Ask the social engineer: Practice

One reader wrote in asking: “How can one practice social engineering before using it in the wild?”

Answering is Chris “loganWHD” Hadnagy, the lead social engineer and developer of the web’s official social engineering framework. He works closely with the Offensive Security and Remote Exploit teams and advocates knowledge and awareness as the keys to what can protect people from social engineering attacks and help secure people from being deceived and influenced maliciously.

Chris: I really thought this was an excellent question. In traditional penetration testing if we want to practice our wares we can do a number of things: set up a virtual machine, a small LAN or we can even purchase a course that comes with labs to practice in.

That methodology works perfect for practicing that level of security auditing, but we can’t really set up “fake” people and “hack” them to practice social engineering. Staged events rarely work the way real life does. Unless we are dealing with expert and experienced actors facial expressions, reactions to questions and body language are almost impossible to mirror the way a real target would react.

With that being said, it is not wise to drive around and take videos of yourself shmoozing free food or getting into clubs for free. Although there might certain aspects that reflect social engineering, in the truest sense it will not prepare you for professional social engineering audits.

Another method that has been suggested, which I feel really isn’t wise, is to practice lying to your friends and family, even for short periods. Social engineering isn’t really all about who is the best liar. Social engineering is about obtaining information from your target that can lead to a security breach. Even little bits of information (i.e. kids names, favorite restaurants, etc) can lead to a security breach.

How can one go about practicing social engineering to perfect the science before trying their hand in the wild? In the recent release of the first framework for social engineers, there is a breakdown of the key components of social engineering. This framework outlines in logical progression these components and then dissects each one to talk about what it is, make makes up the aspects of it and how to perfect it. Mastering all these components would make one a perfect social engineer. It must be mentioned that not every aspect of social engineering is used in every audit, but regardless to act and think like a social engineer here are the keys. Let’s take the top five categories that we would focus on:

1. Information Gathering

2. Elicitation

3. Pretexting

4. Psychological principles

5. Influence

Each one of these can be practiced and enhanced in its own without breaking the law or ruining relationships, actually with just the reverse effect. It may actually enhance your relationships with others. Let’s take two examples.

Elicitation is basically extracting information through the use of questions. Sounds easy? Not really. Try walking up to a stranger and saying: “What is your name and where do you live?” and see what happens. Tell us when you get released from the slammer. If we practice using intelligent questions, questions that provoke thought, questions that cannot be answered with a YES or NO we can be on the road to perfecting elicitation.

One very detailed aspect of elicitation is preloading. Think of preloading as a trailer to a movie. A trailer will show you and tell you the things they want you to know and think. “Best movie of 2009” and then a display of some of the best scenes in the film. In a social engineering context you can practice preloading people with information that will make it easier to get the desired results from them. Take a look at a practice session we just did and how it went, while at a local coffee shop:

SE: While sitting in a Starbucks drinking your coffee you see a target reading the paper. You see him sit a section down, look over and say. “Hey I saw an article there on the cover, if you are done can I just read that quick?”
Target: Most people because they are asked will respond nicely, “Sure, here it is.”
SE: Takes a few minutes to read, folds and hands it back. “I was scared cause I am from here locally, live right over the hill in (name small local town) and the crime is ridiculous. You from here?”
Target: Most of the time they will respond with not even thinking, “No just passing through I am from Chicago.”
SE: “Chicago, heck I was just out there for some business. I went to this place downtown called Morton’s. You in the city or outskirts?”
Target: “Morton’s heck I love that place, but expensive as hell. Yeah I live about 10 miles from the center city.”
SE: Reaching over extending my hand “Hi my name is Chris”
Target: “Jim”
SE: “What do you do Jim, that you are traveling through here? I am in the IT field and do some training.”
Target: “I sell paper, work for the largest paper company in Chicago. XYZ.”

What did we learn? His name, location, place of employment, saw a wedding ring… all in about 3 minutes. We do nothing with this information, but it was great practice.

Microexpressions are the tiny involuntary movements of muscles in the face in reaction to emotions. Researchers like Dr. Paul Ekman and Dr. David Matsumoto have pioneered research in this area. They have proven that regardless of age, sex, race, religion we all have universal expressions that display emotion. Even people who are blind have been proven to have the very same facial expressions to emotions. The problem with these microexpressions or ME as they are called is that they usually last between 1/25th and 1/2 a second. The normal person may not be able to see that when they ask their wife how she is feeling, an ME of contempt went across her face.

Being able to read microexpressions can enhance relationships and make your understanding of people overall better. From a social engineering standpoint it can enhance your ability to detect deception in people and also read if an answer they are giving is not truthful.

How can you practice?
In Paul Ekman’s book Emotions Revealed, he talks about having a mirror and practicing making these facial expressions as described and feeling the emotions that occur when you do. In addition to practicing them on yourself, learning how and where and when to look for these on others. Knowing that contempt is only on one side of the face, knowing that disgust and anger differ in the way the eyebrows move and the eyes glare. Knowing that surprise and fear are different by the way the lips move. These things can change your understanding of people and how they react to questions. When you work on elicitation reading facial expressions is a logical next step in being able to accomplish those tasks perfectly.

Naturally, there are many more aspect to social engineering. Information gathering, pretexting, interview and interrogation tactics, understanding psychology principles that will change the way you deal with people… all of this can be broken down and practiced on their own. They can be practiced without having to break any laws or hurt people. Social engineering is not merely learning how to manipulate people into doing what you want, but it is about learning how to understand people. Once we understand how people think, how they work, how they react to certain situations then we can aid them down a path we want. For the purpose of security auditing we use this information to show where and how security breaches occur, then education makes people aware of these methods so they can guard against them.

Please send in your questions for the following column to logan -@- social-engineer.org with the subject of “net-security Ask The SE”.