Social Engineering Attacks: Lessons from Mr. Robot Episode 3

you found the backup wrap up your go-to podcast for all things

backup recovery and cyber recovery.

In this episode, we look at social engineering tactics in our analysis

of the Mr. Robot Series persona, and I will break down how one character

uses Instagram stalking, personal information gathering, and even

sleeping with somebody to compromise their phone and steal sensitive emails.

We also talk about, uh, how cybersecurity budgets, low ones, like the $7,000 budget

they talk about in the show, create vulnerabilities that hackers will exploit.

We look at how social engineering attacks work, what you can do to

protect yourself and your organization.

By the way, if you don't know who I am, I'm w Curtis Preston, AKA, Mr.

Backup, and I've been passionate about backup and recovery for over 30 years.

Ever since.

I had to tell my boss that there were no backups of that database we just lost.

I don't want that to happen to you, and that's why I do this.

On this podcast, we turn unappreciated backup admins into cyber recovery heroes.

This is the backup wrap up.

Welcome to the show.

Hi, I am w Curtis Preston, AKA, Mr. Backup, and I have with me a guy who

is also celebrating the return of the Tesla Prasanna Malaiyandi How's it going?

Prasanna,

I was like, what am I celebrating?

It's, I'm

return of the Tesla, it's all back.

you got it back and then you had to put it back and then you got it back again.

I did, I had to put it back.

Or give

uh.

say.

Yeah, the, the hood, the hood was slightly misaligned and then, and

then, and there was some, some clear, clear coat over spray on a

completely different part of the car.

So like, it was, I guess the wind or something took some that was, that was

not, I wasn't very happy about that.

I,

be spraying outdoors just saying.

So today we're gonna

Yeah,

series on Mr. Robot,

Mr. Robots.

and we are today on.

Episode three, which is

1.2.

1.2, according to their naming, labeled debug M kv.

Yeah.

me about the numbering, but it all gets confusing, so

it all starts at zero.

Yeah.

So normal people call it episode three.

Uh, that's why I'm saying episode 1.2.

He wakes up in hospital after being dumped off the pier, uh, from Mr. Robot.

And, uh, you know, he's obviously, uh, uh, upset.

Angela shows up with his psychiatrist,

Right, right.

is like, I'm not gonna let you go because you're the one who called

me and said, come, come, come.

Yeah.

And she's like, are you using, I need you to get a drug test every

two weeks or whatever it is to make sure you're not still using,

Yeah.

gonna sign you out.

Yeah.

And he agrees to do that.

But by drug test, what he means is I'm gonna hack the hospital and

And,

Yeah,

how he has like, he tells someone, and then you have like the inner voice Go on.

yeah, yeah, yeah.

And he is like, this is the whole reason I chose this hospital.

Right.

Because there's a guy that, um.

You know, the IT guy, he says, I, I heard $7,000 a year, but I think it was seven.

I think you're right.

It's $70,000 a year.

Um, and he, and he, he's not that impressed with the guy's skills.

And,

Um, or the budget, I guess he said.

95, I

Yeah, yeah.

Something like that.

yeah.

And, um, so he, so he gets outta the hospital and, um, he tries

to go back to what he, normal and then he goes, he gets invited to,

uh, a dinner party with his boss.

Um, and he, he brings the girl that he kind of rescued from drugs or

sort of rescued Yeah, his neighbor, uh, as his girlfriend, although they

don't, they're not really girlfriend to boyfriend to this dinner party.

And he's at the dinner party?

What,

asked her two

what he, he, yeah, I guess.

I guess.

Yeah.

Um, and, um.

Really awkward seeing when they ask him how long he's been,

how long they've been together.

He goes, uh, today

Yeah.

and

did you see Angela just like pour the rest of the bottle

yeah.

Yeah.

She just, so clearly Angela has feelings for him as well, or maybe concern.

I don't know.

We, we just don't know.

But anyway, uh, and then you have the boss, which is Gideon.

And the bosses.

The bosses, he, he still wasn't sure.

Yeah.

About what happened.

So he looked into what happened, and he came up with a story as to

why he didn't tell 'em about the, the, you know, the, uh, that file.

And then he hugs him.

Um, and, but then the, the, the end of the episode is the episode.

There's this big email hack.

And the Terry Kolby is revealed to be behind and, and an Evil

Corp is behind revealed to be behind this big toxic waste spill.

Toxic waste, toxic waste spill,

Yep.

um, that ultimately resulted in the deaths of his dad and her mom.

Um.

That's actually when they finally say that's how the two of them met.

Because the

Right.

how do these two know each other?

Why are they, yeah.

Why are they so close?

And, yeah.

Yeah.

I think you're also missing one part.

What part am I missing?

happened in the this episode.

Right?

Because didn't Terrell find out information, right?

yeah.

Terrell, t. T, Terrell, Ty, Tyrell, I think it's Tyrell, right.

Finds out that he's not going to be the CTO, right?

Is that what you're talking about?

And he basically, so I think that's an important part, right?

Because as he's waiting, right, so he's supposed to have a meeting with the CEO.

Yeah.

And as he's like all pumped and ready to go, he goes into the

CEO's like waiting area and the CEO comes out and says, I'm busy.

I

I.

we have a good candidate for the CTO.

And you just look at his face just like

Yeah.

all dejected.

Now as you leave, I

And,

if you notice this, but he like to the assistant

and he tells him to send the email to him directly.

an email to him directly

Why is it, why is that relevant?

later in the episode.

Because he got the email, he got the name of the person and

then he starts looking him up.

He tracked him on Instagram.

He figured out where he was going to be.

He showed up at the club and the dude's like, Hey, I didn't know you're into this.

He's like, I'm not, I'm here just for you.

ends up taking the guy home, right,

So he sleeps with the guy to get, to get access to his phone, and

it does appear that he's straight,

Yep.

we, we don't have any other evidence that he's not, and he sleeps with a guy to get

access to his phone, which I'm gonna say.

Is commitment,

Yeah.

Well, and he

right?

wife, right?

He's like, I have business to go take

Yeah, yeah.

Yeah.

He lies, lies to his wife.

He had business, he had business.

All right.

Uh, so yeah.

So I'm gonna, you know, I'll, I'll applaud him for his level of commitment

and then, what he does is when the guy's out of the room, he basically steals

the guy's phone, and then from there he basically installs a root kit on it.

He makes it such that the phone can be remotely accessed and he later on uses

that to be able to read all the emails.

And this is the one thing I was surprised about right, is.

Hopefully today most people have either biometrics or pins or something on

their phones, so then when they are not available or around that, someone

Yeah.

open up their phone and start using it.

Right.

Well, he literally opens up his phone, right?

opens up the back of his phone.

Yes.

Yeah.

I'm gonna say number one.

I'm gonna say that's an Android phone, not an iPhone.

You're not opening up iPhones like that,

Yeah.

and you're not opening up most Android phones like that either.

That's a cheap Android phone.

To be able to do that.

Um, he could have just swapped the SIM card, but that wouldn't

have been as cool, I suppose.

Right.

Uh, you're also not swapping the sim card in a, in an iPhone easily, right?

and most of 'em don't even have sim cards.

Well, they, I think they have 'em, but they're internal, right?

most

No.

They're all eims now.

Yep.

Oh, okay.

All right.

What do I know?

And this is where he finds out, okay, who is in the running for the CTO?

He finds out it's this woman's husband who is in the office with the CEO earlier.

Right?

And you could kind of see like the wheels turning in his head.

And then later at the very end of the episode, right.

His wife is like, we need to make sure that we sort of

invite them over to dinner.

Right.

And you could already see like the wheels turning between the two of 'em.

Right?

In

Yeah.

where they're like, yes, we have to figure out how to sabotage this so that

other guy doesn't get the CTO role.

And you do.

Yeah, so, you know, when we think about that again, once again, especially if.

If you're in a sensitive role, caution the level of personal

information that you put out there.

This is where I'm going to dinner.

Yep.

is where I'm going out.

Um, these are the kind of places that I like to go.

Um, here's a, here's a picture of me that if you download, you're

gonna get all kinds of metadata.

It'll tell you exactly where this is.

Right.

The two generations following me, um, I think you're, you're

in the other generation, right?

You're, yeah.

Um, the two generations following me are much more.

You know, used to putting that kind of information out quite

a bit, like all day long.

Like, here's what I had for breakfast and here's the club that I'm at,

and whoa, look at here are the seven different pictures of the seven

different clubs I went to and win.

Yeah,

Um, and just realize that that can be, uh, used against you.

And it's not even just like.

He was important.

It's the fact that he was working in an important role where he was managing the

CEO's calendar and other things like that.

Yeah.

Yeah.

Let's go back to the beginning of the episode and talk about that hospital.

I think it's interesting that he chose a hospital.

I mean, he says, I chose this hospital because of its lack of

cybersecurity because he, he knew, he knew sort of what was gonna happen.

He knew that, that he was gonna get busted for the morphine

and the, and the, and that

matter

at some point, and, uh, that he, he knew that based on.

What he knew about the the guy that, that runs the thing.

And that's, I mean, that's it.

When you look at somebody who's an actual hacker, right?

The level of information that they can get about you, especially once they

started doing reconnaissance, right?

He's good at sort of, you know, poking in and figuring stuff out and, and, and

he definitely got enough information on this guy to know that he would be able

to easily get in and change the, the hospital records to make it look like

he was clean when clearly he was not.

You know what though?

That's, that's like very thoughtful,

Yeah, he's a super smart dude.

You know, he's a super smart dude.

He's troubled, he's clearly addicted to drugs.

Um, and, um, yeah, but, but he, but he's super smart, right?

I, I'd, I'd call him a high functioning, a high functioning drug addict.

but some parts of me thinks like he kind of like starts going

along like the white hat line.

Right.

Yeah, yeah,

Right.

Where he's

yeah,

for ethical reasons.

yeah.

Not the hacking of the,

Yeah.

not the hacking of the hospital, but, yeah.

But yeah, so the, the, just the topic to discuss there is just think

about the people that work for you, and if these people are responsible

for cybersecurity in any way.

Uh, you should think twice about underpaying them.

Just a thought, right?

and then I think the other thing they also mentioned is the guy had no budget.

Hmm.

like, I think it was like $10,000 a year to spend on it.

Security.

Maybe that's the number that I was hearing.

$7,000 a year is the number that I heard.

Maybe that's the number I was hearing

and so

yeah.

especially a hospital or anything of value that you put the same budget towards

things like security, data protection, resiliency, that you are for other aspects

Yeah, I remember when I go all the way back to, um, you know, my first

job with backups, and this was abs

back in the day.

Um, I remember how much money we would spend for the new sexy server, right?

We bought, um, there was.

I, I think it was called a T 500.

It was an HP HPUX server.

It was a T 500, and this thing was, um, huge.

It was a hundred gigabytes.

It was huge.

Um, now, like I have this,

Yeah.

this, this is a x, you know.

card

Yeah.

An XSD card, micro SD card, and it's 256.

Um, but yeah, it was a hundred gigabytes.

And what I remember was there was zero discussion about backup

infrastructure for this thing.

And we were using DDS drives, which were two gigabytes, uh oh.

I think it had a DDS two, which meant it was four gigabytes.

And I was like, so I'm gonna have to swap tapes 25 times.

I remember having that discussion and that was how we, that was how luckily we

bought our, our first, um, tape library.

But, uh, yeah, it, it, it's very common for things that aren't directly

related to revenue, like cybersecurity and data protection to how to be,

you know, budgeted down the, and it's your job as a cybersecurity or a

backup professional disaster recovery.

It is your job to.

Bring that stuff out into the forefront.

so I remember this was a while ago that in it, there was a study done,

I think they said people spend one to 2% of their IT budget data protection.

Yeah, that sounds about right.

and this was a while ago, but I think though if you now throw in security,

cybersecurity and just given everything that's happening in the world these days,

Yeah.

think, I hope that that number has shifted upwards.

Uh, yeah, I think it has, but, but maybe not enough.

You know, it depend, it depends on the company.

It just, it, I, I've been at companies where like, I can remember a, a

meeting where we were discussing the fact that this company didn't have a

DR plan, and this was a big company.

This was a company that you would absolutely know the name of.

Okay.

And.

Uh, the, the comment was made by a senior manager.

Well, like, 'cause it was like, well what happens if a big earthquake comes?

'cause this was a Southern California company.

What happens if the big earthquake comes?

Well, if that happens, if an earthquake that big happens,

I'm probably gonna be dead.

I won't care.

Right.

You know, if you, if you have somebody who's like, who's convinced that like.

Raid is backup, or we don't need backup or whatever, you know, maybe

it's time to wash your hands and walk away right at, at a minimum it's time

to very much, very loudly in writing.

This is what I think we should be doing and, and what we're

currently doing is, is beyond ill advised, you need to do that right.

To make your case.

And if they ignore you, then maybe it's time to, it's time to move on.

Right.

Yeah.

Um, so all right, so then let's talk about.

The

Email, right?

So this huge, uh, f society, which by the way, I'm basically

likening, I I, I hadn't mentioned this in the previous two episodes.

I'm basically likening them to anonymous, right?

Anonymous uses, um, a um, Guy Faulkes mask.

This guy uses this weird looking mask.

what.

What,

Even around anymore, I think they got shut down

uh, I don't know.

or, or they got

I think I haven't, I haven't heard much about him yet.

So I think when Mr. Robot was made, whichever, what was

like six, seven years ago?

Six years

Mm-hmm.

Mm-hmm.

time anonymous was very prevalent,

Right, right,

think since then they've either been shut down or rebranded

to one of the other groups.

Right.

Whatever it is.

And that's why you may not know about it as much,

, I haven't seen any videos of anyone like.

Yeah.

Posting videos of like the stuff that, that they were doing there.

But what we have is they, we have this email hack, which,

and an email dump, right?

We have an email dump of really embarrassing corporate emails that, that,

you know, prove essentially that you know, that they did some really bad stuff.

do.

As I was watching this episode, I remember thinking back, I don't know

if you remember Curtis, the Sony hack,

Oh, yeah.

Sony had their emails compromised and published, and there was some

embarrassing information that executives

Yeah, they were trash talking talent.

Channing Tatum was somebody that, that I was just, I was just looking at it.

Channing Tatum apparently got some, some emails about him read, you know?

Hmm.

Yeah,

I think that is kind of what they modeled this

yeah, yeah.

And.

but so

And similar to that, basically this was just released.

It was like, you know, and so, you know, you wonder wh why, what

was the, um, why did Mr. Robot essentially release this email?

Yep.

And I'd say it was obviously to completely discredit Terry Colby,

Yeah.

The previous CTO, um, and to just to continue to muck up the waters right.

Well, I, I think it was also because until this point, Elliot's

kind of on the fence, right?

He's like, I want nothing to do with you.

I'm stepping away from you guys.

Right?

And this is kind of like.

The nail in the coffin for Elliot, right?

Where he's like, screw this.

Let's go guns a blazing and go after these guys.

Because until that

Yeah.

he was like,

Oh

think so.

yeah.

Okay.

So you're, I see what you're saying.

This, this was, he wanted Elliot, um, you know, to, to do the thing.

And, um, he, he and he, and he, he wants, he wants him to do it willingly.

He wants him to come along and he does believe Elliot, as he says, multiply him.

El Elliot is the key to this whole thing.

The other thing too that I was wondering as I watched this episode

was, it's interesting how like Elliot and Allsafe and all the investigations

they did, they didn't notice all these emails being exfiltrated.

Well, so, so that's a, that's interesting.

So there is a, there is a possible reason for that.

And we, you know, I, I literally, so I'm, I'm currently, uh, editing my book, right?

So the, you know, the, we finished the rough draft and we're editing it,

and I was just, it's called learning ransomware response and recovery.

Thank you very much.

And I, I was just editing the part where just realized that the

backup system, not only is it.

Um, it's not an attack.

Like, it's not the, it's not just the thing that they want

to attack because they want to take it out of the mix, right?

They want to, they want to take it away from you as a tool to be

used after the ransomware attack.

It is also the, the kingdom, right, is the key.

I had an interesting, um, conversation with one of the, one of, one of the tech

editors and, and I was saying that if you had control of the backup system, that you

could restore an image of a vm and then you could do things like a brute force

attack against the password file without anybody noticing because you restored it

like outside the control of everybody.

And he's like, why would you do that?

And I, I was listening this as like additional reconnaissance

that you could do and he, um.

And he said, why would you do that?

And I said, well, to be able to hack that server.

He's like, why?

You have the server, you have the vm, right?

And I'm like, yeah, I guess you have the keys to the kingdom

if you've got the backups.

He goes, no, you have the kingdom.

Like he's like, you've got everything.

And so it's quite possible that one of the reasons that they didn't notice an

exfiltration is that the exfiltration was done via the backup system,

Hmm.

right?

Email backups.

I, I, it's a double-edged sword.

You should be backing up your emails.

You should be backing up Microsoft 365 or Gmail or whatever it is that you're using.

But the double-edged sword is if you're backing up your emails, um, then tho

those are a valuable tool for forensics.

So for E Discovery and things like that.

And in this case, you know, you could very easily restore, um, you know,

all these emails and then, you know, uh, find out what you're looking for.

Yeah,

Yeah.

is true.

Yeah.

And it is a possible thing.

It was just one thing that I just felt that they missed.

Right.

Just given how much

Oh, just talking about it.

Yeah.

Yeah, because that in general, you, you're right.

That, that they, what, who's they?

Is they the writers of the show or the or, or, uh, all safe.

All safe slash Elliot?

Okay.

Okay.

Yeah, yeah.

We'll, we'll, uh, we'll put this in the IMDB category of

mistakes made by characters.

Right?

I dunno if you've ever looked at the goofs.

No.

Um, I, I love, uh, looking at, I'm a big movie and TV fan, and I love looking

on, I mdb love looking at the goofs.

And, um, if you're, if you're an Uber nerd on a particular topic.

Like cybersecurity, um, you can go in and put this kind of stuff in there.

So, all right, so be careful about, so be careful what you put in email.

Be careful and be, make sure to protect the backups of your email, right?

We talk so much about the cybersecurity of, of, of the, the environment.

Make sure about the cybersecurity of your backups.

Make sure they're not easily, um

also the social engineering aspect.

mm.

Right.

I don't know if people are aware, but there's like this ransomware

group called Scattered Spider going around and popping a bunch of,

uh, I think banks and airlines and

Mm-hmm.

Mm-hmm.

one of their first ways of getting in is they pretend to be an employee

asking for their password to be reset.

Yeah.

No bueno.

Yes.

So be

Yeah.

you post out there about where you work, what you're doing,

and other things like that.

'cause that may be used against you.

Yeah.

That's why I tell people I work at Inn Out.

Oh,

I don't even, I don't even like inn out.

I, I mean, I mean, I don't hate it.

Okay.

I know that's like sacrilege here in California, but

No.

There's now an uproar.

I don't know if you've heard about this.

what

CEO moved to Tennessee.

Oh, really

Yeah.

She took the company and left.

interesting.

Interesting.

Um, yeah, we'll see.

But like my daughter, she, you know, the mo if she, whenever she leaves

California, the first thing she does literally on her way home from

the airport is getting in and out.

I'm like, I don't get it.

she get a four by four fries and a shake?

Uh, no, I don't think so.

I don't think so.

Me, I'm a five guys person, but you know, that's just me.

All right.

Well, another fun episode.

Look forward to episode four, aka 1.3 next week.

Yes, I am.

Then I will now have to go watch it before then, and uh, hopefully

you will not spoil it for me.

There's computers in it.

Curtis, why,

All right, well thanks.

Thanks, Prasanna.

It's been fun.

Likewise, Curtis.

And thanks to our listeners.

You are why we do this.

Hope you enjoyed the episode.

Hope you learned a thing or two.

That is a wrap.

The backup wrap up is written, recorded, and produced by me w Curtis Preston.

If you need backup or Dr. Consulting content generation or expert witness

work, check out backup central.com.

You can also find links from my O'Reilly Books on the same website.

Remember, this is an independent podcast and any opinions that

you hear are those of the speaker and not necessarily an employer.

Thanks for listening.