SE VILLAGE - Social Engineering Course Projects for Undergraduate Students
CC Attribution 3.0 Unported:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
Rege, Aunshul
The hard science disciplines (computer science, electrical and computer engineering) have already started investing heavily in cybersecurity education. Security experts, however, note that cybersecurity is a wider discipline than simply the [technical] fields, and professionals with backgrounds [in] the social sciences … will be needed in the cyber workforce of the future. The relevance of incorporating social sciences into the cybersecurity domain has been acknowledged by the National Academies of Sciences, Engineering, and Medicine and the Department of Homeland Security. Social science disciplines, such as sociology, criminology/criminal justice, anthropology, political science, and psychology are particularly adept at unpacking the complex facets of human behavior and should therefore be leveraged for their contributions to the area of cybersecurity. Yet, the social science arena remains weak in cybersecurity training and education of the future cyber workforce. This talk shares an educator’s efforts to engage undergraduate students in a hands-on social engineering project across Fall 2017 and Spring 2018 semesters. It uses the experiential learning framework that promotes “learning by doing”. Specifically, this talk focuses on three sub-projects: (i) shoulder surfing where student teams competed against each other, (ii) laptop distraction, where student teams attempted to convince Temple University Computer Services employees to leave their laptops (designed for the class exercise) so that the students could remove a bogus ‘intellectual property’ file and place a fake ‘malware’ program on the employees’ machines, and (iii) convince individuals on Temple University campus to take a selfie with team members and a funny prop. The talk also offers a comparative analysis of these projects over the two semesters, sharing the experiences and challenges of both the students and this educator. It also details the issues about designing projects that follow university ethics standards, training students in human subjects research ethics, generating relevant rubrics, and how to evaluate student engagement and learning. To conclude, the educator shares these cases discussed to initiate dialog in the area of hands-on learning for social science students. Audience feedback is welcomed as this educator is still exploring the experiential learning approach, especially in the area of social engineering.
 Well, everyone, if you could take your seats, please. We have our final speaker. An-su, right. No, An-su. An-shul, right. Right, like the music. No, that's why. OK, I'm sorry. An-shul Rage. Thank you. She's a criminology professor at Temple University. And she's passionate about educating the next generation workforce about social engineering for social and heart sciences and the relevance of the human factor in cybersecurity. Let's give her her attention. Can everyone hear me OK? So also, before I get started, I'm very excited because this is the first talk that I'm giving after I was awarded tenure a month ago. So. So now I don't have to care about anything, right? It's great. Yeah. So a little bit about me. OK, so I've been at Temple for about six years now. And part of this is a little bit of a story about my own journey as an educator, right? How many students in the audience? Right, OK, so this is something, you know, if you're considering further education, once you go into your master's or your PhD or things like that, the focus is always on your research. Nobody ever tells you how to teach, right? And so all of a sudden, we're thrown into a professor position and the expectations are, yeah, you do your research, you publish, you get grants. But you must also teach. And nobody ever trains you properly for that. So this is something that I'm trying to figure out. It's almost have to learn how to be an educator. So what I'm trying to do today is share some of my own experiences doing experiential learning or hands-on learning in the area of cybersecurity. And this started off as a project for non-technical students because I'm housed in liberal arts. And so my concern was, how am I going to get the liberal arts folks to be able to think about cybersecurity even as a career option? So this is very much a work in progress. I didn't have a foundation to build on. I didn't have any former assignments I could look at to design the rubrics from scratch. OK, so this is very much an experiment. And what I'm trying to share with you are some of those challenges and struggles that I faced, as well as what my students thought about some of the projects that they had to deal with. So I got to start off with my thank yous, the National Science Foundation, the way that NSF works, if you're not familiar, if they fund you for research, but they're also interested in looking at what you do for education. So what I'm sharing with you today is the education side of that grant. I want to thank the Temple University Office of the VP for research. This is where the ethics board is housed. And for all the social engineers here, or the folks that are considering social engineering as a career path, when you're trying to do something in a university setting, the rules are very, very different. So the ethics board was really instrumental in working with me and making these projects happen. I want to thank the university's IT services, because they actually engaged with my students during one of the flags, which is really cool. And of course, I want to thank human hacker. I think he's still out there having conversations with people. But he was really instrumental in this as well. He helped me design one of the flags for my classes. And I think if I didn't get that sort of voice of reason and support and enthusiasm, perhaps these projects wouldn't have taken flight. So what's on the agenda? I want to tell you quickly a little bit about me and what my concerns are as an educator. And where did I get this idea of trying to do social engineering projects in class? Then I'm going to talk about the three flags that we tried to do in class. Shoulder surfing, a group selfie, and laptop distractions. Well, again, to each one of those in a little bit, I'm going to talk about the summaries based on, again, student feedback. And end with some of my own reflections and closing thoughts. Why does this matter? Where would I like to go next? And all of that good stuff. So let's get started. So yes, I'm a criminologist at Temple University. For those of you who don't know where that is, it is in Philadelphia. And I've been there for six years. And my main area of research, my funded projects, look at proactive cybersecurity with an emphasis on adversarial behavior. But I'm not here to talk about research. I'm here to talk about education. And so in the six years that I've been at Temple, I've been teaching an upper level liberal arts class called Computer Prime. And for the first three years that I was teaching this class, I followed the same approaches that I had been subjected to as an undergraduate student. Go research a topic, write a paper about it, and then do a presentation at the end of the semester. Great. And everything was going fine. Every semester I would ask my students, so how many of you would consider a career in cybersecurity? And they said, well, we can't do that. I said, why not? Because we don't know how to code. We don't know how to hack. And I'm saying, yeah, that's important, but you also need to understand that who's doing the hacking is a person. And what do we do in liberal arts is understand human behavior. That's what we're trained to do, right? Be it psychology, sociology, criminology, anthropology, all this stuff. That's what we're trained to do. So you know what? We do have something to contribute. But it's set of alarms. For me, as an educator, I'm doing something wrong if I'm not able to tell my students, you know what? You can pursue a career in cybersecurity, and here is why. So how do you start changing that mindset? So I started looking at my heart science colleagues, because they do work extensively with computer science and electrical and computer engineers. And they were way, way, way ahead of me, right? There are students already have class offerings in the area of pen testing or digital forensics or things like that. So they're actually training students to go out there and pursue careers in cybersecurity. Here's a real sickler. What does that look like in liberal arts, right? How do you get hands-on, experiential learning for the non-technical students? And so this had been brewing in my mind for about three years. I got my first grant, right? Yay, step toward tenure. And again, like I said, this was looking at proactive cybersecurity. So one of the things I look at is the cyber intrusion chain. For those of you who don't know what that is, it's literally a step-by-step process of how an attack unfolds. And I spoke with a lot of ethical hackers, pen testers. And I asked them, which of these stages is the most relevant? What do you think they said? Right? Recon, OK? So we have recon, weaponized delivery, exploit, install, C2, action and objectives. So one of the quotes from one of the pen testers I interviewed really captures it nicely, right? 50% to 75% of the legwork is to learn about the environment ahead of time. Be it through social engineering, calling these people up trying to understand what systems they operate, which is what we saw in the CTF, researching the vendors, right? All of that, oh, sent. OK? So if this is so important, why are we not educating students about this, right? What can these exercises look at? So I know I have an idea, but I don't know how to implement it. And then last summer, I got invited to go and speak at Estonia Cyber Security Summer School. So they have the summer school every year. And last year's theme was social engineering. So they said, hey, can you come and give a talk on your research on online dating scans? I said, sure. So I go there. And what they're doing is this is the first pure social engineering CTF that I've seen at an international level, where you have students from different parts of the world coming in and competing in these flags. And they're doing all these cool things that are listed on here, right? OSINT, creating fake profiles, generating phishing emails and actually disseminating it, shoulder surfing, laptop destruction vision. And I was like, oh, wow. Why did I not think about this? I'm so inspired. I'm excited. Now I have some ideas. I would come back to Temple. What happens? Can I implement this? How have an ethics board? When you are dealing with a student population in a university setting and there's a dissection involved, the ethics board just said, nope. Can't do that. Can't do that. Can't do that. Can't do that. And so it took three months to work with the ethics board and come up with flags that were acceptable. So the two that I could port over were shoulder surfing and laptop distraction. And that's when I said, OK, well, this is great, but I need one more flag. And so last August, I reached out to Human Hacker and I said, hey, I'm doing the social engineering project. Can you help me out? So we started talking. And we went back and forth to the can you try this? I'm like, no, that won't be acceptable. And we ended up with the group selfie flag. And so he said, you know what? Give your students a prop of a squeaking rubber chicken and send them out on campus. And what they have to do is convince someone to take a selfie with that rubber chicken in them. Is that all right? Run it by the ethics board. They said, that's fine. It's safe. It's fun. Logistically possible. And so I said, all right, I have my flags. And I have to now try this out. Again, I had to design the instructions from scratch, the rubrics from scratch, but I had my first project ready. And so I decided I'm going to try this out on my fall 2017 computer crime class. So this was my Guinea Pig class. And just to give you a feel for it, 34 students, 28 in liberal arts. And I had six computer science students. The projects went fine. There were a couple of glitches, which I'm going to talk about. But they gave good feedback. And I learned a lot. And so tweaked the assignments a little bit and did round two in the spring. If 2018 semester is with about 29 students, 20 liberal arts, nine computer science. So what happened? So first flag is shoulder surfing. And basically, students were broken up in teams. And they had to compete against each other. The goal being you have to be able to get a clear shoulder surfing shot of someone from a rival team. So you cannot target anyone outside of the class, because everybody in the class had signed disclaimers. It's like we agree to this activity. Everyone had done their ethics training. So we kept it just to the class. And they also were limited to on campus only. So no, you couldn't follow your classmates home. OK. That was off limits. So I needed to make sure, though, that they weren't cheating. So how do I know that it's you who took that picture? So they had to provide what was called an action shot. So here is a picture of a shoulder surfing successful shot. So they were able to get someone from a rival team, got a picture of the image. This was in a computer lab. And here is the action shot. So this is proof that it was the student who had taken the picture. So students had two weeks to do this. And after the two weeks, they had to give a debriefing, if you will, a 500 presentation about how did they go about doing this, what were the strategies, and so on. So some of the strategies, and these are, I put these into the offense category. So in class, they started remembering who was sitting where, what devices they were using. Arriving to class early, trying to take a bathroom break during class to see if they could find anybody on their devices at that time. The fall 2017 class engaged in something called a honey pot. I'm going to talk about that in a little bit. And outside of class, so this was during class time. Outside of class, they engaged in what was called light stalking. So they actually followed their classmates after class, kept a safe distance between them and their targets, tried to remain in stealth mode. Some of them even cross-referenced to see that other classes with folks from the rival team, so they could target them in other classes. Overall, they said, be patient, persistence pays off. And when the opportunity presents itself, act quickly. So I'm going to talk about these two, the light stalking and the honey pot. So here's a picture of someone from the team who is following this target. And he followed this person for about 20 minutes. If you're wondering where he is, that's a shadow. So he's a good 15, 20 feet behind, following for about 20 minutes on campus until the target stops at a food truck. And that's when he was able to get the successful shot. Now, that was one approach. The other approach was honey pots. So what would happen here? And I only saw this in the fall semester. It's almost like each semester brought its own unique strategies, right? I did not influence any of this. Students could try out. They'd run the strategies by me, but they were allowed to be as creative as they wanted to be. So here we have someone from team A comes to class, sits in the front, opens up her laptop. Someone from team B comes in and says, oh, this is awesome. I got her. I pull up the phone and gets a picture. OK, so I said, why did you do that? Like, you guys got your own picture taken. Really? Yeah, we know. But yeah, so we let them get a picture of us, but we got the picture. And I was like, OK, interestingly, this ended up turning out to be in team B's favor because team A basically provided the action shot. Right? So there was another instance of the honey pot, again, where you have the bait. I'm kind of setting this up because it might be harder for you to read. It's a quick animation that one of the students took, right? So he has someone sitting down. Someone from a rival team come to show that he's got somebody else. So he's bragging. And that's when they get him. OK, so there was a lot of honey pots that were utilized. And I did not, again, see this in the next semester. So some of the defense-based strategies. Everyone was on a high alert. So yes, you had to target someone while also being targeted. So there was this sort of spy versus spy atmosphere. For those two weeks, nobody used their devices in class. Every professor's dream come true, right? So it was great. You saw changes in human behavior. OK, so they changed seating location. They sit at the back of the class. OK. By the walls, OK, they positioned themselves sideways. And they tried using sabotage. I couldn't find a proper term for this. So it's called sabotage. And this was unique to the spring 2018 class. So I'm going to give you the example of what I mean by that. So here's the action shot in progress. OK, the guy with the laptop opening in the blue shirt is a target. Can you see the sabotage going on? Now do you see the sabotage going on? There's a zoomed in version. All right, so they get the picture. And then I get an email about it. And I was like, hey, professor, are we allowed to use this? And I was like, sure. Right, why not? Why not? It's fair game. So doing the debriefing, they actually shared this picture with the class, which is quite entertaining. So some of the challenges that I had to face in the first place was the first flag that we did. People couldn't remember. Students couldn't remember their classmates, right? Because new faces don't remember the names. Sometimes they followed the wrong people, which didn't go over well. OK, they didn't like the fact that they were limited to on campus. But I said, sorry, those are the rules. Trying to get a clear picture, like I said, they had to act quickly. There were a lot of blurry images. They weren't always successful. Like I said, targeting someone well, yourself potentially being a target, was also problematic. They felt uncomfortable and creepy engaging in this activity. Like I said, they could only target each other. But when they were doing this outside of class, people would look at them really funny, right? And so students were like, can we get some special t-shirt or a letter from you that says that this is for a class project? I said, no, right? So there was that feeling of being weird. The last sort of one that was really interesting is coordinating action shots, right? So outside of class, people in your team aren't going to have the same schedule as you. So how do you get someone to prove that you took the picture? And the spring 2018 class came up with a solution. They said, we're just going to do selfies. And so that's what they did. So that was a workaround on the action shot requirements. They got the shoulder surfing picture, and they proved that they were there. So this was their first activity. It was a good sort of warm-up flag in both the semesters. And then we decided to go with the next one, which is the group selfie with a temple citizen and an awkward prop. So this was a flag that had been recommended by a human hacker. And for this, again, this was team-based. So each team had to give me their script ahead of time, which is what they plan to use to approach someone and convince them as to why that person should take a selfie with the team and the rubber chicken. So the scripts were sent to me two weeks in advance. I had to make sure, first of all, that the script was OK. And also, let no two teams have the same script. And to ensure that there would be no conflict in scheduling, I gave them dedicated class time, because that's when everyone is supposed to be there anyways. So they got about two dedicated classes. Once they approached someone, they couldn't say that this was for the class project until after they had gotten the selfie. And again, this was on campus. And they were given two classes, another week to get their debriefing done, which basically meant they had to create a short video about their experience. So I'm going to share some of the videos that my students made. And I thought they did a pretty good job. So hopefully the audio works. I'm going to try this out. So for our first thing, we did frat boy pledging. Justin's going to be the pledge. And his pledge is that he has to get selfies with people holding the rubber chicken. We decided to meet outside of the bail building. And then, of course, we run immediately into someone we can't ask, because it's Leon. So being in our class, we were not allowed to ask him to participate. Justin got out the rubber chicken, and we sent him off to attack students and other people who were passing by. And pretty much we was told to go get someone. So we did. He walked off to the nearest strangers and approached them. Some of them didn't even give him the time of day. I guess that's not surprising, given that's the city. Sorry about my spare change. It's a pretty normal reaction when someone approaches you randomly in the city. I don't really blame that guy. So Justin just kept walking to the next person. Got to give it the old college try, because at first you'll succeed. You keep walking down the street, and you keep asking everybody you see. And then eventually, if you're lucky and persistent, you reach two nice people who say yes. So Justin brought those people back to Justin in front of the Bell Center, and we explained that he was pledging and that we needed to get a selfie with the rubber chicken. And here we go. We got our selfie mission accomplished. OK. And this is one by another team. Don't be a check-in. Ah! With college students in mind as our targets, we wanted to come up with a strategy that would engage them without being obvious about our intentions. Ever since we got at Chick-fil-A on campus, they've been noticeably popular. The lines for it are always super long, so we use the popularity of Chick-fil-A to our advantage. It made more sense to have a chicken-related strategy in order to get people to take a picture with us and our rubber chicken. So our story was that we are prankster and YouTubers who wanted people to do the chicken dance for our channel. However, we didn't want to be obvious about that, so we came up with three chicken challenges, and we'd reward the target with chicken nuggets from Chick-fil-A. So to prepare, we looked up some chicken facts from what was originally supposed to be a quiz, and we went to the Student Activity Center and bought Chick-fil-A nuggets for our reward. This was during lunchtime outside of the Student Activity Center. So it was fairly opportunistic to find some hungry college students. I made one announcement stating that if you completed our chicken challenges, you could win some free Chick-fil-A chicken nuggets. One target came up immediately asking what he had to do for free food. I told him that all he had to do was pass the chicken challenges. I asked him if we could take a video for our YouTube channel, to which he said yes to promptly. The first chicken challenge was to answer a chicken question, which was what is the male chicken called? That is a rooster. So I'm going to pause here for one second. If you're wondering why there was a zoom in on the guy in the back, just sort of remember this scene. I'm going to come back to it in a little bit. Again, is to demonstrate what sound a chicken makes while doing the well-known chicken dance. The third was to take a picture with a rubber chicken. He completed all the challenges successfully, and we joined in the frame for our selfie. After our selfie, we told him about the class project, and he walked away happily with his free chicken. As far as lessons we learned, we learned that we couldn't be around too many of the other groups with chickens. We all went about the same time during the designated class time. So it was a little conspicuous and noticeable that something could be going on. Another lesson that we learned was that if you incentivize an activity, don't bring more eager targets, which seems obvious, but if you know your audience as well, like college students, they're going to be more willing to participate and likely do anything for food, especially if it's around meal time. And the third lesson that we learned was that people don't really care if they're on social media with strangers and how easily their information is obtained. We didn't do a wave or anything like that. So he unknowingly just gave his face for our YouTube channel without knowing it could be abused or anything like that. So a couple of glitches. Each team was given the same prop, and they were out with the same prop at the same time. This caused problems because, like I said, the guy, I totally remember the scene where they zoomed in. He was actually someone from a different team. The problem was that they were approaching targets with the same prop and different stories at the same time. So potential targets are going to be like, what's going on? So that was a problem. And one of the feedback, obviously, that I got from the students was, hey, can you please use different props for the next semester? So sure enough, I did. I kept, of course, the rubber chicken. And then I got a giant stuffed Minnie Mouse, a sock monkey, a Hello Kitty pillow, a swimming-o llama, and a unicorn. This was the most assorted mix I could find in a short amount of time. And so again, I'm going to share with you real quick the unicorn video. And this is now for the spring 2018 semester. MUSIC Script 3 is a personal favorite. We went in with the intention of having a staring contest with the unicorn. Little do we know, it would turn into one of the most rewarding experiences we had. We used the unicorn as bait to get our target to have a staring contest with Rob. Initially, the goal was to have a staring contest with the unicorn. But in all fairness to our contestant, we went with Rob. A clock can get the experiment time. Put a timer on. See how long we can get it up. All right, so get your eyes open. On, on, on, what? Feel you have to stop. Oh, it's snow. I blinked. Yes. Do you see the sling? Yes, you blinked. All right. So you don't get to win the unicorn. But if you mind if I take a picture with you. I'll be there. Yeah, yeah, yeah. You've got a friend. OK, so some of the strategies based on student debriefings and reports. OK, so how did the students go about doing this? They first decided to be cognizant of what potential targets were doing. What are they working on? Are they doing homework? Are they surfing? Are they eating? Are they chatting with their friends? They had to stick to their script, but they also had to be able to adapt based on that script. So for instance, the group that got the stuffed llama, they came up with the script of Save the Llama Foundation. So a lot of students were interested in that, and they asked them a lot of tough questions. So they had a good story prepared. They were able to adapt. Some of the strategies, like is it pretexting, obviously? Quit pro quo, right? We saw that offering food for the target's time or to get the selfie, playing on the emotional card, right? We want to save the flamingos. We want to save the llamas. So there's that desire of wanting to please. Some of the challenges, like I said, getting out of the comfort zone, right? So going out and actually approaching people was interesting. The spring 2018 class was scheduled for 9 in the morning. So it was hard to find people on campus at 9 AM. And even though the props had changed, the teams were still bumping into each other, even though now with different props, but it's still kind of wise everyone walking around campus with different props, right? So that's something now that we have to figure out. The last activity, the last flag, was the laptop distraction flag. So again, this was team-based. And what happened here was folks from the information technology services came in with a laptop. And the team had to distract the representative from the laptop. That was the objective, using a story and whatever you wanted to do to adapt. So they had to come up with a script, which again, had to be sent to me in advance to ensure that no two teams would have the same scripts. And we did this in class. So the IT representatives came in class. We dedicated the entire class time to this, so about two or three classes. And they were given two minutes of prep time, five minutes to actually execute the activity. And then they had a two-minute debriefing with the IT services representatives. So just a note here. They were not graded on whether or not they were successful in getting the person away from the laptop. What they were graded on is what strategy did they use? How convincing were they? Were they able to adapt in those five minutes? So again, there's a whole bunch of different videos, but I'm not going to be able to share them with you. So the one that I am sharing with you is from the fall 2017 semester. This was a two-student team. And I like this clip a lot because their execution was very, very smooth. They stayed calm and remained in character, even when things weren't going their way. And they adapted the best, in the best possible way that they could. All right, so it's a two-student team. And the folks that they're targeting are against the back wall. OK, so when you see this video, you'll know what's going on. It may be a little hard to hear because they were moving around all over the place. So I've tried to insert cues where possible to help guide you. How's it going? I'm Christopher Gattie. This is Brian Shad. Is it OK for me to leave? With you? With you, my role. No, with you. We made an appointment. We called you last week to schedule. And they did in the arms fire. I forgot to tell you. And the schedule, they were in with your appointment. Oh, OK. All right. Was it? We have the idea set up in the back door, so we can just run by and we'll see you in five minutes. Did the interviewer move back in the way? Oh, all right. Can you give me some context? So it's definitely a new website. It's here. And the area does this go to. There's a lot of people who do a little bit of research. So we have a little teaching department talking there. Again, we'll feel it's working to introduce them to the students, people looking at the schools or investors that are working in the sort of shell companies. Five years of active research. And I'm trying to get viewers out there. So what's going on with this again? Are you guys from? I'm not from simply university. I'm a girls' friend. I'm just trying to tell you. So what I do is I'm hired, and I just write for the university. So I won't be a friend of the girls, but that's the right way. I want to school for it. I don't think I should be. So if you actually do that, you get there's no reason that we don't want to come in. And then I'm just going to say, this is my laptop. I know it's your laptop. That's what it could be. We don't want to do that. Let's just do the easy one. We already have an area to sit down. Oh, no. I'm just going to walk with you on that. I'm sorry. I can't lead you to the policies. But I was wondering if you could let me. Ah, OK. All right. Seth, do you mind watching my laptop? I don't know what it's that way. No. I don't know. No. No. No. No. No. No. No. No. No. No. No. No. No. No. No. No. No. No. No. No. No. No. No. Nov. No. No. No. No. No. No. No. OK. Just describe a typical work week of USDA-7? It's great. It starts Monday morning, typically with YouTube or ethane. We craft those week then. Usually, depending on the number of issues, we see what the week doesn't make you a busy morning. channel we're looking for and it's a fact. I'm sorry to do this but actually, T-Mines coming up here as well, so we can talk to the boss as well. Just get both people doing it. Yeah, sure. Get both people doing it. Come on up, we're going to have both of you in the room at the same time. Get all four of them, nice and simple. We're at the big interview now. My partner is going to go with the other two interns here. So what is the work environment? I know it's a little bit of a question of the boss. Yeah, I know that's a big question. I would say it's become better over time. We have an ECIO stage. How would you say, how is it working? Okay, so I'm going to pause it right there. And basically, if you were to put this out in a playbook format, okay, it's very interesting, right? So they have a good context. They come with a good backstory. Temple is making a new website. They've hired us as ghost writers to get a feel that's why we're talking to you. When there was sort of a credibility check, what do you mean, ghost writers, right? So they actually clarified the term. They had done their research. They were able to defend that. When the first target gets up with a laptop, they said, sorry, you don't need it. You don't want it to get damaged. That doesn't work. We have everything set up. You don't need to bring it. That didn't work. It violates policy. Okay, so they tried hitting the target with three different types of adaptation right there. When you have the first pass of the laptop, okay, they asked for a dual interview. When you had the second pass of the laptop, they split up. Okay, and so on and on it goes. So again, the team ultimately ran out of time and they were not successful, but they still ended up scoring. Getting a perfect score, basically, because they kept at it and they stayed calm and they tried to make it work. This was the only team that used sort of a calm approach. All the other teams had emergency scenarios. So we had four teams with law enforcement scenarios, okay, where they came in and they accused the people from IT services of some type of wrongdoing. So we had four teams doing that. Two teams came up with disaster scenarios. So they had chemical spills. So teams came in with fog machines. Other teams came in with hazmat suits. Okay, so they did a couple of, somebody even came in and did a fake pregnancy, like giving birth. So it was madness, but all of them came up with emergency scenarios, right? So some of the students thought, okay, props and costumes. Interestingly, the fall 2017 teams were better prepared than the spring 2018 teams. They had stronger stories, better prepared, better equipped. Their biggest thing was unanticipated tag teaming, right? And so the IT services did a couple of other mean things, like, you know, they got access to the laptop, but that's when they were, they scheduled system updates. So they couldn't, you know, actually get to the device or anything like that. They took the battery out so they couldn't start the laptop. So all those types of things. But one of the things, I think it became really easy for the teams that were using emergency scripts. So in the spring 2018 semester, Ashley said you can't do emergency scenarios. And that made it really, really difficult. So some teams came up with some interesting things. One was a birthday celebration surprise. Okay, so they came in and took the person away to play some party games. Because they were IT service representatives, they came in seeking tech support help. And there were a few other creative ones in there. And I don't have the time to get into that. But what I do want to talk about is the flag summary. Okay, now that I've done this across two semesters, I found that the shoulder surfing activity, the students really liked as having that as the first one. Because they felt that it was a great warm up exercise. We don't know what social engineering is. We don't know what we're going to do. So here's a good, safe, fun one to start with. The downside, of course, is, well, we don't know our classmates yet. Okay. The laptop distraction activity, that was the most dynamic. The students had way too much fun with that, right? Because it was in real time. But the downside was they said it was one of the toughest ones. Because you only had five minutes and you had to do this. The group selfie, they enjoyed that a lot. They said they got to be creative with it, but they needed more time. Okay, so overall the structure of the flags were, you know, the instructions were clear, easy to follow. They were happy with the amount of time that they were given. And the only change they said was can you make the laptop distraction activity as the last flag? Okay, because that was the toughest one. So the first two would give us enough sort of prep time and let us warm up and hopefully engage with the ID services folks a little bit better. So in closing, what does this mean for me as an educator? Implementing social engineering projects are not easy. Okay. In terms of logistics, duration, structure coming up with the entire setting, it was quite challenging for me. One of the main challenges was getting approval from the University Ethics Committee. And ethics was a big point of discussion yesterday. A lot of speakers brought that into their talks. I think it's even tougher and trickier when you're dealing in a university setting. So yes, there were a lot more restrictions on the flags that designed the implementations, but they still worked with me and we made it work. Okay, so was it the best flag? Is it something like perhaps what you all do professionally? No, but it's a starting point. Designing rubrics, how do you grade a project like this? What are your categories? What are your weights going to be? How many points do you give for these different things? So how do you do that? One of my biggest challenges was catering to the computer and information science students. So as I mentioned, I had six students in the fall semester from computer science and about nine in the spring semester. Their biggest thing was, do we have to talk to people? And I said, yes, welcome to the liberal arts. You do, of course you have to talk to people, right? Because they're just like, well, can we write a script that would like execute? I'm like, no, you can't know, right? You are not hacking a computer system, you are hacking the human. So they actually found this very challenging. Some other things that I'm now going through my mind is, how do I develop ethically acceptable variations? So one of the things that the students really wanted was, hey, if we're doing a group selfie project with a prop, can we target professors? I don't know how my colleagues would feel about that. Right? I'm tenured now, yes, but I still like my job, right? I do at some point again want to be promoted. How do I come up with good props? So there were a lot of students who were like, yeah, we need, I think almost like giving someone a llama and a flamingo actually was, the props were cute. So it actually worked in their favor. So that might be some tougher props and that the students would have to really come up with unique storylines. Shoulder surfing. They said, yeah, we'll do this, but if we get you, do we get bonus points? Right? So for the first year, I didn't really do any of that because this was, like I said, an experiment. I'm trying to figure out what the heck I'm doing. But in the next year, when I introduced this, that might be a possibility. So in closing, right? This is not the first experiential learning project that I've done. This is actually the second one. Social engineering is the second one that I've tried out. Okay, I've worked with electrical and computer engineers, I'd have national labs, right? We did something where we simulated power grid cyber attacks and then my students ended up playing adversary. They designed the attacks that were launched against the electrical and computer engineering students. We did that and that actually is a talk that I had presented earlier at Shmukhan this year. So why am I trying to do this? Okay, I think it's really important to emphasize and that's why I love this village so much, right? That cybersecurity is not just technical. It's that there is a lot of human aspects to it. So how can disciplines in the sort of social sciences and liberal arts make their students realize that what they're doing is important and they can contribute, that they do have a voice? And initially I'd started this as something I wanted to do for the liberal arts students, but I think hard science students can also benefit from this, right? So it's kind of moved beyond just for the liberal arts right now. It was a heck of a lot of fun. Okay, students had a great time, IT services had a great time, they were excited that somebody asked them to engage with their students. The biggest thing for me, and this is I think the last point that I have here, is I was able to create at least a small slice of it, right? But create something effective, safe and fun, okay, for students. And I think what's really important is that we need to educate the educators, okay? It is risky to think outside the box, but I think it pays off, because you take your education, your pedagogical culture in a whole new direction, and I think that's really cool. So I do have new flags for the spring 2019 semester in the works, but if you have any suggestions or feedback, I'm happy to take anything really, because I do need a lot of help with this, it's not easy. And so with that, I just want to say thank you for your time and attention. Thank you. Liberal Arts? He was in media and communications. So, yeah, yeah. Right, so if you notice in both the videos, right, they had a guy walking in the back, and in the voiceover they said we couldn't ask him because he's in our class. And the second one was Zoom in, was also because that was someone from another team. The problem was they were all crossing the paths because they were all out there on campus doing this at the exact same time, and that caused problems, right? Because they all had different stories, so it's going to cause conflict if they approach the same target at time T, and then five minutes later a different team comes with the same problems and says, hey, we're doing it for this reason, that kind of messes things up. So the Zoom in was basically to show that there's intersections going on. Yeah. Yes? What about students from the production here, performing arts students, to do kind of the back and forth, to play out what were the questions for the class? Yeah, you know, one of the biggest criticisms, and I think it's a valid criticism that I got from my students is, well, it's not fair because the IT services folks know what's going to happen, right? So they're going to make our lives difficult, and yes, that was true, but they didn't know what the script was going to be. Okay, so I literally had to form a barrier between the tech representatives, between the students. So even when I had the spring 2018 class, I didn't tell them the strategies that the IT services had to use the fall semester, which was passing off the laptops. So it's so new, but it is a possibility. Yeah. So... Thank you.
 Well, everyone, if you could take your seats, please.  We have our final speaker.  An-su, right.  No, An-su.  An-shul, right.  Right, like the music.  No, that's why.  OK, I'm sorry.  An-shul Rage.  Thank you.  She's a criminology professor at Temple University.  And she's passionate about educating the next generation  workforce about social engineering  for social and heart sciences and the relevance  of the human factor in cybersecurity.  Let's give her her attention.  Can everyone hear me OK?  So also, before I get started, I'm  very excited because this is the first talk  that I'm giving after I was awarded tenure a month ago.  So.  So now I don't have to care about anything, right?  It's great.  Yeah.  So a little bit about me.  OK, so I've been at Temple for about six years now.  And part of this is a little bit of a story  about my own journey as an educator, right?  How many students in the audience?  Right, OK, so this is something, you know,  if you're considering further education,  once you go into your master's or your PhD or things  like that, the focus is always on your research.  Nobody ever tells you how to teach, right?  And so all of a sudden, we're thrown into a professor position  and the expectations are, yeah, you do your research,  you publish, you get grants.  But you must also teach.  And nobody ever trains you properly for that.  So this is something that I'm trying to figure out.  It's almost have to learn how to be an educator.  So what I'm trying to do today is share  some of my own experiences doing experiential learning  or hands-on learning in the area of cybersecurity.  And this started off as a project for non-technical students  because I'm housed in liberal arts.  And so my concern was, how am I going  to get the liberal arts folks to be  able to think about cybersecurity  even as a career option?  So this is very much a work in progress.  I didn't have a foundation to build on.  I didn't have any former assignments I could look at  to design the rubrics from scratch.  OK, so this is very much an experiment.  And what I'm trying to share with you  are some of those challenges and struggles that I faced,  as well as what my students thought  about some of the projects that they had to deal with.  So I got to start off with my thank yous, the National Science  Foundation, the way that NSF works, if you're not familiar,  if they fund you for research, but they're also  interested in looking at what you do for education.  So what I'm sharing with you today  is the education side of that grant.  I want to thank the Temple University Office of the VP  for research.  This is where the ethics board is housed.  And for all the social engineers here,  or the folks that are considering social engineering  as a career path, when you're trying  to do something in a university setting,  the rules are very, very different.  So the ethics board was really instrumental in working with me  and making these projects happen.  I want to thank the university's IT services,  because they actually engaged with my students  during one of the flags, which is really cool.  And of course, I want to thank human hacker.  I think he's still out there having conversations  with people.  But he was really instrumental in this as well.  He helped me design one of the flags for my classes.  And I think if I didn't get that sort of voice of reason  and support and enthusiasm, perhaps these projects  wouldn't have taken flight.  So what's on the agenda?  I want to tell you quickly a little bit about me  and what my concerns are as an educator.  And where did I get this idea of trying  to do social engineering projects in class?  Then I'm going to talk about the three flags  that we tried to do in class.  Shoulder surfing, a group selfie, and laptop distractions.  Well, again, to each one of those in a little bit,  I'm going to talk about the summaries based on, again,  student feedback.  And end with some of my own reflections and closing thoughts.  Why does this matter?  Where would I like to go next?  And all of that good stuff.  So let's get started.  So yes, I'm a criminologist at Temple University.  For those of you who don't know where that is,  it is in Philadelphia.  And I've been there for six years.  And my main area of research, my funded projects,  look at proactive cybersecurity with an emphasis  on adversarial behavior.  But I'm not here to talk about research.  I'm here to talk about education.  And so in the six years that I've been at Temple,  I've been teaching an upper level liberal arts  class called Computer Prime.  And for the first three years that I was teaching this class,  I followed the same approaches that I had been subjected  to as an undergraduate student.  Go research a topic, write a paper about it,  and then do a presentation at the end of the semester.  Great.  And everything was going fine.  Every semester I would ask my students,  so how many of you would consider a career in cybersecurity?  And they said, well, we can't do that.  I said, why not?  Because we don't know how to code.  We don't know how to hack.  And I'm saying, yeah, that's important,  but you also need to understand that who's doing the hacking  is a person.  And what do we do in liberal arts  is understand human behavior.  That's what we're trained to do, right?  Be it psychology, sociology, criminology, anthropology,  all this stuff.  That's what we're trained to do.  So you know what?  We do have something to contribute.  But it's set of alarms.  For me, as an educator, I'm doing something wrong  if I'm not able to tell my students, you know what?  You can pursue a career in cybersecurity, and here is why.  So how do you start changing that mindset?  So I started looking at my heart science colleagues,  because they do work extensively with computer science  and electrical and computer engineers.  And they were way, way, way ahead of me, right?  There are students already have class offerings  in the area of pen testing or digital forensics  or things like that.  So they're actually training students  to go out there and pursue careers in cybersecurity.  Here's a real sickler.  What does that look like in liberal arts, right?  How do you get hands-on, experiential learning  for the non-technical students?  And so this had been brewing in my mind for about three years.  I got my first grant, right?  Yay, step toward tenure.  And again, like I said, this was looking  at proactive cybersecurity.  So one of the things I look at is the cyber intrusion chain.  For those of you who don't know what that is,  it's literally a step-by-step process  of how an attack unfolds.  And I spoke with a lot of ethical hackers, pen testers.  And I asked them, which of these stages is the most relevant?  What do you think they said?  Right?  Recon, OK?  So we have recon, weaponized delivery, exploit, install,  C2, action and objectives.  So one of the quotes from one of the pen testers I interviewed  really captures it nicely, right?  50% to 75% of the legwork is to learn about the environment  ahead of time.  Be it through social engineering, calling these people up  trying to understand what systems they operate, which  is what we saw in the CTF, researching the vendors, right?  All of that, oh, sent.  OK?  So if this is so important, why are we not educating students  about this, right?  What can these exercises look at?  So I know I have an idea, but I don't know how to implement it.  And then last summer, I got invited  to go and speak at Estonia Cyber Security Summer School.  So they have the summer school every year.  And last year's theme was social engineering.  So they said, hey, can you come and give a talk  on your research on online dating scans?  I said, sure.  So I go there.  And what they're doing is this is the first pure social  engineering CTF that I've seen at an international level,  where you have students from different parts of the world  coming in and competing in these flags.  And they're doing all these cool things  that are listed on here, right?  OSINT, creating fake profiles, generating phishing emails  and actually disseminating it, shoulder surfing,  laptop destruction vision.  And I was like, oh, wow.  Why did I not think about this?  I'm so inspired.  I'm excited.  Now I have some ideas.  I would come back to Temple.  What happens?  Can I implement this?  How have an ethics board?  When you are dealing with a student population  in a university setting and there's  a dissection involved, the ethics board just said, nope.  Can't do that.  Can't do that.  Can't do that.  Can't do that.  And so it took three months to work with the ethics board  and come up with flags that were acceptable.  So the two that I could port over were shoulder surfing  and laptop distraction.  And that's when I said, OK, well, this is great,  but I need one more flag.  And so last August, I reached out to Human Hacker  and I said, hey, I'm doing the social engineering project.  Can you help me out?  So we started talking.  And we went back and forth to the can you try this?  I'm like, no, that won't be acceptable.  And we ended up with the group selfie flag.  And so he said, you know what?  Give your students a prop of a squeaking rubber chicken  and send them out on campus.  And what they have to do is convince someone  to take a selfie with that rubber chicken in them.  Is that all right?  Run it by the ethics board.  They said, that's fine.  It's safe.  It's fun.  Logistically possible.  And so I said, all right, I have my flags.  And I have to now try this out.  Again, I had to design the instructions from scratch,  the rubrics from scratch, but I had my first project ready.  And so I decided I'm going to try this out on my fall 2017  computer crime class.  So this was my Guinea Pig class.  And just to give you a feel for it,  34 students, 28 in liberal arts.  And I had six computer science students.  The projects went fine.  There were a couple of glitches, which  I'm going to talk about.  But they gave good feedback.  And I learned a lot.  And so tweaked the assignments a little bit  and did round two in the spring.  If 2018 semester is with about 29 students,  20 liberal arts, nine computer science.  So what happened?  So first flag is shoulder surfing.  And basically, students were broken up in teams.  And they had to compete against each other.  The goal being you have to be able to get a clear shoulder  surfing shot of someone from a rival team.  So you cannot target anyone outside of the class,  because everybody in the class had signed disclaimers.  It's like we agree to this activity.  Everyone had done their ethics training.  So we kept it just to the class.  And they also were limited to on campus only.  So no, you couldn't follow your classmates home.  OK.  That was off limits.  So I needed to make sure, though, that they weren't cheating.  So how do I know that it's you who took that picture?  So they had to provide what was called an action shot.  So here is a picture of a shoulder surfing successful shot.  So they were able to get someone from a rival team,  got a picture of the image.  This was in a computer lab.  And here is the action shot.  So this is proof that it was the student who  had taken the picture.  So students had two weeks to do this.  And after the two weeks, they had to give a debriefing,  if you will, a 500 presentation about how  did they go about doing this, what were the strategies,  and so on.  So some of the strategies, and these are,  I put these into the offense category.  So in class, they started remembering  who was sitting where, what devices they were using.  Arriving to class early, trying to take a bathroom break  during class to see if they could find anybody  on their devices at that time.  The fall 2017 class engaged in something called a honey pot.  I'm going to talk about that in a little bit.  And outside of class, so this was during class time.  Outside of class, they engaged in what  was called light stalking.  So they actually followed their classmates after class,  kept a safe distance between them and their targets,  tried to remain in stealth mode.  Some of them even cross-referenced  to see that other classes with folks from the rival team,  so they could target them in other classes.  Overall, they said, be patient, persistence pays off.  And when the opportunity presents itself, act quickly.  So I'm going to talk about these two, the light stalking  and the honey pot.  So here's a picture of someone from the team  who is following this target.  And he followed this person for about 20 minutes.  If you're wondering where he is, that's a shadow.  So he's a good 15, 20 feet behind,  following for about 20 minutes on campus  until the target stops at a food truck.  And that's when he was able to get the successful shot.  Now, that was one approach.  The other approach was honey pots.  So what would happen here?  And I only saw this in the fall semester.  It's almost like each semester brought  its own unique strategies, right?  I did not influence any of this.  Students could try out.  They'd run the strategies by me, but they  were allowed to be as creative as they wanted to be.  So here we have someone from team A comes to class,  sits in the front, opens up her laptop.  Someone from team B comes in and says, oh, this is awesome.  I got her.  I pull up the phone and gets a picture.  OK, so I said, why did you do that?  Like, you guys got your own picture taken.  Really?  Yeah, we know.  But yeah, so we let them get a picture of us,  but we got the picture.  And I was like, OK, interestingly,  this ended up turning out to be in team B's favor  because team A basically provided the action shot.  Right?  So there was another instance of the honey pot, again,  where you have the bait.  I'm kind of setting this up because it might be harder  for you to read.  It's a quick animation that one of the students took, right?  So he has someone sitting down.  Someone from a rival team come to show  that he's got somebody else.  So he's bragging.  And that's when they get him.  OK, so there was a lot of honey pots that were utilized.  And I did not, again, see this in the next semester.  So some of the defense-based strategies.  Everyone was on a high alert.  So yes, you had to target someone  while also being targeted.  So there was this sort of spy versus spy atmosphere.  For those two weeks, nobody used their devices in class.  Every professor's dream come true, right?  So it was great.  You saw changes in human behavior.  OK, so they changed seating location.  They sit at the back of the class.  OK.  By the walls, OK, they positioned themselves sideways.  And they tried using sabotage.  I couldn't find a proper term for this.  So it's called sabotage.  And this was unique to the spring 2018 class.  So I'm going to give you the example of what I mean by that.  So here's the action shot in progress.  OK, the guy with the laptop opening in the blue shirt  is a target.  Can you see the sabotage going on?  Now do you see the sabotage going on?  There's a zoomed in version.  All right, so they get the picture.  And then I get an email about it.  And I was like, hey, professor, are we allowed to use this?  And I was like, sure.  Right, why not?  Why not?  It's fair game.  So doing the debriefing, they actually  shared this picture with the class,  which is quite entertaining.  So some of the challenges that I had  to face in the first place was the first flag that we did.  People couldn't remember.  Students couldn't remember their classmates, right?  Because new faces don't remember the names.  Sometimes they followed the wrong people,  which didn't go over well.  OK, they didn't like the fact that they were limited to on campus.  But I said, sorry, those are the rules.  Trying to get a clear picture, like I said,  they had to act quickly.  There were a lot of blurry images.  They weren't always successful.  Like I said, targeting someone well, yourself potentially  being a target, was also problematic.  They felt uncomfortable and creepy engaging in this activity.  Like I said, they could only target each other.  But when they were doing this outside of class,  people would look at them really funny, right?  And so students were like, can we get some special t-shirt  or a letter from you that says that this is for a class project?  I said, no, right?  So there was that feeling of being weird.  The last sort of one that was really interesting  is coordinating action shots, right?  So outside of class, people in your team  aren't going to have the same schedule as you.  So how do you get someone to prove that you took the picture?  And the spring 2018 class came up with a solution.  They said, we're just going to do selfies.  And so that's what they did.  So that was a workaround on the action shot requirements.  They got the shoulder surfing picture,  and they proved that they were there.  So this was their first activity.  It was a good sort of warm-up flag in both the semesters.  And then we decided to go with the next one, which  is the group selfie with a temple citizen  and an awkward prop.  So this was a flag that had been recommended by a human hacker.  And for this, again, this was team-based.  So each team had to give me their script ahead of time,  which is what they plan to use to approach someone  and convince them as to why that person should  take a selfie with the team and the rubber chicken.  So the scripts were sent to me two weeks in advance.  I had to make sure, first of all, that the script was OK.  And also, let no two teams have the same script.  And to ensure that there would be no conflict in scheduling,  I gave them dedicated class time, because that's when everyone  is supposed to be there anyways.  So they got about two dedicated classes.  Once they approached someone, they couldn't say that this  was for the class project until after they had gotten  the selfie.  And again, this was on campus.  And they were given two classes, another week  to get their debriefing done, which basically  meant they had to create a short video about their experience.  So I'm going to share some of the videos that my students made.  And I thought they did a pretty good job.  So hopefully the audio works.  I'm going to try this out.  So for our first thing, we did frat boy pledging.  Justin's going to be the pledge.  And his pledge is that he has to get selfies with people  holding the rubber chicken.  We decided to meet outside of the bail building.  And then, of course, we run immediately into someone  we can't ask, because it's Leon.  So being in our class, we were not  allowed to ask him to participate.  Justin got out the rubber chicken, and we sent him off  to attack students and other people who were passing by.  And pretty much we was told to go get someone.  So we did.  He walked off to the nearest strangers  and approached them.  Some of them didn't even give him the time of day.  I guess that's not surprising, given that's the city.  Sorry about my spare change.  It's a pretty normal reaction when someone approaches you  randomly in the city.  I don't really blame that guy.  So Justin just kept walking to the next person.  Got to give it the old college try,  because at first you'll succeed.  You keep walking down the street,  and you keep asking everybody you see.  And then eventually, if you're lucky and persistent,  you reach two nice people who say yes.  So Justin brought those people back to Justin  in front of the Bell Center, and we explained  that he was pledging and that we needed to get a selfie  with the rubber chicken.  And here we go.  We got our selfie mission accomplished.  OK.  And this is one by another team.  Don't be a check-in.  Ah!  With college students in mind as our targets,  we wanted to come up with a strategy that  would engage them without being obvious about our intentions.  Ever since we got at Chick-fil-A on campus,  they've been noticeably popular.  The lines for it are always super long,  so we use the popularity of Chick-fil-A to our advantage.  It made more sense to have a chicken-related strategy  in order to get people to take a picture with us  and our rubber chicken.  So our story was that we are prankster and YouTubers  who wanted people to do the chicken dance for our channel.  However, we didn't want to be obvious about that,  so we came up with three chicken challenges,  and we'd reward the target with chicken nuggets  from Chick-fil-A. So to prepare, we looked up some chicken  facts from what was originally supposed to be a quiz,  and we went to the Student Activity Center  and bought Chick-fil-A nuggets for our reward.  This was during lunchtime outside of the Student Activity  Center.  So it was fairly opportunistic to find  some hungry college students.  I made one announcement stating that if you completed  our chicken challenges, you could win some free Chick-fil-A  chicken nuggets.  One target came up immediately asking  what he had to do for free food.  I told him that all he had to do was pass the chicken challenges.  I asked him if we could take a video for our YouTube channel,  to which he said yes to promptly.  The first chicken challenge was to answer a chicken question,  which was what is the male chicken called?  That is a rooster.  So I'm going to pause here for one second.  If you're wondering why there was a zoom in on the guy  in the back, just sort of remember this scene.  I'm going to come back to it in a little bit.  Again, is to demonstrate what sound a chicken makes  while doing the well-known chicken dance.  The third was to take a picture with a rubber chicken.  He completed all the challenges successfully,  and we joined in the frame for our selfie.  After our selfie, we told him about the class project,  and he walked away happily with his free chicken.  As far as lessons we learned, we learned  that we couldn't be around too many of the other groups  with chickens.  We all went about the same time during the designated class  time.  So it was a little conspicuous and noticeable  that something could be going on.  Another lesson that we learned was that if you incentivize  an activity, don't bring more eager targets, which  seems obvious, but if you know your audience as well,  like college students, they're going  to be more willing to participate and likely do  anything for food, especially if it's around meal time.  And the third lesson that we learned  was that people don't really care  if they're on social media with strangers  and how easily their information is obtained.  We didn't do a wave or anything like that.  So he unknowingly just gave his face  for our YouTube channel without knowing it  could be abused or anything like that.  So a couple of glitches.  Each team was given the same prop,  and they were out with the same prop at the same time.  This caused problems because, like I said,  the guy, I totally remember the scene where they zoomed in.  He was actually someone from a different team.  The problem was that they were approaching targets  with the same prop and different stories at the same time.  So potential targets are going to be like, what's going on?  So that was a problem.  And one of the feedback, obviously,  that I got from the students was, hey,  can you please use different props for the next semester?  So sure enough, I did.  I kept, of course, the rubber chicken.  And then I got a giant stuffed Minnie Mouse, a sock monkey,  a Hello Kitty pillow, a swimming-o llama, and a unicorn.  This was the most assorted mix I could find  in a short amount of time.  And so again, I'm going to share with you real quick  the unicorn video.  And this is now for the spring 2018 semester.  MUSIC  Script 3 is a personal favorite.  We went in with the intention of having a staring contest  with the unicorn.  Little do we know, it would turn into one of the most  rewarding experiences we had.  We used the unicorn as bait to get our target to have  a staring contest with Rob.  Initially, the goal was to have a staring contest  with the unicorn.  But in all fairness to our contestant, we went with Rob.  A clock can get the experiment time.  Put a timer on.  See how long we can get it up.  All right, so get your eyes open.  On, on, on, what?  Feel you have to stop.  Oh, it's snow.  I blinked.  Yes.  Do you see the sling?  Yes, you blinked.  All right.  So you don't get to win the unicorn.  But if you mind if I take a picture with you.  I'll be there.  Yeah, yeah, yeah.  You've got a friend.  OK, so some of the strategies based on student debriefings  and reports.  OK, so how did the students go about doing this?  They first decided to be cognizant of what potential  targets were doing.  What are they working on?  Are they doing homework?  Are they surfing?  Are they eating?  Are they chatting with their friends?  They had to stick to their script,  but they also had to be able to adapt based on that script.  So for instance, the group that got the stuffed llama,  they came up with the script of Save the Llama Foundation.  So a lot of students were interested in that,  and they asked them a lot of tough questions.  So they had a good story prepared.  They were able to adapt.  Some of the strategies, like is it pretexting, obviously?  Quit pro quo, right?  We saw that offering food for the target's time  or to get the selfie, playing on the emotional card, right?  We want to save the flamingos.  We want to save the llamas.  So there's that desire of wanting to please.  Some of the challenges, like I said,  getting out of the comfort zone, right?  So going out and actually approaching people was interesting.  The spring 2018 class was scheduled for 9 in the morning.  So it was hard to find people on campus at 9 AM.  And even though the props had changed,  the teams were still bumping into each other,  even though now with different props,  but it's still kind of wise everyone walking around  campus with different props, right?  So that's something now that we have to figure out.  The last activity, the last flag,  was the laptop distraction flag.  So again, this was team-based.  And what happened here was folks from the information  technology services came in with a laptop.  And the team had to distract the representative  from the laptop.  That was the objective, using a story and whatever  you wanted to do to adapt.  So they had to come up with a script, which again,  had to be sent to me in advance to ensure that no two teams would  have the same scripts.  And we did this in class.  So the IT representatives came in class.  We dedicated the entire class time to this,  so about two or three classes.  And they were given two minutes of prep time, five minutes  to actually execute the activity.  And then they had a two-minute debriefing  with the IT services representatives.  So just a note here.  They were not graded on whether or not  they were successful in getting the person away  from the laptop.  What they were graded on is what strategy did they use?  How convincing were they?  Were they able to adapt in those five minutes?  So again, there's a whole bunch of different videos,  but I'm not going to be able to share them with you.  So the one that I am sharing with you  is from the fall 2017 semester.  This was a two-student team.  And I like this clip a lot because their execution  was very, very smooth.  They stayed calm and remained in character,  even when things weren't going their way.  And they adapted the best, in the best possible way  that they could.  All right, so it's a two-student team.  And the folks that they're targeting  are against the back wall.  OK, so when you see this video, you'll know what's going on.  It may be a little hard to hear because they were moving around  all over the place.  So I've tried to insert cues where possible to help guide you.  How's it going?  I'm Christopher Gattie.  This is Brian Shad.  Is it OK for me to leave?  With you?  With you, my role.  No, with you.  We made an appointment.  We called you last week to schedule.  And they did in the arms fire.  I forgot to tell you.  And the schedule, they were in with your appointment.  Oh, OK.  All right.  Was it?  We have the idea set up in the back door,  so we can just run by and we'll see you in five minutes.  Did the interviewer move back in the way?  Oh, all right.  Can you give me some context?  So it's definitely a new website.  It's here.  And the area does this go to.  There's a lot of people who do a little bit of research.  So we have a little teaching department talking there.  Again, we'll feel it's working to introduce them  to the students, people looking at the schools  or investors that are working in the sort of shell companies.  Five years of active research.  And I'm trying to get viewers out there.  So what's going on with this again?  Are you guys from?  I'm not from simply university.  I'm a girls' friend.  I'm just trying to tell you.  So what I do is I'm hired, and I just  write for the university.  So I won't be a friend of the girls, but that's the right way.  I want to school for it.  I don't think I should be.  So if you actually do that, you get there's no reason  that we don't want to come in.  And then I'm just going to say, this is my laptop.  I know it's your laptop.  That's what it could be.  We don't want to do that.  Let's just do the easy one.  We already have an area to sit down.  Oh, no.  I'm just going to walk with you on that.  I'm sorry.  I can't lead you to the policies.  But I was wondering if you could let me.  Ah, OK.  All right.  Seth, do you mind watching my laptop?  I don't know what it's that way.  No.  I don't know.  No.  No.  No.  No.  No.  No.  No.  No.  No.  No.  No.  No.  No.  No.  No.  No.  No.  No.  No.  No.  No.  No.  No.  Nov.  No.  No.  No.  No.  No.  No.  No.  OK.  Just describe a typical work week of USDA-7?  It's great.  It starts Monday morning, typically with YouTube  or ethane.  We craft those week then.  Usually, depending on the number of issues,  we see what the week doesn't make you a busy morning.  channel we're looking for and it's a fact.  I'm sorry to do this but actually,  T-Mines coming up here as well, so we can talk to the boss as well.  Just get both people doing it.  Yeah, sure.  Get both people doing it.  Come on up, we're going to have both of you in the room at the same time.  Get all four of them, nice and simple.  We're at the big interview now. My partner is going to go with the other two interns here.  So what is the work environment?  I know it's a little bit of a question of the boss.  Yeah, I know that's a big question.  I would say it's become better over time.  We have an ECIO stage.  How would you say, how is it working?  Okay, so I'm going to pause it right there.  And basically, if you were to put this out in a playbook format, okay, it's very interesting, right?  So they have a good context.  They come with a good backstory.  Temple is making a new website.  They've hired us as ghost writers to get a feel that's why we're talking to you.  When there was sort of a credibility check, what do you mean, ghost writers, right?  So they actually clarified the term.  They had done their research.  They were able to defend that.  When the first target gets up with a laptop, they said, sorry, you don't need it.  You don't want it to get damaged.  That doesn't work.  We have everything set up.  You don't need to bring it.  That didn't work.  It violates policy.  Okay, so they tried hitting the target with three different types of adaptation right there.  When you have the first pass of the laptop, okay, they asked for a dual interview.  When you had the second pass of the laptop, they split up.  Okay, and so on and on it goes.  So again, the team ultimately ran out of time and they were not successful, but they still ended up scoring.  Getting a perfect score, basically, because they kept at it and they stayed calm and they tried to make it work.  This was the only team that used sort of a calm approach.  All the other teams had emergency scenarios.  So we had four teams with law enforcement scenarios, okay, where they came in and they accused the people from IT services of some type of wrongdoing.  So we had four teams doing that.  Two teams came up with disaster scenarios.  So they had chemical spills.  So teams came in with fog machines.  Other teams came in with hazmat suits.  Okay, so they did a couple of, somebody even came in and did a fake pregnancy, like giving birth.  So it was madness, but all of them came up with emergency scenarios, right?  So some of the students thought, okay, props and costumes.  Interestingly, the fall 2017 teams were better prepared than the spring 2018 teams.  They had stronger stories, better prepared, better equipped.  Their biggest thing was unanticipated tag teaming, right?  And so the IT services did a couple of other mean things, like, you know, they got access to the laptop, but that's when they were, they scheduled system updates.  So they couldn't, you know, actually get to the device or anything like that.  They took the battery out so they couldn't start the laptop.  So all those types of things. But one of the things, I think it became really easy for the teams that were using emergency scripts.  So in the spring 2018 semester, Ashley said you can't do emergency scenarios.  And that made it really, really difficult.  So some teams came up with some interesting things.  One was a birthday celebration surprise.  Okay, so they came in and took the person away to play some party games.  Because they were IT service representatives, they came in seeking tech support help.  And there were a few other creative ones in there.  And I don't have the time to get into that.  But what I do want to talk about is the flag summary.  Okay, now that I've done this across two semesters,  I found that the shoulder surfing activity, the students really liked as having that as the first one.  Because they felt that it was a great warm up exercise.  We don't know what social engineering is. We don't know what we're going to do.  So here's a good, safe, fun one to start with.  The downside, of course, is, well, we don't know our classmates yet.  Okay.  The laptop distraction activity, that was the most dynamic.  The students had way too much fun with that, right?  Because it was in real time.  But the downside was they said it was one of the toughest ones.  Because you only had five minutes and you had to do this.  The group selfie, they enjoyed that a lot.  They said they got to be creative with it, but they needed more time.  Okay, so overall the structure of the flags were, you know, the instructions were clear, easy to follow.  They were happy with the amount of time that they were given.  And the only change they said was can you make the laptop distraction activity as the last flag?  Okay, because that was the toughest one.  So the first two would give us enough sort of prep time and let us warm up and hopefully engage with the ID services folks a little bit better.  So in closing, what does this mean for me as an educator?  Implementing social engineering projects are not easy.  Okay.  In terms of logistics, duration, structure coming up with the entire setting, it was quite challenging for me.  One of the main challenges was getting approval from the University Ethics Committee.  And ethics was a big point of discussion yesterday.  A lot of speakers brought that into their talks.  I think it's even tougher and trickier when you're dealing in a university setting.  So yes, there were a lot more restrictions on the flags that designed the implementations, but they still worked with me and we made it work.  Okay, so was it the best flag?  Is it something like perhaps what you all do professionally?  No, but it's a starting point.  Designing rubrics, how do you grade a project like this?  What are your categories?  What are your weights going to be?  How many points do you give for these different things?  So how do you do that?  One of my biggest challenges was catering to the computer and information science students.  So as I mentioned, I had six students in the fall semester from computer science and about nine in the spring semester.  Their biggest thing was, do we have to talk to people?  And I said, yes, welcome to the liberal arts.  You do, of course you have to talk to people, right?  Because they're just like, well, can we write a script that would like execute?  I'm like, no, you can't know, right?  You are not hacking a computer system, you are hacking the human.  So they actually found this very challenging.  Some other things that I'm now going through my mind is, how do I develop ethically acceptable variations?  So one of the things that the students really wanted was, hey, if we're doing a group selfie project with a prop, can we target professors?  I don't know how my colleagues would feel about that.  Right?  I'm tenured now, yes, but I still like my job, right?  I do at some point again want to be promoted.  How do I come up with good props?  So there were a lot of students who were like, yeah, we need, I think almost like giving someone a llama and a flamingo actually was, the props were cute.  So it actually worked in their favor.  So that might be some tougher props and that the students would have to really come up with unique storylines.  Shoulder surfing.  They said, yeah, we'll do this, but if we get you, do we get bonus points?  Right?  So for the first year, I didn't really do any of that because this was, like I said, an experiment.  I'm trying to figure out what the heck I'm doing.  But in the next year, when I introduced this, that might be a possibility.  So in closing, right?  This is not the first experiential learning project that I've done.  This is actually the second one.  Social engineering is the second one that I've tried out.  Okay, I've worked with electrical and computer engineers, I'd have national labs, right?  We did something where we simulated power grid cyber attacks and then my students ended up playing adversary.  They designed the attacks that were launched against the electrical and computer engineering students.  We did that and that actually is a talk that I had presented earlier at Shmukhan this year.  So why am I trying to do this?  Okay, I think it's really important to emphasize and that's why I love this village so much, right?  That cybersecurity is not just technical.  It's that there is a lot of human aspects to it.  So how can disciplines in the sort of social sciences and liberal arts make their students realize  that what they're doing is important and they can contribute, that they do have a voice?  And initially I'd started this as something I wanted to do for the liberal arts students,  but I think hard science students can also benefit from this, right?  So it's kind of moved beyond just for the liberal arts right now.  It was a heck of a lot of fun.  Okay, students had a great time, IT services had a great time,  they were excited that somebody asked them to engage with their students.  The biggest thing for me, and this is I think the last point that I have here,  is I was able to create at least a small slice of it, right?  But create something effective, safe and fun, okay, for students.  And I think what's really important is that we need to educate the educators, okay?  It is risky to think outside the box, but I think it pays off,  because you take your education, your pedagogical culture in a whole new direction,  and I think that's really cool.  So I do have new flags for the spring 2019 semester in the works,  but if you have any suggestions or feedback,  I'm happy to take anything really, because I do need a lot of help with this, it's not easy.  And so with that, I just want to say thank you for your time and attention.  Thank you.  Liberal Arts?  He was in media and communications.  So, yeah, yeah.  Right, so if you notice in both the videos, right, they had a guy walking in the back,  and in the voiceover they said we couldn't ask him because he's in our class.  And the second one was Zoom in, was also because that was someone from another team.  The problem was they were all crossing the paths because they were all out there on campus  doing this at the exact same time, and that caused problems, right?  Because they all had different stories, so it's going to cause conflict  if they approach the same target at time T, and then five minutes later  a different team comes with the same problems and says,  hey, we're doing it for this reason, that kind of messes things up.  So the Zoom in was basically to show that there's intersections going on.  Yeah.  Yes?  What about students from the production here,  performing arts students, to do kind of the back and forth,  to play out what were the questions for the class?  Yeah, you know, one of the biggest criticisms, and I think it's a valid criticism  that I got from my students is, well, it's not fair because the IT services folks  know what's going to happen, right?  So they're going to make our lives difficult, and yes, that was true,  but they didn't know what the script was going to be.  Okay, so I literally had to form a barrier between the tech representatives,  between the students.  So even when I had the spring 2018 class, I didn't tell them the strategies  that the IT services had to use the fall semester, which was passing off the laptops.  So it's so new, but it is a possibility.  Yeah.  So...  Thank you.
DEF_CON_26_SE_VILLAGE_-_Aunshul_Rege_-_Social_Engineering_Course_Projects_for_Undergrads_zp5FxnuFg7g_0_599.png DEF_CON_26_SE_VILLAGE_-_Aunshul_Rege_-_Social_Engineering_Course_Projects_for_Undergrads_zp5FxnuFg7g_600_851.png DEF_CON_26_SE_VILLAGE_-_Aunshul_Rege_-_Social_Engineering_Course_Projects_for_Undergrads_zp5FxnuFg7g_852_923.png DEF_CON_26_SE_VILLAGE_-_Aunshul_Rege_-_Social_Engineering_Course_Projects_for_Undergrads_zp5FxnuFg7g_924_971.png DEF_CON_26_SE_VILLAGE_-_Aunshul_Rege_-_Social_Engineering_Course_Projects_for_Undergrads_zp5FxnuFg7g_972_1019.png DEF_CON_26_SE_VILLAGE_-_Aunshul_Rege_-_Social_Engineering_Course_Projects_for_Undergrads_zp5FxnuFg7g_1020_1067.png DEF_CON_26_SE_VILLAGE_-_Aunshul_Rege_-_Social_Engineering_Course_Projects_for_Undergrads_zp5FxnuFg7g_1068_1115.png DEF_CON_26_SE_VILLAGE_-_Aunshul_Rege_-_Social_Engineering_Course_Projects_for_Undergrads_zp5FxnuFg7g_1116_1175.png DEF_CON_26_SE_VILLAGE_-_Aunshul_Rege_-_Social_Engineering_Course_Projects_for_Undergrads_zp5FxnuFg7g_1176_1295.png DEF_CON_26_SE_VILLAGE_-_Aunshul_Rege_-_Social_Engineering_Course_Projects_for_Undergrads_zp5FxnuFg7g_1296_5111.png DEF_CON_26_SE_VILLAGE_-_Aunshul_Rege_-_Social_Engineering_Course_Projects_for_Undergrads_zp5FxnuFg7g_5112_24947.png DEF_CON_26_SE_VILLAGE_-_Aunshul_Rege_-_Social_Engineering_Course_Projects_for_Undergrads_zp5FxnuFg7g_24948_26747.png DEF_CON_26_SE_VILLAGE_-_Aunshul_Rege_-_Social_Engineering_Course_Projects_for_Undergrads_zp5FxnuFg7g_26748_26795.png DEF_CON_26_SE_VILLAGE_-_Aunshul_Rege_-_Social_Engineering_Course_Projects_for_Undergrads_zp5FxnuFg7g_26796_27143.png DEF_CON_26_SE_VILLAGE_-_Aunshul_Rege_-_Social_Engineering_Course_Projects_for_Undergrads_zp5FxnuFg7g_27144_30815.png DEF_CON_26_SE_VILLAGE_-_Aunshul_Rege_-_Social_Engineering_Course_Projects_for_Undergrads_zp5FxnuFg7g_30816_33827.png DEF_CON_26_SE_VILLAGE_-_Aunshul_Rege_-_Social_Engineering_Course_Projects_for_Undergrads_zp5FxnuFg7g_33828_33959.png DEF_CON_26_SE_VILLAGE_-_Aunshul_Rege_-_Social_Engineering_Course_Projects_for_Undergrads_zp5FxnuFg7g_33960_34103.png DEF_CON_26_SE_VILLAGE_-_Aunshul_Rege_-_Social_Engineering_Course_Projects_for_Undergrads_zp5FxnuFg7g_34104_38519.png DEF_CON_26_SE_VILLAGE_-_Aunshul_Rege_-_Social_Engineering_Course_Projects_for_Undergrads_zp5FxnuFg7g_38520_38603.png DEF_CON_26_SE_VILLAGE_-_Aunshul_Rege_-_Social_Engineering_Course_Projects_for_Undergrads_zp5FxnuFg7g_38604_38651.png DEF_CON_26_SE_VILLAGE_-_Aunshul_Rege_-_Social_Engineering_Course_Projects_for_Undergrads_zp5FxnuFg7g_38652_41159.png DEF_CON_26_SE_VILLAGE_-_Aunshul_Rege_-_Social_Engineering_Course_Projects_for_Undergrads_zp5FxnuFg7g_41160_41207.png DEF_CON_26_SE_VILLAGE_-_Aunshul_Rege_-_Social_Engineering_Course_Projects_for_Undergrads_zp5FxnuFg7g_41208_41255.png DEF_CON_26_SE_VILLAGE_-_Aunshul_Rege_-_Social_Engineering_Course_Projects_for_Undergrads_zp5FxnuFg7g_41256_42551.png DEF_CON_26_SE_VILLAGE_-_Aunshul_Rege_-_Social_Engineering_Course_Projects_for_Undergrads_zp5FxnuFg7g_42552_42599.png DEF_CON_26_SE_VILLAGE_-_Aunshul_Rege_-_Social_Engineering_Course_Projects_for_Undergrads_zp5FxnuFg7g_42600_42719.png DEF_CON_26_SE_VILLAGE_-_Aunshul_Rege_-_Social_Engineering_Course_Projects_for_Undergrads_zp5FxnuFg7g_42720_44855.png DEF_CON_26_SE_VILLAGE_-_Aunshul_Rege_-_Social_Engineering_Course_Projects_for_Undergrads_zp5FxnuFg7g_44856_48335.png DEF_CON_26_SE_VILLAGE_-_Aunshul_Rege_-_Social_Engineering_Course_Projects_for_Undergrads_zp5FxnuFg7g_48336_50135.png DEF_CON_26_SE_VILLAGE_-_Aunshul_Rege_-_Social_Engineering_Course_Projects_for_Undergrads_zp5FxnuFg7g_50136_50303.png DEF_CON_26_SE_VILLAGE_-_Aunshul_Rege_-_Social_Engineering_Course_Projects_for_Undergrads_zp5FxnuFg7g_50304_52595.png DEF_CON_26_SE_VILLAGE_-_Aunshul_Rege_-_Social_Engineering_Course_Projects_for_Undergrads_zp5FxnuFg7g_52596_63935.png DEF_CON_26_SE_VILLAGE_-_Aunshul_Rege_-_Social_Engineering_Course_Projects_for_Undergrads_zp5FxnuFg7g_63936_72467.png DEF_CON_26_SE_VILLAGE_-_Aunshul_Rege_-_Social_Engineering_Course_Projects_for_Undergrads_zp5FxnuFg7g_72468_72515.png DEF_CON_26_SE_VILLAGE_-_Aunshul_Rege_-_Social_Engineering_Course_Projects_for_Undergrads_zp5FxnuFg7g_72516_72563.png DEF_CON_26_SE_VILLAGE_-_Aunshul_Rege_-_Social_Engineering_Course_Projects_for_Undergrads_zp5FxnuFg7g_72564_72959.png DEF_CON_26_SE_VILLAGE_-_Aunshul_Rege_-_Social_Engineering_Course_Projects_for_Undergrads_zp5FxnuFg7g_72960_73007.png DEF_CON_26_SE_VILLAGE_-_Aunshul_Rege_-_Social_Engineering_Course_Projects_for_Undergrads_zp5FxnuFg7g_73008_73055.png DEF_CON_26_SE_VILLAGE_-_Aunshul_Rege_-_Social_Engineering_Course_Projects_for_Undergrads_zp5FxnuFg7g_73056_73103.png DEF_CON_26_SE_VILLAGE_-_Aunshul_Rege_-_Social_Engineering_Course_Projects_for_Undergrads_zp5FxnuFg7g_73104_73835.png DEF_CON_26_SE_VILLAGE_-_Aunshul_Rege_-_Social_Engineering_Course_Projects_for_Undergrads_zp5FxnuFg7g_73836_76128.png