34.230]  I'll start with you, Bernie.
[02:35.390 --> 02:36.930]  Thanks for giving me some fair warning.
[02:39.690 --> 02:49.090]  Well, what I think social engineering is, is getting people to do something that they probably wouldn't ever do if they knew it was me asking them to do it.
[02:51.070 --> 02:52.170]  Or someone like me.
[02:54.030 --> 03:02.770]  And I find it a bigger challenge, getting a more interesting and rewarding challenge, to get them to do things without lying to them.
[03:02.970 --> 03:17.730]  By just saying things in a certain tone of voice, in a certain way, to make them think that this is in their best interest to tell you how to do something, or to give you information that they really shouldn't be giving out.
[03:18.490 --> 03:20.930]  Yeah, it's easy to kind of lie and get that.
[03:21.090 --> 03:31.930]  But it's much more challenging to say it in a way that if you read between the lines, or just go back and look at what you said, you didn't say anything that was exactly untrue.
[03:32.290 --> 03:35.070]  So that's, I think, a more interesting challenge aspect.
[03:35.350 --> 03:38.670]  Why don't we all do the definitions first, and then maybe do the stories after that?
[03:38.950 --> 03:39.290]  Sure.
[03:40.110 --> 03:45.290]  So the whole concept of social engineering for me is this absolute fascination I've had since I was a wee little lad.
[03:45.290 --> 03:48.530]  It's the intersection of sociology and psychology for me.
[03:48.670 --> 03:57.130]  It's this interpretation of your culture surrounding and how to exploit that on a way of using your words, your tone of voice, things like that.
[03:57.270 --> 04:03.430]  It's just controlling someone's thoughts and how they react to you based on how you present yourself to them.
[04:03.670 --> 04:09.030]  I love giving the example of wearing a suit, because giving a suit gives this appearance that you may be someone important.
[04:09.030 --> 04:09.830]  I don't know why.
[04:09.970 --> 04:11.210]  I look great in a suit, apparently.
[04:11.410 --> 04:14.610]  Because people love to give me information they shouldn't give me at any time.
[04:15.090 --> 04:26.430]  So the social engineering for me is this wonderful way of kind of playing with the human psyche in a way that, well, sometimes it has a very negative spin because you can use it for a malicious advantage.
[04:26.550 --> 04:29.250]  But as Bernie was saying, it's a lot more fun to do it without lying.
[04:29.430 --> 04:37.410]  Because by doing that, it's not only a challenge for yourself, but it's more of a mental task to wrap your head around, well, what are they thinking?
[04:37.670 --> 04:38.710]  How did they do that?
[04:44.510 --> 04:49.030]  I like the concept of social engineering, but I never liked the term.
[04:49.550 --> 04:51.810]  Because engineering is an exact science.
[04:52.050 --> 04:55.630]  And what we're doing when we're doing social engineering is never engineering.
[04:55.890 --> 04:57.650]  So it cannot be planned.
[04:57.810 --> 05:05.790]  There's a certain way, psychology, there are certain ways to statistically analyze how people behave, but that's never fun.
[05:06.870 --> 05:10.210]  I like to call it a dance.
[05:10.570 --> 05:16.410]  And sometimes I'm like the leading figure, and sometimes I'm being led.
[05:16.650 --> 05:19.110]  And I try to play around with that.
[05:19.850 --> 05:23.570]  I think we like social engineering.
[05:23.970 --> 05:26.550]  I'm going to use the term because I can't think of anything else right now.
[05:28.010 --> 05:32.510]  We like doing things over the phone because we can hide our identities.
[05:32.510 --> 05:34.190]  We can just use voices.
[05:34.890 --> 05:36.750]  And people don't see what you look like.
[05:36.830 --> 05:38.590]  So that's one line of defense.
[05:38.590 --> 05:41.370]  You're able to pretend you're somebody you're not.
[05:41.370 --> 05:49.350]  Obviously, you're able to do this on computers as well where you just text on a screen and you can make people believe you're anybody on IRC.
[05:49.650 --> 05:50.830]  It's not that difficult.
[05:51.550 --> 05:59.010]  What Notkevin was talking about was actually showing up in person in a suit and getting people to believe that you're legitimate there as well.
[05:59.810 --> 06:01.610]  We find people are very trusting.
[06:02.110 --> 06:09.470]  Companies are very trusting too, especially the big companies that are kind of faceless and have a massive amount of people working for them.
[06:09.590 --> 06:15.970]  Because you just basically say, well, this person said to call you and I'm just doing my job and they're just doing their job.
[06:16.110 --> 06:19.070]  So the machine just sort of keeps on plodding along.
[06:19.350 --> 06:25.790]  And if you're able to manipulate it in the right way, there's all kinds of information that you can get out of that.
[06:27.090 --> 06:34.330]  We have the most luck, I think, playing with massive bureaucracies and just getting them to do our bidding without realizing that's what's going on.
[06:35.270 --> 06:36.090]  So I don't know.
[06:36.230 --> 06:40.190]  Do you guys have any specific stories of things that have happened in the past?
[06:40.270 --> 06:41.750]  We are going to try some experiments.
[06:42.090 --> 06:47.290]  And as with any social engineering experiment, there's no guarantee it's going to work.
[06:47.390 --> 06:48.810]  It could be a complete disaster.
[06:48.810 --> 06:54.230]  We find that individual people, when you call individual people and ask them for information, they're a lot more wary.
[06:54.230 --> 07:03.670]  They're a lot more sharp than if you call somebody who's working in, say, a fast food place or even a government office or something like that.
[07:03.730 --> 07:06.470]  They're more likely to just obey whatever you tell them.
[07:06.550 --> 07:08.630]  But people, they're looking out for themselves.
[07:08.790 --> 07:09.390]  And that's a good thing.
[07:09.470 --> 07:18.530]  I like to think that's something that hackers are able to sort of help instill, that you've got to protect your privacy and not just do what somebody tells you.
[07:18.530 --> 07:26.310]  Bernie, any memories of anything in the past maybe that people told you that they really shouldn't have?
[07:28.050 --> 07:31.770]  I would say... this is a different example of social engineering.
[07:32.550 --> 07:42.610]  Maybe stuff they didn't... it wasn't a situation where I got people to tell me something, but I got a group of people to do something that another group of people really wanted me to do.
[07:43.990 --> 07:50.150]  It goes way back to 1995 when I was incarcerated in federal prison.
[07:51.370 --> 08:02.290]  And the way the cell block was laid out is there were two tiers and there's top tier, bottom tier, and there were three TV rooms.
[08:03.670 --> 08:11.790]  And as it works out, they were pretty much used by certain... on a race basis.
[08:11.950 --> 08:18.390]  There was white guys in one, black guys in another, and Latinos in the third one, or Hispanics.
[08:18.770 --> 08:21.850]  And there were no signs in the door saying blacks only or anything.
[08:21.990 --> 08:24.110]  It just... that's how it was set up.
[08:24.230 --> 08:25.410]  So that's just the way it was.
[08:25.410 --> 08:35.450]  And there was a group of individuals there who were incarcerated for some organized grime activities.
[08:35.930 --> 08:40.610]  And there was about... I guess about 20 or so of them in this particular group.
[08:40.930 --> 08:42.890]  And they got to know me.
[08:42.890 --> 08:43.750]  I got to know them.
[08:43.990 --> 08:52.210]  And they... one night, they knew in advance that The Godfather was going to be playing on television.
[08:52.210 --> 08:53.630]  And they really wanted to see it.
[08:53.690 --> 08:56.710]  And there wasn't enough room in their one TV room for all of them to come.
[08:57.190 --> 09:02.270]  And they needed some way to get people out of the other TV room.
[09:02.310 --> 09:05.050]  And they asked me, well, how do we do this?
[09:05.190 --> 09:06.230]  I don't know why they came to me.
[09:06.650 --> 09:06.810]  I know.
[09:06.990 --> 09:08.430]  Maybe because I read books.
[09:08.650 --> 09:09.870]  That gave me some credibility.
[09:10.090 --> 09:12.190]  Because half of them were functionally illiterate.
[09:12.210 --> 09:14.150]  Are you saying mobsters don't know how to clear a room?
[09:15.530 --> 09:19.030]  Well, they didn't... they didn't... I don't know.
[09:19.030 --> 09:22.170]  They just didn't want to go to this group and say, you know, get out.
[09:22.230 --> 09:22.570]  I don't know.
[09:22.650 --> 09:23.350]  They just didn't...
[09:23.750 --> 09:24.730]  It was... I don't know.
[09:24.790 --> 09:25.210]  You're right.
[09:25.330 --> 09:25.930]  They didn't.
[09:26.010 --> 09:27.110]  These particular mobsters.
[09:27.650 --> 09:28.750]  But they were accused of like...
[09:28.750 --> 09:29.330]  Let's see why they got in prison.
[09:29.590 --> 09:31.930]  They were accused of killing people and everything.
[09:32.130 --> 09:32.930]  But I don't know.
[09:33.010 --> 09:35.950]  They just didn't want to start a battle in there or something.
[09:37.450 --> 09:44.410]  So, I said, well, we got to figure out some way to make them be preoccupied with something else besides basketball.
[09:44.670 --> 09:46.290]  Which is what was normally watched in that one room.
[09:46.290 --> 09:52.590]  So, I typed up a prison memo.
[09:52.750 --> 09:55.830]  And I knew I was going to be getting out of there in a couple of days and move to another place.
[09:55.970 --> 09:58.050]  So, I didn't really worry about the repercussions of doing this.
[10:00.850 --> 10:03.070]  I knew I was being transferred soon thereafter.
[10:03.070 --> 10:10.010]  So, I wrote a... I got a piece of... I won't tell... I still probably had a set of limitations as over.
[10:10.170 --> 10:12.970]  But I obtained a piece of Bureau of Prisons stationery.
[10:14.530 --> 10:22.030]  And typed in the prison law library a new policy.
[10:22.210 --> 10:24.830]  The Bureau of Prisons has all these policies and rules and regulations.
[10:25.150 --> 10:26.250]  And they all have code numbers.
[10:26.250 --> 10:31.250]  So, I'd read enough of these things from the Bureau of Prisons called program statements.
[10:31.410 --> 10:32.910]  It's like their encyclopedia of regulations.
[10:33.130 --> 10:36.570]  I wrote up a new policy on the new conjugal visit policy.
[10:36.810 --> 10:43.990]  There is no such thing as a conjugal visit policy in probably hardly any prisons in the U.S., let alone federal prisons.
[10:44.530 --> 10:52.530]  So, I wrote up this whole thing in Bureau of Prisons speak about the new conjugal visit policy.
[10:52.690 --> 10:54.330]  And the deadline was that night.
[10:54.890 --> 10:56.650]  It had to get the applications in.
[10:56.730 --> 11:02.430]  And it had to be... it was a very complex series of things that had to be worded on this application.
[11:03.150 --> 11:06.430]  You had to fill out a form that was readily available for any kind of request you had to go.
[11:06.570 --> 11:12.530]  So, but it was worded in such a way that certain people would get it and certain people wouldn't get it.
[11:12.530 --> 11:16.890]  Like, there were like subtle things like these requests that we handled on a first-come, first-service basis.
[11:17.330 --> 11:18.810]  And stuff like that.
[11:19.150 --> 11:24.190]  And stuff that just was beyond... beyond belief.
[11:24.410 --> 11:32.130]  Like, there was vending machines in the visitor's room that would have certain sections of it replaced with condoms.
[11:32.350 --> 11:37.570]  And that there would be no audio monitoring in the rooms.
[11:37.630 --> 11:41.130]  Normally, the visits were all, you know, supervised by prison guards.
[11:41.130 --> 11:45.110]  But there would be no audio monitoring in the conjugal visit room.
[11:50.750 --> 11:51.630]  The CVR.
[11:52.070 --> 11:53.530]  We have all these acronyms.
[11:53.630 --> 11:54.070]  The CVR.
[11:54.210 --> 12:00.310]  There would be no audio monitoring, but visual monitoring might be through the window, might be used.
[12:00.450 --> 12:03.770]  And that marital aids would be made available as necessary.
[12:04.750 --> 12:05.370]  So, anyhow.
[12:05.470 --> 12:06.190]  I put all this thing...
[12:06.190 --> 12:06.830]  It was a couple paragraphs.
[12:07.550 --> 12:10.250]  And we knew that they'd have to fill this thing out that night.
[12:10.410 --> 12:11.010]  I put it in...
[12:11.010 --> 12:13.670]  It had to be filled in that night and get it... and slipped under the warden's door.
[12:14.890 --> 12:15.210]  Um...
[12:15.210 --> 12:15.990]  By morning.
[12:17.930 --> 12:18.570]  And, uh...
[12:18.570 --> 12:20.070]  So, sure enough...
[12:20.070 --> 12:23.510]  And I clued the mobsters into this, so they wouldn't...
[12:23.510 --> 12:28.090]  They were pretty dumb, but they made sure that they didn't feel insulted by this because they asked me to do this.
[12:28.090 --> 12:30.330]  So, they didn't ask me to do this particular thing, but it was a method.
[12:30.710 --> 12:34.250]  And, it turns out, that other TV room was empty that night.
[12:34.350 --> 12:35.870]  They were all filling out this application.
[12:36.650 --> 12:37.450]  And, uh...
[12:37.450 --> 12:38.010]  I talked with...
[12:38.010 --> 12:40.070]  The next day, I talked with the guy who, uh...
[12:40.070 --> 12:42.650]  Who mops the floor in the warden's office.
[12:43.270 --> 12:43.930]  And, uh...
[12:43.930 --> 12:49.390]  He was there when the warden came in the next day and had that big stack of applications.
[12:49.730 --> 12:52.590]  And he was wondering, what the heck is this?
[12:53.370 --> 12:54.450]  So, anyhow, it worked.
[12:54.530 --> 12:56.070]  We got everybody out of the other TV room.
[12:56.070 --> 12:59.990]  They watched The Godfather, which was, like, the movie they lived for, to see.
[13:00.170 --> 13:01.870]  They used to, like, wannabe mobsters, but they...
[13:01.870 --> 13:03.330]  It was, like, the gang that couldn't shoot straight.
[13:03.510 --> 13:04.510]  But, anyhow, I did that.
[13:04.610 --> 13:09.550]  And, like, that Monday, I was moved out to another place, and there were no repercussions to me.
[13:09.610 --> 13:12.530]  I don't think Bureau of Prisons even knows anything about that until now.
[13:12.710 --> 13:13.510]  But that was...
[13:13.510 --> 13:15.430]  That was, like, uh...
[13:15.430 --> 13:16.330]  You know, back in the 90s.
[13:16.410 --> 13:18.810]  So, that was social engineering, and I didn't...
[13:18.810 --> 13:20.290]  You know, it was just a written memo.
[13:20.490 --> 13:21.170]  It wasn't a...
[13:21.170 --> 13:23.970]  It wasn't me calling anybody on the phone and getting them to give me information.
[13:23.970 --> 13:28.490]  And, you know, I feel kind of bad about it, but, um, you know, if...
[13:28.490 --> 13:30.130]  Wait, why do you feel bad about it?
[13:30.230 --> 13:37.590]  Well, because they probably were getting all excited and telling their wives and girlfriends about it and a lot of disappointment.
[13:38.450 --> 13:39.910]  But, you know, if they really...
[13:39.910 --> 13:44.030]  If they really read it carefully, they would have realized it couldn't possibly be true.
[13:44.430 --> 13:46.770]  So, it was just wishful thinking, I think, on their parts.
[13:47.350 --> 13:48.190]  So, that was...
[13:48.190 --> 13:49.290]  That was one story that came to mind.
[13:56.130 --> 13:56.590]  Before we...
[13:56.590 --> 13:57.210]  I have that memo.
[13:57.290 --> 14:00.250]  If anyone wants to see it, I'll email me and I'll send you a copy of it.
[14:00.430 --> 14:01.070]  Oh, hell yeah.
[14:03.830 --> 14:04.170]  Wow.
[14:04.250 --> 14:06.250]  So, you basically social engineered by paper.
[14:06.550 --> 14:06.810]  Yeah.
[14:06.930 --> 14:07.690]  You can do that.
[14:07.850 --> 14:09.330]  You can social engineer...
[14:09.330 --> 14:11.450]  Well, corporations do it to us all the time.
[14:11.590 --> 14:11.830]  How so?
[14:11.910 --> 14:13.630]  And governments do it to us all the time.
[14:13.630 --> 14:14.990]  How do they social engineer us?
[14:15.150 --> 14:15.310]  Yeah.
[14:15.490 --> 14:19.310]  Just by issuing official-looking memos and corporate policies.
[14:19.670 --> 14:25.410]  And one of our speakers was almost social engineered not giving a talk by sending a memo.
[14:25.950 --> 14:26.110]  True.
[14:26.110 --> 14:26.250]  True.
[14:27.310 --> 14:28.210]  You know, we know about this.
[14:28.350 --> 14:30.430]  It was a crisis thing just before the conference.
[14:30.430 --> 14:30.990]  You can get...
[14:30.990 --> 14:31.090]  Yeah.
[14:31.210 --> 14:32.590]  In fact, very good point.
[14:32.710 --> 14:34.570]  A lot of legal threats.
[14:34.850 --> 14:36.410]  It's another form of social engineering.
[14:36.570 --> 14:39.730]  They're trying to get you to do what they're threatening you to do.
[14:39.730 --> 14:44.690]  To say that you have to take this page down or we're going to come after you.
[14:44.770 --> 14:46.690]  Of course, they'd have no intention of ever doing that.
[14:47.130 --> 14:50.410]  Because it would be way too expensive and time consuming and they'd probably lose.
[14:50.850 --> 14:54.930]  But in most cases, people get a threatening letter of some sort and they obey it.
[14:55.030 --> 14:55.730]  Because they're afraid.
[14:56.010 --> 15:01.070]  And they don't want to incur any expense or risk or anything like that.
[15:01.230 --> 15:01.550]  So, yeah.
[15:01.710 --> 15:02.110]  Good point.
[15:02.210 --> 15:03.490]  It is a way of doing this.
[15:04.130 --> 15:09.210]  I would like to actually, before we get to Kevin, reach out to a local place.
[15:09.210 --> 15:19.850]  And the reason I want to do it now is because we spent a little bit of time before this panel just getting business hours and things like that sorted out so that we would call places before they closed.
[15:20.050 --> 15:21.310]  And this place closes at 10.
[15:21.390 --> 15:23.110]  Actually, the guy said 9.45.
[15:23.130 --> 15:24.350]  I think he wants to get out of there early.
[15:24.830 --> 15:25.830]  It's a local subway.
[15:26.230 --> 15:29.110]  I'm sure all of you are familiar with the subway chain.
[15:30.650 --> 15:35.710]  And this sort of reminds me of something that a friend of mine did years ago.
[15:36.690 --> 15:38.390]  And this involved a phone company.
[15:38.530 --> 15:40.110]  And boy, that really took some guts.
[15:41.590 --> 15:55.370]  He basically called the phone company, I think it was down on Pearl Street here in Manhattan, and said that he was showing up to collect the old identification cards, and that the new ones would be delivered shortly afterwards.
[15:57.050 --> 15:58.450]  This is a 15-year-old kid.
[15:58.590 --> 16:09.330]  And you're 15 years old going down to a phone company building like you have any right to, like you're part of some organization, and telling the security guard, I'm here to get your ID card.
[16:09.870 --> 16:21.130]  And to this day, he has his ID card of this idiot who did not know, to not believe somebody on the telephone.
[16:21.350 --> 16:23.670]  So yeah, that kind of thing can happen.
[16:23.750 --> 16:24.610]  We're going to do something similar.
[16:24.790 --> 16:26.650]  Not quite as gutsy, I think.
[16:26.690 --> 16:27.030]  Emmanuel?
[16:27.370 --> 16:27.490]  Yes.
[16:27.810 --> 16:30.890]  I'm sorry to interrupt, but the very same thing happened to me.
[16:31.010 --> 16:35.410]  I was at the Bureau of Prisons where I was, because it's related to the other story.
[16:35.990 --> 16:37.190]  He goes home at 9.45.
[16:37.190 --> 16:41.910]  They sent us a memo saying that we had to turn on our ID cards, because they were going to replace them with new orange ones.
[16:42.230 --> 16:43.870]  And I really liked the white one I had.
[16:44.790 --> 16:46.730]  So I mailed it out that night.
[16:46.790 --> 16:48.430]  And all the mail that's inspected goes out.
[16:49.130 --> 16:50.930]  But the attorney-client mail is not.
[16:51.030 --> 16:52.830]  So I had to write to an attorney.
[16:52.930 --> 16:55.150]  But it was just a friend of mine, and I just said, attorney, and whatever.
[16:55.270 --> 16:55.870]  I mailed it out.
[16:56.350 --> 16:57.530]  And then I was issued an X-Card.
[16:57.590 --> 16:58.730]  I just said, I couldn't find it.
[16:58.810 --> 16:59.370]  What are they going to say?
[17:01.910 --> 17:05.470]  So that's why I always had my own card to have afterwards.
[17:06.050 --> 17:08.630]  Now, it's always a good idea if you're going to do something like this.
[17:08.690 --> 17:09.970]  Do a little bit of research first.
[17:10.770 --> 17:13.830]  And I found out that Subway is headquartered in Milford, Connecticut.
[17:14.030 --> 17:14.750]  So it's good to know that.
[17:15.730 --> 17:17.950]  Got the phone number of the Subway that's actually open.
[17:18.050 --> 17:19.170]  Found the store number.
[17:19.170 --> 17:20.830]  That's also very important to have.
[17:20.970 --> 17:22.850]  And, of course, getting their hours.
[17:23.010 --> 17:23.930]  So let's see if this works.
[17:23.930 --> 17:29.170]  We're going to try and see if this guy will allow us to come by and give him a new ID card.
[17:29.570 --> 17:30.610]  Or take his old ID card.
[17:31.390 --> 17:32.310]  What do I do with this phone?
[17:32.410 --> 17:33.910]  Pick it up and dial nine?
[17:35.070 --> 17:36.830]  Just regular telephone.
[17:37.250 --> 17:38.430]  It's a plain old telephone line.
[17:38.450 --> 17:39.050]  I'm going to pick this up.
[17:39.390 --> 17:40.470]  Hopefully it won't be a horrible noise.
[17:42.230 --> 17:43.150]  Oh, that's a good noise.
[17:43.310 --> 17:43.450]  Okay.
[17:44.390 --> 17:46.630]  And then I press this in when I want to talk.
[17:47.230 --> 17:47.750]  Okay.
[17:48.010 --> 17:48.070]  Okay.
[17:48.410 --> 17:48.930]  Understood.
[18:13.180 --> 18:14.060]  Hello, Subway.
[18:14.880 --> 18:17.500]  Yeah, am I reaching Subway on 5th Avenue?
[18:18.320 --> 18:19.420]  Yeah, 5th Avenue, Subway.
[18:19.660 --> 18:23.700]  Is this store 48195?
[18:25.620 --> 18:26.360]  Phone number?
[18:26.720 --> 18:27.820]  The store number.
[18:28.080 --> 18:29.080]  Is the store number 48195?
[18:29.940 --> 18:30.420]  Yes, yes.
[18:30.660 --> 18:32.260]  Okay, I'm calling from the Milford office.
[18:32.260 --> 18:36.180]  We have your new ID cards that we need to drop off.
[18:37.080 --> 18:39.540]  Are you open until 10 p.m.
[18:39.980 --> 18:39.980]  tonight?
[18:41.600 --> 18:41.760]  Today?
[18:42.440 --> 18:44.180]  Well, it's either going to be today.
[18:44.400 --> 18:45.560]  I'm in touch with the driver.
[18:46.040 --> 18:48.740]  And he's either going to drop them off today or tomorrow morning.
[18:48.880 --> 18:50.060]  I believe you open at 9 tomorrow?
[18:50.680 --> 18:51.380]  Tomorrow morning?
[18:51.460 --> 18:51.820]  What time?
[18:52.720 --> 18:54.280]  Well, if he doesn't get there...
[18:54.280 --> 18:55.100]  What time do you close today?
[18:55.220 --> 18:55.740]  You close at 10?
[18:55.760 --> 18:58.160]  Yeah, tomorrow store opens at 9 o'clock.
[18:58.700 --> 18:59.100]  Okay.
[18:59.580 --> 19:00.880]  Who will be on duty then?
[19:00.920 --> 19:02.440]  What's the name of the person who will be there then?
[19:03.600 --> 19:04.000]  Okay.
[19:04.580 --> 19:05.180]  I'm sorry.
[19:05.320 --> 19:07.220]  What is the name of the person who will be on duty?
[19:07.620 --> 19:08.080]  My name?
[19:08.640 --> 19:09.080]  Okay.
[19:09.160 --> 19:09.680]  What is your name?
[19:10.120 --> 19:11.160]  My name is Jassim.
[19:11.300 --> 19:13.320]  J-A-S-S-I-M.
[19:13.940 --> 19:14.380]  Okay.
[19:15.380 --> 19:20.620]  And can you tell me how many employees there will be between now and Monday?
[19:21.900 --> 19:22.540]  Every day?
[19:22.940 --> 19:23.200]  Yeah.
[19:23.360 --> 19:24.760]  How many people are there right now?
[19:25.520 --> 19:29.820]  Right now, today we are working with three people.
[19:30.240 --> 19:30.640]  Okay.
[19:31.380 --> 19:33.160]  And can I get their names as well?
[19:33.240 --> 19:35.080]  So make sure we have the right ID cards.
[19:35.340 --> 19:35.640]  Okay.
[19:35.820 --> 19:37.460]  You talk to another people, okay?
[19:37.680 --> 19:38.140]  Yes, please.
[19:44.760 --> 19:45.160]  Hello?
[19:45.580 --> 19:46.080]  Yes, hi.
[19:46.180 --> 19:47.700]  We're delivering the new ID cards.
[19:47.920 --> 19:52.700]  We're trying to get them there today, but they might arrive tomorrow morning at around 9.30.
[19:53.940 --> 19:54.860]  Where are you from, sir?
[19:54.860 --> 19:56.720]  This is from the office in Milford.
[19:56.920 --> 19:58.900]  We're just delivering new subway ID cards.
[19:59.300 --> 19:59.620]  Okay, sir.
[19:59.720 --> 20:01.140]  Just you talk with our boss, okay?
[20:01.540 --> 20:01.860]  Okay.
[20:02.020 --> 20:02.640]  And what's his name?
[20:02.880 --> 20:03.660]  Mr. Ahmed.
[20:04.240 --> 20:04.600]  Okay.
[20:04.680 --> 20:05.300]  Is he there now?
[20:05.760 --> 20:06.080]  Okay.
[20:06.240 --> 20:07.480]  You can call this guy, okay?
[20:07.680 --> 20:08.960]  Can I talk to him now?
[20:09.540 --> 20:10.260]  No, he's not here.
[20:10.840 --> 20:11.860]  He's, you know...
[20:12.820 --> 20:13.180]  Okay.
[20:13.960 --> 20:15.800]  You're from Subway Head Company, right?
[20:16.020 --> 20:16.580]  Yes, from Milford.
[20:16.640 --> 20:19.580]  Go online and check his address and everything and contact with this.
[20:19.760 --> 20:21.360]  Is there a way we can reach him tonight?
[20:21.500 --> 20:23.200]  Because we have to make sure the delivery gets through tomorrow.
[20:23.200 --> 20:26.830]  No, we'll call you tomorrow, okay?
[20:27.270 --> 20:29.030]  Well, we need to talk to him tonight.
[20:29.170 --> 20:30.450]  Do you have a phone number we can reach him at?
[20:31.410 --> 20:32.530]  Actually, I'm a new guy.
[20:32.650 --> 20:34.030]  I don't know about his phone number.
[20:34.210 --> 20:35.430]  Just you can...
[20:36.750 --> 20:37.750]  Because we have a driver.
[20:37.870 --> 20:38.950]  The driver is out now.
[20:39.130 --> 20:41.810]  We need to make sure that we have the right IDs.
[20:41.990 --> 20:45.110]  If you just give me a phone number I can reach him, then this will be fine.
[20:45.870 --> 20:46.190]  Okay.
[20:49.250 --> 20:50.250]  Actually, I'm a new guy.
[20:50.490 --> 20:51.930]  Can you call Monday?
[20:52.170 --> 20:52.890]  Monday will be available.
[20:53.050 --> 20:54.650]  Unfortunately, the delivery is tomorrow morning.
[20:54.650 --> 20:55.570]  Our driver is out now.
[20:55.690 --> 20:56.330]  He's actually trying to...
[20:57.010 --> 20:57.690]  Did anybody?
[20:58.190 --> 20:58.650]  I'm sorry?
[20:59.990 --> 21:00.190]  Yeah.
[21:00.910 --> 21:03.870]  You are calling for USF food service?
[21:04.770 --> 21:05.170]  Yeah.
[21:05.270 --> 21:06.710]  We're trying to deliver for Saturday night.
[21:06.850 --> 21:09.330]  If we can't get it there tonight, we're going to get it there tomorrow morning.
[21:09.390 --> 21:10.450]  But we do need a phone number.
[21:10.650 --> 21:11.330]  Oh, phone number?
[21:11.530 --> 21:12.770]  The bus phone number?
[21:12.970 --> 21:13.330]  Yes.
[21:13.910 --> 21:14.110]  Oh.
[21:15.650 --> 21:15.890]  Okay, sir.
[21:16.930 --> 21:17.330]  516?
[21:17.690 --> 21:17.970]  Okay.
[21:18.730 --> 21:19.130]  655?
[21:19.490 --> 21:19.870]  Thank you.
[21:21.630 --> 21:22.030]  7659.
[21:22.950 --> 21:23.270]  Okay.
[21:23.690 --> 21:24.430]  Thank you very much.
[21:24.650 --> 21:25.990]  Language barrier can be a problem.
[21:26.090 --> 21:29.150]  Well, what he just did was he gave me someone's home phone number.
[21:29.250 --> 21:30.290]  Hopefully the whole thing didn't go through.
[21:30.870 --> 21:31.970]  You really shouldn't do that.
[21:32.070 --> 21:33.990]  Give out someone's home phone number like that.
[21:34.150 --> 21:36.050]  I've got so much information on these people now.
[21:36.190 --> 21:37.090]  Three names.
[21:37.210 --> 21:37.930]  I couldn't really make them out.
[21:37.930 --> 21:42.550]  But if I was at a more comfortable location and recording it, I could have gotten their names.
[21:42.750 --> 21:47.110]  I could have gone further, asked for employee ID codes or whatever it is they use over there.
[21:47.870 --> 21:49.430]  And, you know, it's a subway.
[21:49.610 --> 21:49.730]  Okay.
[21:49.890 --> 21:52.370]  It's not, you know, Fort Knox or anything like that.
[21:52.530 --> 21:57.290]  But it does show how people will be trusting if you tell them you have to give this to me now.
[21:57.850 --> 21:59.890]  I shouldn't even have been on the phone that long with them.
[21:59.950 --> 22:01.250]  They're running a business for God's sake.
[22:01.370 --> 22:03.610]  And here I am wasting their time.
[22:03.610 --> 22:05.910]  I talk to two different people and they're trying to make sandwiches.
[22:07.030 --> 22:07.410]  So...
[22:10.670 --> 22:11.470]  You need...
[22:11.470 --> 22:11.950]  Thank you.
[22:15.790 --> 22:17.610]  You need ways of verifying.
[22:17.790 --> 22:19.870]  You need to know, okay, where can I call you back?
[22:20.050 --> 22:24.850]  Get a phone number of somebody who's calling you out of the blue asking for personal information.
[22:25.030 --> 22:26.350]  You never give it out to them like that.
[22:26.770 --> 22:30.110]  Get a phone number, call them back, make sure they're legit.
[22:30.410 --> 22:31.450]  Yeah, I had some code words.
[22:31.570 --> 22:32.470]  I had Milford, Connecticut.
[22:32.670 --> 22:33.030]  Big deal.
[22:33.290 --> 22:34.610]  I knew their office hours.
[22:34.610 --> 22:36.490]  I knew their store number.
[22:36.990 --> 22:38.570]  And that's pretty much it.
[22:39.150 --> 22:49.070]  Had I pursued this, it's possible I could have just come by now with some ID cards and gotten them to give me their old ones or get all kinds of information as well.
[22:49.710 --> 22:52.150]  We'll try something else a little later, but not Kevin.
[22:52.430 --> 22:55.170]  Any social engineering history that you'd like to share?
[22:55.590 --> 23:04.550]  Corporations are absolutely my favorite because, as we just saw, the monolith of the corporation allows you to really manipulate people because they're so set in this mindset of how things work.
[23:04.770 --> 23:09.410]  And the story I'm gonna tell is about many, many years ago when I was even smaller than I am now.
[23:09.550 --> 23:13.050]  And I was applying for an internship at a, you know, a very unnamed corporation.
[23:14.050 --> 23:18.070]  And I met with the HR person and she was very uninterested in who I was.
[23:18.610 --> 23:22.570]  And, you know, you're going through the standard boring questions that I'm sure you've all gone through before.
[23:22.950 --> 23:26.590]  So I immediately off the bat realized, oh, I'm not gonna get this.
[23:26.710 --> 23:29.450]  So I decided, well, I like information security.
[23:29.550 --> 23:30.570]  Let's see how far I can push this.
[23:30.710 --> 23:32.530]  So I started, you know, answering her questions.
[23:32.790 --> 23:34.970]  Oh, you know, my favorite color is blue, blah, blah, blah.
[23:35.310 --> 23:36.490]  I'm a really warm person.
[23:36.630 --> 23:37.330]  I'm a team builder.
[23:37.770 --> 23:40.070]  But I'm really interested in Windows Server 2003.
[23:40.230 --> 23:40.910]  Do you guys use that?
[23:41.130 --> 23:43.010]  Oh, yeah, that's what our email client runs.
[23:43.130 --> 23:48.790]  And so I just asked me more and more little pointed, subtle questions about their corporate structure, their networks, things like that.
[23:49.150 --> 23:50.570]  Oh, how many passwords do I get?
[23:50.570 --> 23:51.450]  What's the length of passwords?
[23:51.450 --> 23:53.490]  Do you guys use uppercase and lowercase, you know?
[23:53.710 --> 23:54.550]  I'm a young kid.
[23:54.690 --> 23:55.410]  I can't be a threat.
[23:55.930 --> 23:59.910]  And so this went on for, you know, 20, 30 minutes of just little subtle things.
[23:59.990 --> 24:01.330]  And so she said, you know, great, thanks.
[24:01.430 --> 24:02.070]  We'll give you a call.
[24:02.990 --> 24:05.750]  And as we were walking out, she introduced me to the IT director.
[24:05.770 --> 24:12.830]  And I'm like, oh, so you guys use Windows Server 3, SP2, and your passwords are X and Y, and Z with next and next characters, and yada, yada, yada.
[24:13.530 --> 24:15.510]  Needless to say, I never got that call back.
[24:16.470 --> 24:33.310]  But it goes to show that in situations like that where there's an expected formality of how things work, you really can become a very serious threat by just interjecting a little bit of persuasiveness with just a little bit of knowledge of how things work against people who are not expecting it.
[24:33.630 --> 24:37.010]  The subway employee is a great example because they're not expecting a call like this.
[24:37.230 --> 24:37.790]  Oh, IDs?
[24:38.050 --> 24:38.590]  It's not regular.
[24:39.390 --> 24:57.990]  So when you go outside the norm, people don't know how to react, and they involuntarily give up information that they should absolutely not be giving up, especially when it comes to your corporate network, because I'm pretty sure everyone here knows what happens when someone gets the password link or things like the version numbers of your email servers and things like that.
[24:58.210 --> 25:02.610]  It gets very, very dangerous, especially when that information gets out and, say, the public.
[25:03.450 --> 25:06.670]  I feel a little guilty picking on fast food people, but it is fun.
[25:07.930 --> 25:11.050]  We... a number of years ago, I think we did a... was it a Pizza Hut?
[25:11.930 --> 25:16.810]  Something downtown where we convinced them that at a certain time they had to turn their cash registers off.
[25:18.430 --> 25:19.070]  What was it?
[25:19.170 --> 25:19.730]  Taco Bell.
[25:19.870 --> 25:20.510]  It was a Taco Bell?
[25:20.690 --> 25:20.870]  Okay.
[25:21.510 --> 25:23.870]  I almost tried Taco Bell tonight, so I'm glad we didn't do them again.
[25:24.890 --> 25:33.310]  And I think people went down there and they actually... they had to be reminded, but when they were reminded, they basically made people stand on line for, I think, about five minutes without doing anything.
[25:34.130 --> 25:37.050]  And it's a small victory for I don't know what, but...
[25:38.690 --> 25:39.130]  Johannes.
[25:39.510 --> 25:39.930]  Yeah.
[25:41.970 --> 25:44.470]  By the way, has anyone ever tried the Subway diet?
[25:46.190 --> 25:46.630]  No?
[25:46.870 --> 25:47.210]  Okay.
[25:47.330 --> 25:47.910]  I thought so.
[25:48.130 --> 25:48.510]  Okay.
[25:50.470 --> 25:50.910]  Okay.
[25:51.030 --> 25:53.430]  I mean, there are so many stories I could tell.
[25:53.750 --> 26:06.410]  One of my favorite stories, so I'm part of this group called monochrom, and a couple of years ago, we were invited to be the official Austrian representatives at one of the biggest art shows on the planet, the Biennial in Sao Paulo.
[26:06.930 --> 26:17.270]  And the great thing about that story is, and I really tried to reduce it to the bare minimum, is that it had a couple of really interesting social engineering levels at different points of the project.
[26:17.270 --> 26:30.170]  The story was that we were asked to represent Austria at this Biennial, but we told the curator that we don't want to do that, because Austria had a really, really bad right-wing government back then, and we didn't want to represent Austria at that level.
[26:31.090 --> 26:34.590]  And she really insisted and said, come on, think about something really cool.
[26:34.830 --> 26:39.850]  And then we said, okay, we'll have the press release ready for you tomorrow morning, and she sent it out.
[26:39.990 --> 26:45.830]  And the press release stated that the official Austrian representative at the Biennial would be a guy called Georg Paul Thoman.
[26:46.510 --> 26:53.050]  And all the newspapers reported about that, but of course that guy never existed, so we kind of like made up this fake artist.
[26:53.050 --> 27:10.850]  The cool thing was that because this press release was sent out, suddenly all the newspapers reported about that, because journalists don't Google, and suddenly this guy who didn't exist, this art avatar, was suddenly representing Austria at the Biennial in Sao Paulo in Brazil.
[27:11.130 --> 27:23.590]  So we went to Brazil, and in Brazil, we as monochrom, as the group, we were of course not important, because they were waiting for Georg Paul Thoman, and we were just his technical support team.
[27:23.810 --> 27:32.770]  So we were a couple of people there, like, you know, hanging stupid paintings and stuff like that, and drinking beer, and having a nice time chatting to other technical support teams.
[27:33.090 --> 27:38.390]  Because nobody was interested in us, and nobody gave us business cards, because we were not important.
[27:38.530 --> 27:40.350]  We were no curators or no artists.
[27:40.510 --> 27:42.230]  We were just like the technical support team.
[27:42.330 --> 27:44.250]  We were like the bottom of the hierarchy there, yeah?
[27:44.250 --> 27:52.270]  But because we were at the bottom of the hierarchy, we got access to a lot of interesting infrastructure at the Biennial there.
[27:52.690 --> 28:01.570]  But the most important part was that all the other technical support teams, who felt that they were on the same level as us, who had, you know, like beers with us, etc.
[28:01.990 --> 28:06.870]  Those guys, after a couple of days, we just told them what's going on.
[28:06.970 --> 28:16.590]  So we told them that we are actually the artists, that that guy doesn't exist, that he is not watching the porn channel and therefore not coming to the Biennial and doing his job.
[28:17.710 --> 28:22.250]  Because those guys suddenly knew more than all the other guys at the Biennial.
[28:23.130 --> 28:25.610]  Top curators and top artists and whatever.
[28:25.890 --> 28:32.470]  So they suddenly had this power of like, we know that that guy doesn't exist, and we can do something crazy with that.
[28:32.470 --> 28:38.410]  And they started telling interesting, crazy stories about the lives and times of Georg Paul Thoman that he had.
[28:43.430 --> 28:50.490]  And so Georg Paul Thoman had sex with the curator from Argentina on the second floor bathroom, and stuff like that.
[28:50.650 --> 28:54.710]  Yeah, I mean, they were like, they were technicians and some of the stories were kind of like rude.
[28:54.710 --> 29:06.110]  But still, it was quite interesting to see like the gazers of rumors about this non-existing character bursting out, and swapping in all the different corners of the Biennial.
[29:06.570 --> 29:11.650]  And that's the last part of the story, because there are so many stories just about Georg Paul Thoman.
[29:12.790 --> 29:22.410]  A guy who was the official representative of Taiwan, he was a couple of white cubes next to the white cube of Georg Paul Thoman.
[29:22.410 --> 29:24.030]  And he had a problem.
[29:24.210 --> 29:30.390]  So we found out about that, because he sent a public letter to other artists, but no one was really interested in his problem.
[29:30.650 --> 29:34.410]  So the problem was this guy, Chen Chi-Chan.
[29:35.010 --> 29:42.450]  And he had the problem that overnight, the administration had removed or altered his name tag.
[29:42.610 --> 29:45.710]  His name tag, in our case, it was Georg Paul Thoman, Austria.
[29:46.050 --> 29:48.330]  In his case, it was Chen Chi-Chan, Taiwan.
[29:48.330 --> 29:53.990]  And they had removed the Taiwan and replaced the Taiwan by Taipei Museum of Fine Arts.
[29:54.550 --> 29:56.050]  And he didn't know why that happened.
[29:56.150 --> 30:02.750]  And it was really important for him to be the official Taiwanese representative, because he heavily criticized Taiwan.
[30:03.130 --> 30:06.110]  And it was important for him to be the Taiwanese representative.
[30:06.110 --> 30:11.890]  So he was kind of pissed about, why is there this stupid museum name and not my home country's name there?
[30:11.890 --> 30:16.270]  So he tried to talk to the curators and to the administration.
[30:16.830 --> 30:17.930]  Nobody told him anything.
[30:18.250 --> 30:24.110]  But because we were kind of like the technical support teams, we knew the other technical support teams.
[30:24.250 --> 30:25.870]  And they, of course, know everything.
[30:25.950 --> 30:29.030]  So we found out that China had intervened.
[30:29.850 --> 30:31.470]  So one China policy.
[30:31.750 --> 30:39.210]  So China didn't want to have Taiwan as its own national representation there.
[30:39.210 --> 30:47.870]  So the Chinese delegation had intervened and said, if the Taiwanese guy gets its own representation there, we will cause massive diplomatic trouble.
[30:48.210 --> 30:50.790]  And we said, hey, we cannot let that be.
[30:50.810 --> 30:53.990]  So we have to help that guy in some way in form of solidarity.
[30:54.410 --> 31:02.150]  So what we did is, because the letters, you know, Chen Chi-Chan Taiwan, they were kind of like adhesive letters.
[31:02.250 --> 31:03.850]  You could just like take them off.
[31:04.250 --> 31:07.590]  So we took off the T from Austria, and we had a T.
[31:07.950 --> 31:10.590]  And then went to Canada and said, come on, you f*cking Canadians.
[31:10.770 --> 31:11.530]  You have three A's.
[31:11.550 --> 31:12.690]  You don't need three A's.
[31:17.450 --> 31:18.630]  And then we had an A.
[31:19.150 --> 31:21.190]  And then we got an I from Croatia.
[31:22.050 --> 31:26.470]  And the only problem was the W, because there are f*cking no countries with W, yeah?
[31:27.030 --> 31:29.110]  But we had Puerto Rico.
[31:31.190 --> 31:39.090]  And then after a couple of hours running around, we had Taiwan in this like very campy, trashy way on the outside of his white cube.
[31:39.250 --> 31:41.810]  And suddenly he had his representation back again.
[31:42.050 --> 31:47.950]  The cool thing that happened was that many, many journalists took pictures of that, reported about the whole thing.
[31:47.950 --> 31:55.350]  And my favorite article about the whole thing appeared in the Taipei Times, a week after the whole incident.
[31:55.670 --> 31:59.290]  And the Taipei Times is the second largest newspaper in Taiwan, yeah?
[31:59.450 --> 32:05.590]  And this newspaper had the headline, Austrian artist Georg Paul Thoman saves Taiwan.
[32:16.770 --> 32:24.470]  And so, and my final word to that is, a non-existing artist saves a country that should not exist.
[32:24.670 --> 32:27.150]  That's like as radical as postmodernism can get.
[32:30.730 --> 32:32.530]  Are you sure you're not a yes man?
[32:34.570 --> 32:35.050]  Wow.
[32:36.150 --> 32:36.810]  All right.
[32:37.710 --> 32:39.150]  I got an idea for something.
[32:39.810 --> 32:41.750]  It's kind of surprising to me, but you know what?
[32:41.750 --> 32:45.130]  We've never actually tried to social engineer Mitt Romney.
[32:46.010 --> 32:46.610]  Whoa!
[32:52.180 --> 32:53.580]  How did we miss that?
[32:53.680 --> 32:54.640]  I don't understand.
[32:54.960 --> 32:55.740]  That's very rich.
[32:56.080 --> 32:56.380]  Yeah.
[33:01.000 --> 33:02.900]  So, we're going to correct that.
[33:03.860 --> 33:08.720]  Some of you might know there's another convention coming up later this year called the Republican National Convention.
[33:09.040 --> 33:12.080]  It's traditional that one of us gets arrested at those things.
[33:13.860 --> 33:16.080]  This one that was happening in Tampa, Florida.
[33:16.360 --> 33:17.220]  Now, interesting story.
[33:17.360 --> 33:19.320]  I just found out about this right before the panel.
[33:19.620 --> 33:30.040]  But someone within the Republican Party has booked this particular hotel that we're about to call for the duration of the party's National Convention in Tampa in August, late August.
[33:30.440 --> 33:32.720]  Now, exactly who made the reservation is a mystery.
[33:33.540 --> 33:43.120]  Officials with the hotel have confirmed that someone within the GOP organization, they won't say who, has made an unofficial reservation for the entire hotel for the convention.
[33:45.260 --> 33:47.680]  So, obviously nothing has been verified.
[33:47.700 --> 33:58.180]  And we figured, why not give them a call and see if maybe we can get some information out of them as far as if someone made a reservation, if someone, if there's a name, some kind of contact information.
[33:58.340 --> 34:07.060]  Now, of course, it is 930 on a Saturday night, but sometimes that can work to your advantage because you're not getting the people that are there in the middle of the day that know better.
[34:08.500 --> 34:10.320]  Sometimes you get people who are pretty sharp, though.
[34:10.420 --> 34:11.700]  So, let's give this a try.
[34:23.000 --> 34:23.620]  Thanks for calling.
[34:23.660 --> 34:24.280]  I'm going to hit zero.
[34:24.700 --> 34:25.760]  I'll transfer you now.
[34:26.180 --> 34:29.420]  Retail shops and search...
[34:31.340 --> 34:32.400]  Beauty from Rockware.
[34:32.600 --> 34:33.300]  Sponsors, this is Don.
[34:33.400 --> 34:33.940]  How may I help you?
[34:34.060 --> 34:34.520]  Yes, hi.
[34:34.560 --> 34:37.120]  This is Frank Robinson from Governor Romney's office.
[34:37.500 --> 34:42.740]  I needed to update contact information for the August convention week.
[34:43.040 --> 34:43.980]  Who can I speak to?
[34:43.980 --> 34:45.020]  I'm sorry?
[34:45.240 --> 34:46.560]  Contact information for what?
[34:47.020 --> 34:50.700]  For the Republican convention in the last week of August.
[34:50.700 --> 34:53.080]  We just want to make sure we have our contact information update.
[34:53.240 --> 34:57.140]  I realize it's Saturday night, but we're working at the office now to get this done.
[34:58.960 --> 34:59.360]  Okay.
[34:59.400 --> 35:03.680]  I still wouldn't have a place to connect you to 940 at night.
[35:03.800 --> 35:05.360]  All the business offices are already closed.
[35:06.560 --> 35:16.380]  Well, can you connect me to, or at least give me a voicemail for the person that's handling that particular book of reservations for that particular week?
[35:16.720 --> 35:22.040]  I wouldn't know who's handling it, but I can put you into the voicemail for the reservation managers in our office.
[35:22.820 --> 35:25.560]  They won't be in until tomorrow at 9 a.m.
[35:25.560 --> 35:28.680]  But it wouldn't tell me who was handling that particular situation.
[35:28.940 --> 35:34.780]  Are you able to tell me who has booked the rooms for that particular week, under whose name?
[35:35.000 --> 35:40.360]  I just want to make sure that you have our information and we have your information, because we are trying to get this done before Monday.
[35:40.360 --> 35:41.200]  No, I'm sorry.
[35:43.430 --> 35:44.090]  I see.
[35:44.290 --> 35:44.570]  Okay.
[35:45.710 --> 35:50.050]  Are you able to tell me the period that we have it booked for?
[35:50.290 --> 35:51.990]  Like what day it starts, what day it ends?
[35:52.250 --> 35:52.750]  No, sir.
[35:52.810 --> 35:56.210]  We don't have anything to do with the reservations.
[35:56.370 --> 35:58.090]  We don't know who was booked or what time.
[35:58.490 --> 36:00.130]  There's no way for us to get into those accounts.
[36:00.310 --> 36:04.770]  It would be through reservations at 9 p.m.
[36:05.490 --> 36:07.090]  Will they be open tomorrow as well?
[36:07.330 --> 36:08.310]  Yes, they'll be open tomorrow.
[36:08.530 --> 36:09.170]  9 a.m.
[36:09.270 --> 36:09.810]  to 9 p.m.
[36:10.130 --> 36:10.530]  Okay.
[36:10.750 --> 36:13.530]  And who is the manager I can speak to about this tomorrow?
[36:14.350 --> 36:17.170]  Well, I'm not sure which manager will be in for that department.
[36:18.830 --> 36:22.250]  Rene Ruiz is the manager for them.
[36:22.510 --> 36:22.770]  Okay.
[36:26.500 --> 36:26.900]  Okay.
[36:28.120 --> 36:28.620]  All right.
[36:28.720 --> 36:29.600]  Well, thanks for your help anyway.
[36:29.800 --> 36:30.180]  You're welcome.
[36:30.240 --> 36:30.480]  Bye-bye.
[36:31.280 --> 36:31.680]  Okay.
[36:31.860 --> 36:32.500]  That failed.
[36:32.760 --> 36:35.060]  That did not work at all, but that's what happens.
[36:35.080 --> 36:36.500]  You have to sort of back out gracefully.
[36:37.060 --> 36:38.620]  She wasn't going to tell us anything.
[36:38.860 --> 36:40.740]  Any thoughts on ways that could have been handled better?
[36:41.060 --> 36:51.860]  Well, if you were to call tomorrow, you would know who to ask for and address her by name, which you wouldn't have known otherwise, maybe, unless you were the person who had spoken to her earlier or someone from the...
[36:51.860 --> 36:57.200]  And I would have also said campaign office instead of just office, because I might have had a more ring of authenticity.
[36:57.620 --> 36:57.860]  Right.
[36:58.000 --> 37:02.460]  I thought you did a pretty good job with, you know, given that they didn't have access to that.
[37:03.020 --> 37:05.340]  I thought it was five minutes before the panel, so yeah.
[37:06.260 --> 37:08.000]  That's the best we could do.
[37:08.520 --> 37:16.440]  I had an address for the office in Tampa, for the Romney office, and the hope was that somebody there would say, oh yeah, you guys again.
[37:16.700 --> 37:17.080]  Okay, yeah.
[37:17.240 --> 37:18.840]  Talk to this particular person.
[37:20.640 --> 37:22.380]  And it does work sometimes.
[37:22.560 --> 37:23.380]  It doesn't work every time.
[37:24.940 --> 37:27.160]  But we'll keep trying something else.
[37:27.400 --> 37:27.900]  All right.
[37:29.760 --> 37:30.300]  Thank you.
[37:32.180 --> 37:36.660]  We do want to allow time for questions and answers or stories from the audience as well.
[37:36.820 --> 37:38.200]  Where should we tell people to walk up to?
[37:39.140 --> 37:39.840]  Over there?
[37:40.140 --> 37:42.720]  Okay, I can't see, because it's like staring into the sun here.
[37:43.800 --> 37:44.540]  Okay, in the middle.
[37:44.740 --> 37:47.400]  So if anyone has questions for the panel, please ask.
[37:47.400 --> 37:50.980]  We have at least one more attempt to get some information later on.
[37:51.600 --> 37:53.860]  Any other stories or comments, folks?
[37:55.360 --> 37:55.740]  Always.
[37:57.120 --> 37:57.500]  Okay.
[37:58.580 --> 37:59.420]  Someone's there, I think.
[37:59.600 --> 38:00.520]  I see a shadowy figure.
[38:00.620 --> 38:00.940]  Okay, go ahead.
[38:03.600 --> 38:05.160]  Yeah, it's called a microphone.
[38:05.340 --> 38:05.840]  Yeah, you can use it.
[38:05.860 --> 38:06.860]  Well, it should work.
[38:06.940 --> 38:08.500]  Yeah, it's just sort of, you know...
[38:08.500 --> 38:08.900]  Ah, I see.
[38:08.960 --> 38:09.580]  Above his head.
[38:09.660 --> 38:10.460]  I see not, no.
[38:11.200 --> 38:11.580]  Hi.
[38:13.880 --> 38:17.140]  I actually had this question since the last time I was here.
[38:17.140 --> 38:21.800]  But we have all these techniques for sort of getting people to do things.
[38:21.980 --> 38:29.080]  Could we use them to try and maybe influence the political process in this country to try and effect change?
[38:30.140 --> 38:30.620]  Try and...
[38:30.620 --> 38:31.700]  By lying on the telephone?
[38:31.880 --> 38:32.080]  Sure.
[38:33.740 --> 38:34.260]  Why not?
[38:34.260 --> 38:36.160]  It works as well as anything else, you know?
[38:36.300 --> 38:37.820]  I meant on like a slightly larger scale.
[38:38.180 --> 38:38.460]  Mm-hmm.
[38:38.880 --> 38:44.300]  I mean, there's all kinds of things you can do to manipulate people and get them to change the way...
[38:44.700 --> 38:46.520]  I mean, yes men are a perfect example of that.
[38:46.520 --> 38:52.240]  If you saw the keynote earlier today, the way they're able to change the conversation and get people talking about something.
[38:52.360 --> 38:52.880]  Yeah, that's...
[38:52.880 --> 38:53.320]  That's...
[38:53.320 --> 38:54.820]  You can certainly do that.
[38:55.420 --> 39:00.080]  But you have to be really good and you have to know who to hit and what to say.
[39:00.740 --> 39:02.880]  But, you know, you should experiment.
[39:03.280 --> 39:04.220]  Always open to ideas.
[39:04.500 --> 39:05.440]  Yeah, I think too.
[39:05.440 --> 39:10.620]  The main problem nowadays is that the mainstream media are very much interested in pranks.
[39:10.780 --> 39:13.300]  They're interested in subversive, interesting stories.
[39:13.560 --> 39:21.500]  So, in the meantime, we have the problem that we have to create ways to subvert the system without being subverted ourselves.
[39:21.500 --> 39:29.540]  Because, if you end up as the five-second segment on CNN that's kind of funny, that's not where you want to end up.
[39:29.840 --> 39:31.100]  So, you have to...
[39:31.100 --> 39:37.440]  The media system is so complex, the more complex the prank is, the better it actually is.
[39:37.440 --> 39:43.800]  So, I think we have to be careful not to feed the system with the shit that it actually wants.
[39:44.320 --> 39:44.720]  So, yeah.
[39:45.360 --> 39:46.700]  Yeah, define the conversation.
[39:47.660 --> 39:48.060]  Don't...
[39:48.060 --> 39:53.040]  They'll ask questions or they'll try to frame a story in a particular way.
[39:53.220 --> 39:55.840]  And you don't have to play by those rules.
[39:55.960 --> 39:58.760]  You can basically say, no, this is what the important issue is.
[39:58.800 --> 40:00.480]  You say it enough times, they're gonna hear it.
[40:00.540 --> 40:09.960]  I mean, the folks at Occupy Wall Street, they were able to do that last year, where at first it was portrayed in one particular way, and they raised their voices a bit, and they did other things.
[40:10.140 --> 40:11.700]  And all of a sudden, everybody was talking about it.
[40:11.780 --> 40:13.780]  Whether or not it succeeded, that's open to debate.
[40:13.780 --> 40:18.420]  But people started talking about a different subject than the media initially wanted to.
[40:18.700 --> 40:19.840]  So, yeah, you can do it.
[40:20.440 --> 40:21.060]  Thank you.
[40:21.280 --> 40:21.500]  Sure.
[40:21.640 --> 40:22.100]  Next question?
[40:23.700 --> 40:26.740]  Actually, in response to his question, they already do that.
[40:26.760 --> 40:27.720]  It's called push polling.
[40:28.260 --> 40:30.880]  People will call up and say, hi, I'm taking a survey.
[40:30.880 --> 40:36.260]  If I told you that Mitt Romney kicks puppies, would that influence your vote?
[40:36.960 --> 40:41.720]  If I said that Mitt Romney does this, would that influence your vote?
[40:42.020 --> 40:48.020]  And they might be taking a survey, but they're putting these things out there in a way that you're not expecting.
[40:48.120 --> 40:50.000]  So, it's already being done.
[40:51.760 --> 40:52.520]  Thank you.
[40:56.830 --> 40:58.250]  I'm looking it up right now.
[40:59.970 --> 41:02.270]  So, I have a quick anecdote, actually.
[41:02.590 --> 41:04.170]  I think Bernie might have heard this one already.
[41:04.390 --> 41:10.510]  So, last winter, I got a phone call from someone who had found out that my domain name was expired.
[41:10.550 --> 41:13.170]  I'm sorry, there's a YouTube video, Mitt Romney kicks a puppy.
[41:13.430 --> 41:13.850]  I'm just saying.
[41:14.950 --> 41:15.970]  So, there's your answer.
[41:17.150 --> 41:17.610]  Go ahead.
[41:17.730 --> 41:19.370]  So, I had gotten this phone call.
[41:19.510 --> 41:26.130]  Apparently, there were people who were scraping domain information to look for expirations to try to sell SSL certificates.
[41:26.490 --> 41:27.450]  And it was Komodo.
[41:28.130 --> 41:29.350]  And so, this guy called.
[41:29.490 --> 41:30.530]  He left a cryptic message.
[41:30.690 --> 41:32.190]  He didn't identify who he was from.
[41:32.370 --> 41:34.850]  He just said, you need to renew your domain name.
[41:34.970 --> 41:37.070]  And you need to buy hacker proof.
[41:37.510 --> 41:39.990]  Because if you don't, you're going to be vulnerable.
[41:40.170 --> 41:41.030]  So, he left this message.
[41:41.250 --> 41:42.190]  Didn't identify himself.
[41:42.450 --> 41:44.050]  I thought, okay, this is great social engineering.
[41:44.210 --> 41:44.970]  So, I called him back.
[41:45.510 --> 41:49.310]  Pretended to be completely oblivious to what he was talking about.
[41:49.730 --> 41:50.590]  SSP, what, what.
[41:50.590 --> 41:53.290]  And I had the guy on the phone for about 20 minutes.
[41:54.010 --> 41:56.590]  And I was going like, so I need to buy this?
[41:56.630 --> 41:58.250]  He's like, yeah, because the hackers will get you.
[41:58.330 --> 42:00.230]  And I said, well, you mean hackers.
[42:00.230 --> 42:02.330]  The people that do the social engineering thing.
[42:02.490 --> 42:05.210]  Where they call you on the phone and pretend to be someone else.
[42:05.350 --> 42:06.410]  And he's like, yeah.
[42:06.630 --> 42:09.110]  And I said, and no one's ever done that to you before?
[42:09.270 --> 42:10.110]  He's like, oh no.
[42:10.270 --> 42:11.350]  They wouldn't do that to me.
[42:11.530 --> 42:13.390]  And it went on for like 20 minutes.
[42:13.750 --> 42:17.030]  And I managed to find out how he got my name.
[42:17.190 --> 42:18.130]  How he got my number.
[42:18.270 --> 42:19.150]  How it operates.
[42:19.150 --> 42:21.510]  And all of this information from him.
[42:21.650 --> 42:24.670]  By pretending to just not know what was going on.
[42:25.030 --> 42:28.910]  And dropping little things about hackers and social engineering throughout the whole thing.
[42:29.570 --> 42:30.510]  And yeah, it was fun.
[42:30.670 --> 42:31.030]  Brilliant.
[42:31.250 --> 42:32.750]  That's exactly how you do it.
[42:34.870 --> 42:37.370]  But I hope you bought the product.
[42:37.590 --> 42:39.790]  Because that is important that everybody buy that.
[42:39.890 --> 42:41.090]  Because hackers will get you otherwise.
[42:41.090 --> 42:47.490]  No, hackers are used by corporate America to sell so many things.
[42:47.710 --> 42:50.970]  Because if you watch the media, it's always hackers are the threat.
[42:51.250 --> 42:58.670]  Even if a bank leaves 100,000 people's names, addresses, social security numbers on a website somewhere in clear text.
[42:59.010 --> 43:00.790]  It's hackers could have gotten to this.
[43:00.950 --> 43:02.530]  And they're the ones that could have done something bad.
[43:02.710 --> 43:05.530]  Not the company doing something bad by leaving it there in the first place.
[43:05.530 --> 43:08.730]  So yeah, they use hackers to instill fear.
[43:08.970 --> 43:10.650]  And that is a form of social engineering.
[43:10.930 --> 43:12.270]  It victimizes people.
[43:12.990 --> 43:14.370]  So be wary of that.
[43:14.630 --> 43:15.010]  Yes, go ahead.
[43:15.930 --> 43:19.250]  Earlier you used the phrase, sometimes you have to bow out gracefully.
[43:19.410 --> 43:24.130]  And I was just wondering if maybe one of you could share a story when you weren't able to do that.
[43:24.130 --> 43:25.310]  You got into some hot water.
[43:25.610 --> 43:27.430]  Or it kind of backfired on you.
[43:27.450 --> 43:28.590]  Or something like that happened.
[43:28.590 --> 43:32.710]  I actually wanted to get tasered by the Google security force.
[43:33.610 --> 43:34.750]  And it didn't work out.
[43:35.870 --> 43:36.670]  I failed.
[43:38.670 --> 43:43.530]  Because like a couple of years ago we had this idea of like flash mobs are kind of boring in the meantime.
[43:43.790 --> 43:45.830]  So what we wanted to do was sculpture mobs.
[43:46.050 --> 43:47.450]  Because we hate public art.
[43:47.650 --> 43:52.750]  And we thought, why not going to, you know, like the Walmart parking space.
[43:53.070 --> 43:54.330]  Or somewhere else.
[43:54.530 --> 43:58.210]  Go there, build a public sculpture in under five minutes and just like take off.
[43:58.210 --> 44:04.590]  So, and we did the same at the Google, in Mountain View, the Google headquarters.
[44:05.190 --> 44:05.670]  Googleplex.
[44:05.870 --> 44:06.270]  Yeah.
[44:06.530 --> 44:10.910]  So we built this really shitty piece of art called the Great Firewall of China.
[44:13.490 --> 44:15.950]  And then we were waiting for the security guys.
[44:16.190 --> 44:17.690]  And I really wanted to get tasered.
[44:17.830 --> 44:20.390]  But they just like stared at us for two hours and nothing happened.
[44:20.530 --> 44:21.470]  It was a major fail.
[44:23.290 --> 44:26.570]  I actually told this story a few years ago.
[44:26.570 --> 44:29.470]  I'm not sure if I have all the details straight.
[44:29.690 --> 44:35.750]  But a number of years ago when I was in school, we were trying to find out the high-speed modem line.
[44:36.010 --> 44:37.550]  The number for the high-speed modem line.
[44:37.690 --> 44:40.770]  I think 9600 as opposed to the 1200 we were using.
[44:41.170 --> 44:45.550]  And we called the sysadmin of the university to find out what this was.
[44:45.550 --> 44:46.670]  And he was on to us right away.
[44:46.830 --> 44:48.470]  He said, you know, getting that.
[44:48.630 --> 44:49.930]  We're not going to give you that information.
[44:50.090 --> 44:51.670]  How dare you even try to get that information.
[44:51.870 --> 44:54.790]  They're sitting on it like, you know, his little fiefdom and things like that.
[44:54.870 --> 44:55.670]  And he was very indignant.
[44:55.690 --> 44:57.110]  And the call did not end well.
[44:57.550 --> 44:59.030]  We did not back out gracefully.
[45:00.210 --> 45:03.570]  But a couple of minutes later, we thought, you know, this doesn't have to end this way.
[45:03.570 --> 45:10.330]  And so we called back as somebody from the administration building wanting to know what just happened.
[45:10.490 --> 45:13.890]  And sure enough, he had called somebody to report the incident.
[45:14.090 --> 45:17.790]  And then we simply asked him what information were they trying to get.
[45:18.350 --> 45:20.270]  And he gave us the phone line.
[45:28.550 --> 45:32.290]  It doesn't happen often, but, you know, I'll never accept a feat.
[45:34.690 --> 45:35.510]  Next question.
[45:35.830 --> 45:36.170]  Sure.
[45:36.170 --> 45:39.970]  So speaking of tricking people with paper and things that expire.
[45:40.330 --> 45:44.670]  I've got a lot of letters lately saying that my car warranty has expired.
[45:45.030 --> 45:46.750]  And you get these things in the mail.
[45:46.870 --> 45:49.170]  And they come in like these really industrial looking envelopes.
[45:49.270 --> 45:51.150]  They have like no, you know, return address at the top.
[45:51.250 --> 45:51.810]  There's a little window.
[45:52.050 --> 45:56.310]  Like they look like the total cheap bottom of the barrel crap that like, you know, important people send to people.
[45:56.470 --> 45:57.230]  Who they just want to...
[45:57.230 --> 45:59.110]  And then you read this thing and it's like a bill.
[45:59.250 --> 46:01.070]  It's like a just total document that looks authentic.
[46:01.250 --> 46:01.950]  And you turn it over.
[46:02.110 --> 46:05.210]  And it's like, oh, we are in no way related to, you know, your car company.
[46:05.210 --> 46:06.250]  By the way, blah, blah, blah.
[46:06.530 --> 46:09.310]  It's just like, speaking of getting people to buy shit.
[46:09.450 --> 46:11.910]  I mean, just to trick you to get this crap.
[46:12.050 --> 46:14.890]  You don't need to be like, oh shit, my warranty might be out.
[46:14.970 --> 46:15.590]  Oh, what the hell?
[46:15.730 --> 46:16.430]  You know, so...
[46:16.430 --> 46:21.550]  Or getting some kind of a bill in the mail for some kind of a yellow page listing.
[46:21.770 --> 46:21.970]  Right.
[46:22.150 --> 46:24.010]  Or who's who and God knows what.
[46:24.090 --> 46:25.150]  Yeah, you got to watch out if you're a business guy.
[46:25.370 --> 46:29.010]  And corporate people will see that, oh, a bill, send it to accounting, they pay it.
[46:29.010 --> 46:29.110]  Yeah.
[46:29.230 --> 46:31.150]  And hundreds and hundreds, thousands of dollars.
[46:31.990 --> 46:34.310]  People are a bit more dubious to these things.
[46:38.220 --> 46:39.180]  What, no other questions?
[46:40.060 --> 46:40.600]  Go ahead.
[46:40.680 --> 46:42.900]  One more question and we'll try one more thing.
[46:45.380 --> 46:46.680]  We're about the same age.
[46:46.680 --> 46:53.200]  And back in the day when we were growing up, we usually call this thing that we call social engineering now, being a bullshit artist.
[46:53.820 --> 47:01.000]  But what do you think the difference is between being a bullshit artist, being a social engineer, and being just simply a marketer?
[47:01.200 --> 47:01.760]  The fear.
[47:02.240 --> 47:03.480]  It's all the motivation.
[47:03.780 --> 47:05.400]  I mean, we're not trying to sell anything.
[47:05.680 --> 47:09.580]  We're trying to see what we can get, see how secure things are.
[47:09.800 --> 47:10.980]  It's basically testing the system.
[47:11.640 --> 47:20.340]  But a marketer, that's somebody who's going to want to sell something by fooling people and taking advantage of their innocence.
[47:21.040 --> 47:28.840]  And in a way, I like to think that we wake people up to keep that from happening to them by seeing that not everything you hear is true.
[47:28.960 --> 47:32.340]  And there are very many ways to wind up trusting people.
[47:32.440 --> 47:33.800]  People want to trust other people.
[47:33.940 --> 47:35.460]  That's just in our nature.
[47:36.540 --> 47:41.220]  You call somebody on the telephone and you say, you know, trying to help you out here.
[47:41.380 --> 47:42.160]  Just doing my job.
[47:42.380 --> 47:43.200]  You know, it's been a hard day.
[47:43.320 --> 47:43.920]  How are you today?
[47:44.880 --> 47:47.400]  And that's how you gain people's trust.
[47:47.800 --> 47:51.360]  And it's also how you get things done sometimes when you really want to get things done.
[47:52.720 --> 47:55.720]  But too often it's used to your detriment.
[47:55.800 --> 47:57.380]  And you just have to be very careful.
[47:57.640 --> 47:59.080]  Should I be giving out this information?
[47:59.300 --> 48:01.080]  Does this person really need to know this?
[48:01.580 --> 48:07.760]  Because at the same time, we shouldn't be so much of a fortress that we don't let anybody in.
[48:07.920 --> 48:10.240]  That we treat everybody like an enemy.
[48:10.440 --> 48:15.280]  But just think about it first before you actually give out anything of a private nature.
[48:15.460 --> 48:15.600]  Yes.
[48:17.160 --> 48:18.840]  Just to respond to the last guy.
[48:19.160 --> 48:27.120]  I got a lot of phone calls trying to peddle me auto insurance and extra warranties and shit like that.
[48:28.940 --> 48:32.860]  The sucky thing for them was I happen to know telemarketer law.
[48:33.900 --> 48:36.140]  And to know social engineering tricks.
[48:36.440 --> 48:41.180]  So if you try to ask them who they're calling from, what company they are, etc.
[48:41.560 --> 48:45.500]  They'll hang up on you or they'll lie or do various other things.
[48:45.940 --> 48:48.220]  Which is, by the way, a violation of federal law.
[48:49.580 --> 48:52.060]  So basically, you do two things.
[48:52.300 --> 48:58.540]  First off, you play along and you act as if you're really f*cking stupid and technophobic.
[48:58.680 --> 49:01.360]  So you're like, I'd love to buy this.
[49:01.660 --> 49:06.360]  But I need to wait for my spouse to come home to talk to them about it.
[49:06.540 --> 49:09.720]  Is there a direct phone line I can call you back at?
[49:09.920 --> 49:11.380]  Not like your 800 number.
[49:12.300 --> 49:14.880]  Is there an address I can mail a check to?
[49:15.500 --> 49:18.000]  I don't really trust like credit cards.
[49:19.280 --> 49:21.660]  Short version is, I got that info.
[49:22.240 --> 49:23.680]  I sent it to my lawyer.
[49:23.840 --> 49:26.540]  I successfully prosecuted them for a few thousand dollars.
[49:33.720 --> 49:38.100]  And if you want to know how and what the laws are, come talk to me at some point.
[49:38.340 --> 49:38.620]  Okay.
[49:39.020 --> 49:40.900]  Yeah, I just have one remark to that.
[49:42.160 --> 49:44.200]  It's not specifically to that, but in general.
[49:44.200 --> 49:48.380]  I think there are two possibilities to think about social engineering.
[49:48.580 --> 49:52.040]  The one possibility is to almost be an imposter.
[49:52.220 --> 49:55.180]  To be as realistic as possible in the role that you're playing.
[49:55.540 --> 50:00.740]  The other possibility is, and that works quite well most of the time, is that you're completely absurd.
[50:01.180 --> 50:06.960]  For example, you have seen me walking around as this strange Soviet officer maybe in the afternoon, okay?
[50:07.100 --> 50:09.640]  We have been doing this shtick for 10 years now.
[50:09.640 --> 50:15.560]  And the first time we did that is when we kind of like attacked a small village in Austria overnight.
[50:15.580 --> 50:18.460]  And we decorated it with giant Soviet flags.
[50:18.660 --> 50:23.060]  And in the morning, those guys were waking up and saying, what the f*ck is going on?
[50:23.540 --> 50:26.380]  And we were walking in Soviet uniforms.
[50:26.380 --> 50:28.740]  And we were kind of like occupying the town, yeah?
[50:29.440 --> 50:32.420]  And they were calling the police and saying, oh, the Russians are in waiting.
[50:35.820 --> 50:37.960]  And then the police showed up, yeah?
[50:38.080 --> 50:39.960]  And the police tried to talk to me.
[50:40.240 --> 50:42.000]  But I was not breaking character.
[50:42.000 --> 50:46.060]  I was the crazy Soviet officer that you saw in the afternoon.
[50:46.060 --> 50:48.120]  And I was like, what are you doing here?
[50:48.300 --> 50:49.740]  This is an act of war.
[50:49.860 --> 50:51.500]  You cannot come into our country.
[50:51.680 --> 50:52.240]  F*ck off.
[50:52.400 --> 50:53.540]  This is blah, blah, blah, blah, blah, blah, blah.
[50:53.960 --> 50:57.020]  And I remained in character for half an hour.
[50:57.220 --> 51:04.080]  And after half an hour, the one police officer talked to the other police officer and they pretty much said something like, they're idiots.
[51:04.300 --> 51:04.720]  Let's go.
[51:07.080 --> 51:11.060]  And I mean, of course they didn't believe in us.
[51:11.060 --> 51:15.800]  But they were so, like, it was kind of like a buffer overflow for them, I guess.
[51:16.480 --> 51:18.900]  And sometimes that's a good tool to use.
[51:19.400 --> 51:21.260]  I feel like there's a little bit of misconception about social engineering.
[51:21.360 --> 51:22.060]  It's very technical.
[51:22.060 --> 51:23.920]  You have to know these certain ways of doing things.
[51:24.020 --> 51:29.380]  But that's a perfect example that social engineering is more acting or being just absolutely absurd.
[51:29.380 --> 51:33.120]  When I do a workshop, when I teach things, it's more of acting skills.
[51:33.120 --> 51:34.120]  How to present yourself.
[51:34.380 --> 51:38.660]  If it's wearing a Soviet officer's uniform, damn it, you're a Soviet officer and you're not breaking that character.
[51:38.660 --> 51:41.900]  You apply that same mentality to whatever character you create.
[51:42.260 --> 51:44.080]  If it's on a phone, if it's in person, it doesn't matter.
[51:44.560 --> 51:46.720]  But then the bowing out gracefully, go absurd.
[51:46.900 --> 51:47.280]  Why not?
[51:47.440 --> 51:48.100]  You've already failed.
[51:48.260 --> 51:48.780]  Go for it.
[51:51.360 --> 51:51.720]  Yes.
[51:52.180 --> 51:52.540]  Yes.
[51:52.900 --> 51:53.080]  Go ahead.
[51:53.400 --> 51:55.380]  I just found out something rather disturbing.
[51:55.600 --> 51:57.160]  We were going to call something that's 24 hours.
[51:57.260 --> 51:59.320]  I just found out they close at 10 o'clock on Saturdays.
[51:59.980 --> 52:03.420]  So this isn't going to be as effective as I was hoping because there won't be customers in the store.
[52:03.860 --> 52:09.080]  I'll verify that information first and maybe we can change it a little bit so that it...
[52:09.080 --> 52:10.660]  I would really like to call an Olive Garden.
[52:10.780 --> 52:11.960]  Can we call an Olive Garden?
[52:12.260 --> 52:14.260]  Well, it's going to be tough at this time.
[52:14.300 --> 52:15.720]  It's my favorite restaurant chain on the planet.
[52:15.900 --> 52:16.040]  Two minutes.
[52:16.180 --> 52:16.820]  No, we're going...
[52:17.320 --> 52:17.500]  Two minutes.
[52:17.600 --> 52:19.200]  We're going to Best Buy this time.
[52:19.260 --> 52:19.840]  Okay, we have two minutes.
[52:19.980 --> 52:21.520]  Because they probably won't be in business in two years.
[52:21.700 --> 52:22.080]  Two minutes.
[52:23.080 --> 52:24.180]  Look, look, Nick Farr.
[52:24.400 --> 52:25.060]  Two minutes.
[52:25.380 --> 52:26.320]  I see, I see.
[52:26.480 --> 52:27.120]  Two minutes.
[52:27.280 --> 52:27.540]  All right.
[52:28.000 --> 52:29.300]  Let's make this fast.
[52:38.770 --> 52:40.510]  Thank you for calling Best Buy.
[52:40.670 --> 52:42.470]  You have pressed an invalid key.
[52:42.670 --> 52:43.450]  Please try again.
[52:43.590 --> 52:45.410]  For four hours, press one.
[52:45.730 --> 52:47.830]  For directions, press two.
[52:48.150 --> 52:50.950]  To speak to a sales associate, press three.
[52:51.470 --> 52:54.470]  For pricing and availability, press one.
[52:54.790 --> 52:59.510]  For questions regarding a previous purchase and all other questions, press two.
[53:21.720 --> 53:23.520]  They close in six minutes, so I don't know.
[53:39.300 --> 53:41.100]  The places we call tend to go out of business.
[53:46.910 --> 53:47.690]  Okay, you know what?
[53:48.190 --> 53:49.230]  You guys banter for a moment.
[53:49.330 --> 53:51.970]  I'm going to try to find a West Coast version of this quickly.
[53:52.290 --> 53:53.450]  Because you deserve that much.
[53:54.570 --> 53:54.970]  All right.
[53:55.110 --> 53:55.330]  Kill this?
[53:57.990 --> 53:58.530]  Well, go ahead.
[53:58.630 --> 53:58.890]  Banter.
[54:01.070 --> 54:02.590]  So we have to do some banter.
[54:02.590 --> 54:03.570]  Wow.
[54:04.010 --> 54:04.430]  He is...
[54:04.430 --> 54:05.610]  How was your day?
[54:07.610 --> 54:09.290]  Nick Farr said we had two minutes.
[54:09.430 --> 54:11.130]  Have we used our minutes up yet?
[54:11.790 --> 54:13.070]  Can we buy more minutes?
[54:14.210 --> 54:17.350]  We could try to socially engineer Nick Farr.
[54:24.770 --> 54:25.810]  Oh, yes.
[54:25.990 --> 54:26.430]  Yeah, tonight.
[54:26.750 --> 54:31.230]  If you want to see a couple of neo-Marxist sock puppets, midnight here.
[54:31.230 --> 54:31.970]  Yeah.
[54:32.230 --> 54:32.270]  Yeah.
[54:32.790 --> 54:33.190]  Yeah.
[54:34.850 --> 54:35.250]  Yeah.
[54:35.310 --> 54:35.550]  Next door?
[54:36.270 --> 54:37.150]  Want to do any questions?
[54:38.030 --> 54:38.890]  Yeah, why not?
[54:38.990 --> 54:39.070]  Yeah.
[54:39.830 --> 54:40.190]  All right.
[54:40.190 --> 54:43.410]  This is a little more than a question, more like a story.
[54:43.550 --> 54:46.530]  But first of all, did you know that you can just buy police badges?
[54:50.510 --> 54:54.650]  So, as long as they don't say police officer, it's not impersonating an officer.
[54:54.990 --> 54:58.610]  You can buy them from the same company that manufactures them and wait three weeks.
[54:58.710 --> 55:01.110]  And as long as they don't say you're an officer, you're not an officer.
[55:01.110 --> 55:05.050]  So, I have one that says, uh, network operations engineer.
[55:05.650 --> 55:09.350]  And I also live in Virginia, where I open carry a handgun.
[55:09.690 --> 55:14.270]  Long story short, I have never paid full price at 7-Eleven ever.
[55:23.970 --> 55:24.770]  Yeah, yeah.
[55:24.870 --> 55:25.430]  No comment.
[55:25.630 --> 55:25.870]  Okay.
[55:26.390 --> 55:26.750]  Okay.
[55:27.870 --> 55:31.770]  We found one in Los Angeles, so we have until midnight, but we only have about a minute.
[55:31.770 --> 55:31.910]  Oh, we called Los Angeles.
[55:32.350 --> 55:32.410]  Nice.
[55:39.870 --> 55:40.470]  Okay.
[55:44.080 --> 55:46.900]  Thank you for calling Best Buy in West Los Angeles.
[55:47.780 --> 55:50.000]  For store hours, press 1.
[55:50.300 --> 55:52.480]  For directions, press 2.
[55:52.880 --> 55:56.260]  To speak to a Best Buy sales associate, press 3.
[55:56.860 --> 55:59.840]  For pricing and availability, press 1.
[55:59.900 --> 56:00.600]  It might be different.
[56:00.660 --> 56:03.820]  For questions regarding a previous purchase and all other questions...
[56:03.820 --> 56:04.400]  All right, it's the same.
[56:27.300 --> 56:27.900]  Corrosion.
[56:33.350 --> 56:35.270]  They're open till 9 in Los Angeles.
[56:36.270 --> 56:37.310]  It's nowhere near.
[56:40.270 --> 56:41.770]  This is what happens a lot of times.
[56:53.660 --> 56:54.820]  We'll give it five more rings.
[57:04.480 --> 57:05.320]  Isn't this thrilling?
[57:05.460 --> 57:06.260]  This is so much fun.
[57:08.560 --> 57:09.520]  All right, two more rings.
[57:10.540 --> 57:11.860]  It's a bonding experience.
[57:14.000 --> 57:16.460]  Like I said, you never know how these things are gonna turn out.
[57:21.330 --> 57:22.930]  Okay, well, this has been a catastrophe.
[57:26.090 --> 57:26.870]  We're out of time.
[57:27.230 --> 57:29.470]  But what I would have liked to have done...
[57:29.470 --> 57:30.090]  And we'll try this again.
[57:30.710 --> 57:35.130]  I would have liked to have told them that we're updating the satellite feed for their TVs.
[57:35.510 --> 57:39.070]  I actually went down there before to see if they had cable or a satellite.
[57:39.310 --> 57:40.170]  Turns out they have neither.
[57:40.170 --> 57:43.370]  They just have commercials for themselves that they play constantly.
[57:43.610 --> 57:46.710]  But they still get that from a satellite and it has to be updated occasionally.
[57:47.210 --> 57:51.850]  And we were gonna tell them that you have to turn your TVs off to receive the update for about 10 minutes.
[57:52.750 --> 57:55.570]  And that's the worst thing for them to do is turn off all their TVs.
[57:57.110 --> 57:59.130]  But experience shows that they will do things like that.
[58:00.170 --> 58:02.730]  So they have to answer the phone in order to do it in the first place.
[58:03.730 --> 58:08.510]  If you're looking for an interesting prank, try...
[58:08.510 --> 58:10.150]  I'm coming back to Olive Garden.
[58:10.310 --> 58:11.390]  I like my Olive Garden.
[58:12.730 --> 58:19.350]  Call the Olive Garden and tell them that you are like a test person for their chairs.
[58:19.350 --> 58:23.210]  You know, like the Olive Garden chairs are really super big with the...
[58:24.330 --> 58:28.870]  And you are like the test person trying to break those chairs.
[58:31.090 --> 58:34.810]  And you are like a very obese person hired to do their job and blah, blah, blah, blah, blah, blah.
[58:35.190 --> 58:35.690]  Try it.
[58:36.110 --> 58:37.950]  In two years, will you do this for us?
[58:38.110 --> 58:39.470]  I did that in North Dakota.
[58:40.810 --> 58:42.310]  I don't mean really break the chairs.
[58:42.490 --> 58:43.830]  I mean make the phone call to...
[58:43.830 --> 58:44.630]  Why not?
[58:45.310 --> 58:45.750]  Awesome.
[58:48.390 --> 58:50.110]  All right, thank you all for your patience.
[58:50.230 --> 58:51.550]  Well, you don't see that on the phone, you know.
[58:52.210 --> 58:53.330]  We're sorry for running late.
[58:53.450 --> 58:55.350]  We're sorry for not succeeding.