107: Alethe

Alethe, a social engineer working for Critical Insight is good at reading people because of the series of unfortunate events and terrible relationships she faced in her life. Growing up in South Africa, Alethe had to grow up quickly when her parents separated when she was just seven years old. Her mom, who was like a cool big sister, let her explore her creative ideas and take risks without any guardrails. Alethe's interest in social engineering grew over time and she now helps organizations providing critical infrastructure, including DoD contractors, to secure their systems. Alethe's unique journey shows that sometimes our past experiences can lead us to unexpected and valuable places.

Growing up with limited resources and freedom, Alethe developed manipulation and sneaky behaviors as a pre-teen. However, a strict Catholic school experience taught her the negative consequences of lying and over-embellishing. Despite the setback, Alethe's interest in computers and coding provided a focus and direction for her life. She pursued studies in science and computer science, ultimately leading to a fulfilling career. The key takeaway is that early experiences, both negative and positive, can have a significant impact on an individual's life trajectory and skill development.

Alethe's experience of being groomed by a stranger she met online highlights the dangers of interacting with strangers online. Her story emphasizes the importance of being vigilant and aware while interacting with people online and not sharing personal information easily. Alethe's career journey, starting with a minimum wage job, teaches us the value of perseverance in difficult times and how small jobs can lead to a lot of learning and opportunities. Her acquisition of OSINT skills through her work at a title company highlights the power of publicly available information and reiterates the importance of staying informed and aware of the digital footprint we leave behind.

Defcon is an annual hacking conference that features various villages where participants can try to hack different devices and systems. The Social Engineering Village is one of the most popular ones, where people learn how to manipulate others to get what they want. The main event in this village is the social engineering Capture the Flag contest, where contestants try to get information from a target company live on stage, with five hundred to a thousand hackers watching. The contestants have six weeks to investigate their target and gather information, and then they have twenty minutes to make the call and try to get specific flags of information assigned by the contest runners. It is a high-pressure situation that requires an in-depth understanding of social engineering tactics.

Social engineering is a powerful tool that can help improve communication, and interpersonal skills in different settings such as business and relationships. Participating in interactive events such as capture the flag contests can help develop confidence and sharpen OSINT skills. Public sources are valuable to learn more about a target, but one has to be creative in gathering information while staying ethical. The hacking culture can offer a feeling of belonging and acceptance that can be difficult to find elsewhere. Being a misfit is not an issue in this environment and honing social engineering skills can be beneficial to anyone.

Being over-prepared with knowledge about the company, its culture and the technologies they use through OSINT can equip social engineers with necessary information to succeed in social engineering. Social engineers use company websites, review sites, job descriptions and Google dorking to gain insights into the company's internal processes. Social media platforms like Instagram can reveal geotagged employee pictures with company IDs, badges, applications open on the monitor, and locations of the cafeteria. Such information can be used to impersonate an internal employee, vendor, or a trusted entity and get access to sensitive information. The better equipped social engineers are with the data collected, the better his/her chances of success in social engineering.

Alethe had a well-prepared plan and pretext for social engineering Capture the Flag competition, which helped her to secure the third position. She had researched her targets thoroughly and had a clear idea of her goals for the call. Alethe had gone into the competition determined to do better than sixth, and focused on doing better than the previous year. She had a low-tech approach; she brought in three sheets of paper, one with a list of all the flags she had prioritized, another with her pretext person and target details, and the third with key points of her pretext and goals for the call. This helped Alethe to win and enjoy the game more than anything.

Competing in a hacking competition with a three-month-old baby is not recommended, but Alethe, an experienced mother, managed it. She missed some calls to care for her baby and prayed she wouldn't cry while she competed. She pretexted as a new intern to access tech support and then targeted regional salespeople of a tobacco company. She used OSINT to learn about the company and confirmed information with the salespeople. She knew that the salespeople had company-issued laptops and cell phones, among other perks, which made it easy to ask confirmation questions. Alethe's experience shows that with determination, focus, and preparation, mothers can balance competing and caregiving responsibilities.

The approach taken for verifying software and applications on remote workers' laptops before shipping replacements out was successful due to building trust and being friendly while making calls. The person calling from IT used a tactic of introducing themselves as an internal employee from the headquarters, incentivizing with a new laptop, and creating a relatable conversation with the other person. The approach effectively removed objections and made the other person feel secure about the authenticity of the call. The friendly interaction led to the other person being forthcoming with information, leading to a successful outcome. However, the person who made the calls is concerned about the impact on the other person and feels the need to make amends and apologize after the fact.

Participating in safe learning experiences can help you learn from mistakes and improve skills. Winning competitions can lead to prestigious awards like the Defcon black badge, which can open up job opportunities. However, success often requires hard work, perseverance, and sacrifices. Alethe's journey to winning the social engineering contest involved over-researching her targets, impressing the audience with her flags and time management, missing her flight, attending the closing ceremonies with her baby, and driving seven hours overnight to get back home. Despite the challenges, Alethe hoped to turn her passion into a career or business. Overall, success requires a combination of talent, effort, and opportunity.

Social engineering is an emerging security field that helps companies identify and strengthen their weak points. It involves manipulating human psychology, which scammers and cybercriminals also use to exploit vulnerabilities. Companies can hire social engineers for physical assessments and phishing campaigns to test employees' ability to recognize and report suspicious activity. Regular security awareness training is also essential to avoid falling into the traps of social engineers. For those who aspire to enter the field, starting a consulting business and specializing in social engineering assessments and testing is an excellent option. Joining a security company, like Critical Insight, can also provide ample learning opportunities and exposure to different clients.

Phishing is a serious security threat and businesses should be cautious. Social engineers use tactics like setting up a landing page and making a suspicious URL to trick employees into providing their credentials. Alethe's job includes running phishing campaigns for companies and she emphasises the importance of running towards uncomfortable conversations that are organic and real to get good at this. People are becoming more aware of social engineering, and companies should aim to achieve between a 10% or 20% click rate rather than expecting 30% to 40% or 30% to 60%. Alethe's clients include organizations involved in critical infrastructure or even Department of Defense contractors. It is vital to be mindful of phishing attacks and their consequences.