Social Engineering - Christopher Hadnagy [119]
This experiment points to the fact that part of the motivation to show, exhibit, or feel pain is related to how others around you act. The people in the study weren’t just acting like it hurt less: Their skin reactions and heart rate actually exhibited less pain reaction when a tolerant model was in place.
For a humorous example of the power of social proof, check out a video from the old television show Candid Camera at www.social-engineer.org/framework/Influence_Tactics:_Consensus_or_Social_Proof.
This video shows subjects being influenced to face different directions in an elevator, even at one point facing toward the back because everyone else is doing it. There were four to five participants in the elevator acting as patrons. At set intervals, the participants would all turn to the left, to the right, or face backwards. After a few seconds, a hidden camera would catch the unsuspecting subject complying and facing the same direction, removing a hat, or taking some other action.
Using social proof as a social engineer can be a deadly tool. This principle can be used to stimulate a person’s compliance with a request by informing him or her that many other individuals, perhaps some who are role models, took the action or behavior you are trying to get this person to do. Social proof can provide a shortcut for determining how to behave. But at the same time it can make targets vulnerable to the manipulations of others who seek to exploit such influence.
Social proof is most influential under two conditions:
Uncertainty: When people are unsure and the situation is ambiguous they are more likely to observe the behavior of others and to accept that behavior as correct.
Similarity: People are more inclined to follow the lead of others who are similar to themselves.
These conditions are where a social engineer can use social proof. Stating or even implying that many people before this target have taken a particular action can increase your chances of success.
In one social engineering situation where I was stopped by a leery security guard, I simply acted confused as to why I was stopped and said, “Yesterday, Jim let me in after checking all my credentials. I just figured I was still on record.”
The present security guard, hearing that Jim approved me, allowed me to pass without question. Social proof won’t always work so easily, but it is a very powerful force.
The principles outlined in this section are some of the deadliest influence tactics used today. These tactics can literally give a social engineer powers to motivate people, move them, and cause them to react in ways that will put them in the social engineer’s control.
Remember that influence and the art of persuasion is the process of getting someone else to want to do, react, think, or believe in the way you want them to. Creating this motivation within a target is a powerful force; it is a social engineer’s superpower. The principles outlined in this chapter can make that superpower a reality, but not without consequence and lots of work.
What do I mean by that? I have often found that after I practice a certain skill and become proficient at it, “turning it off” is very hard. This trait may sound attractive, but being cautious when it comes to who you are influencing, especially as a social engineer, is a good idea. To ingrain these skills into your personality, use them for helping others. For example, when you start to practice reading microexpressions and even using them to manipulate a target, the initial response might be to think you have some mystical power that allows you to almost read minds. This is where caution is wise. Practice the skill and work toward perfecting it, but don’t assume you know it all.
If you can influence someone to stop smoking, to start working out, or to be healthier,