Social Engineering summary

Whether you’re a security auditor or a criminal social engineer, before you plan an attack, you need to know your target. The more you understand your target, the more you’ll know how to influence them, and the more effective your plan will be.

Start by creating a profile of your target. A good place to start is on the internet: certain websites allow you to track a person’s e-mail address, phone number and even her IP address, while social media can also be a great resource. Be diligent! Even a minor detail can prove valuable.

Imagine you’re a detective about to go undercover. Would you use your real name, address and backstory? Of course not! You’d create a backstory and alias, and use everything you know to design a solid plan to go undercover.

It all starts with a pretext, that is, a scenario that makes your target feel comfortable doing something they normally wouldn’t. This is why it’s so important to gather good information about your target in the beginning: the better your information about them, the more convincing the pretext will be.

People like to be liked, a fact social engineers know well. They also know that people who like you will do things to earn your affection. But how do you get complete strangers to like you immediately?

Start by making the target feel like you have good chemistry and rapport. One way to do this is by making the conversation about the target. After all, everyone loves to talk about themselves!

Think of all the white lies you’ve ever told. Do you think people knew you were lying? Probably. But it’s not because they were listening carefully to the logic of your fib; rather, they probably read it on your face.

Our faces tend to reveal our emotions involuntarily. These microexpressions flash by in less than a second, but are nonetheless unmistakable.

Con artists are well known for their ability to talk anyone into doing anything. Many chalk this up to a natural born talent for sweet talking, but there is an actual science behind it. In this blink, we’ll examine one such science: Neuro-linguistic programming.

Neuro-linguistic programming, or NLP, is a mode of communication that focuses on the way people think and experience the world.

Sometimes social engineers are confronted with a challenge that requires more than just sweet talk: locks. But no lock, be it physical or digital (in other words, password protection), is insurmountable.

If you want to open up a physical lock to access personal files or other data, you’ll first need certain tools.

Social engineers combine all these tactics and tools to manipulate their targets without them ever being the wiser. The best way to protect ourselves is to know their methods and how they work.

If you don’t want to get duped, it’s important to educate yourself and your personnel about social engineering tactics. The more you know about elicitation, body language and so on, the better equipped you will be to recognize when someone is trying to use these tactics on you.