Social engineering is bull, call it what it is

-surpherdave

Disclaimer

• The information discussed are my views and opinions and mine alone.

• Much like the title of this talk, citations are needed and provided at the end of this deck.

This talk may contain the following:

Drink if you hear or see:

About me

Talk introduction

• Attempt to define “social engineer”• What we really mean when we hear the term

“social engineer”• History of manipulation and deception• Persuasion techniques that work• Neuro Linguistic Programming

so·cial

adjective \ˈsō-shəl\: relating to or involving activities in which people spend time talking to each other or doing enjoyable things with each other

: liking to be with and talk to people : happy to be with people

: of or relating to people or society in general

Definition of “social” and “engineer”

Definition of “social” and “engineer”

en·gi·neer

noun \ˌen-jə-ˈnir\: a person who has scientific training and who designs and builds complicated products, machines, systems, or structures : a person who specializes in a branch of engineering

: a person who runs or is in charge of an engine in an airplane, a ship, etc.

: a person who runs a train

engineering

noun (Concise Encyclopedia)

Professional art of applying science to the optimum conversion of the resources of nature to the uses of humankind. Engineering is based principally on physics, chemistry, and mathematics and their extensions into materials science, solid and fluid mechanics, thermodynamics, transfer and rate processes, and systems analysis. A great body of special knowledge is associated with engineering; preparation for professional practice involves extensive training in the application of that knowledge.

Definition of “social” and “engineer”

How does it happen in information security?

• Phishing

• Phone calls

• Dumpster Diving

• Doxxing

• OSINT

Call it what it is… manipulation

history of manipulation and deception

• Adam and Eve

• False weights

• Clothing, make-up,

smells

history of manipulation and deception

• We are told to tell the truth at a young age, yet told to be polite, have manners, feign respect for elderly, refrain from telling someone their breath stinks, if you have nothing good to say about a person…it is mandatory in society to be deceptive as to our true feelings and nature

• Santa Claus and Easter Bunny

techniques that work

• Reciprocation• Golden rule• Hare Krishna• Street performers asking for

donations• Free samples, instead of a

person giving them samples invited them to take as much as they wanted• -olive bar in NYC

• Failed reciprocity

techniques that work

Commitment and consistency• Race track betters more

likely to stand by their horse after they bet

• Abused spouses• Sales of toys during

Christmas are in short supply in order to keep sales going afterwards• Parents want to show

children consistency

nlp

Pacing and Matching• Similar to method acting• Matching another person’s

body language and speech in order to build rapport

• Not mirroring, rather integrate elements of their personality into your own

• Bring vocabulary in line with the other person

nlp

Mirroring• Behavioral Mirroring• Symbolic Mirroring• Exchanged matches

• Not mirroring exactly, but substituting part of the body for another

• Using hands to control breathing

nlp

Building and Maintaining Rapport

• Positive connection between you and another person or group

• Conscious application not a gift

• Use sensory acuity to find out about a persons disposition

speech

• Pause or delay• Stress level of voice

• Dry mouth can show anxiety or alarm

• Accent• Not only where they

are from, but also their vocabulary tells the educational level

body language

Notice body changes for clues as to how to proceed

• Stress levels can change in an instant, facial expressions, tension, rigid body language, withdrawing in apprehension

• Look for signs of change in sympathetic nervous system• Pupil dilation, thinning

lips

body language

Calibration• Using sensory acuity to

gauge the state the person is in, this allows you to understand more about their inner state

• Once you understand their state, you cultivate the state in yourself

body language

Posture• Adopt the other person’s stance

or sitting positionMovement

• Gesturing, how fast or slow, how often, and how open or closed are the movements

Breathing• Harder to master, but matched

breathing is used in hypnosis. Helps to match the timing of your verbal statements

Wrap Up

• Mindset of “social engineering” needs to change• Learn what to look for in the human element, not the

technical• Understanding these tenets will assist us in protecting

all aspects of our lives

Questions?

References

Philip Houston, Michael Floyd, Susan Carnicero, Don Tennant - Spy the Lie: Former CIA Officers Teach You How to Detect Deception Published: 2012-07-17 | ISBN: 125000585X | EPUB

Influence: The Psychology of Persuasion, Revised Edition Paperback – December 26, 2006Robert B. Cialdini (Author)ISBN-13: 978-0061241895 ISBN-10: 006124189X Edition: Revised

The Big Book of NLP, Expanded: 350+ Techniques, Patterns & Strategies of Neuro Linguistic Programming Paperback – August 2, 2010Shlomo Vaknin (Author), Marina Schwarts (Contributor)ISBN-10: 9657489083 ISBN-13: 978-965748908

http://www.slideshare.net/surferdave71/social-engineering-is-bull