Social Engineering - Christopher Hadnagy [139]
She did it without a second thought. The suggestion made sense, especially in the light of her excitement.
Knowing the target and his likes, dislikes, kids’ names, favorite teams, and favorite foods, and then using this to create an emotional environment will make creating a susceptible atmosphere so much easier.
Controlling the Target’s Environment
Controlling the target’s environment is often used in online social engineering, scams, and identity theft.
Becoming part of the same social networks and groups gives the attacker the chance to have “face time” to be able to manipulate targets into acting or thinking the way the attacker wants. Being able to use a target’s social networks to find out what triggers they have is also a powerful tool.
I used this method once when searching for an illegal scammer for a client who wanted to get the scammer’s contact details. I was able to gain an account on a forum he used to post his “achievements.” Using this tactic of getting into his environment, then befriending him, I was able to gain his trust, use his social networks to know what he was doing, and eventually get his contact info.
Any method used to control the environment of the target can be used in this manipulation technique. Controlling the environment can be as simple as approaching when you know you have the least chance of interruption, or allowing a target to see or not see something that will cause a reaction.
Of course, unless you plan on bringing your target to a dark closet, you can’t really control his whole environment, so controlling as much as you can will take planning and research. After you locate your target’s social circles, whether online or in the real world, you will need to spend time planning how you will get an in to control that environment. Once inside, what elements do you want to control? A good social engineer will not come in running for the “kill shot” but will take time to build a relationship and gather information before the final blow is administered.
Environment control is often used in police or war-time interrogations. The environment where the questioning will take place will have a certain atmosphere to make the target feel at ease, nervous, scared, anxious, or any other emotion the attacker (or lead officer) wants the target to feel.
Forcing the Target to Reevaluate
Undermining a target’s beliefs, awareness, or emotional control of a circumstance can have a very unsettling effect on him or her. This tactic is very negative because it is used to make a target doubt what he or she has been told to be true.
Cults use this tactic to prey upon those looking for guidance through life. Many times, people who feel lost or confused are convinced that their whole belief system needs to be reevaluated. When the cults have control they can be so convincing that the victims can be thoroughly convinced that their family and friends do not know what is best.
On a personal social engineering level you can make a person reevaluate the beliefs he has been taught about what is safe and what is not, or what is corporate policy and what is not.
Each day social engineers use similar tactics by presenting one well-thought-out question that can cause the target to reevaluate his stand on a topic and cause him to falter.
For example, in this economy, salespeople are hungry to make sales, and you could call the sales department of a company that happens to have a strict policy about downloading PDFs from the web without proper scans and precautions. Yet you can still place this call:
“Hi, I am with ABC Company and I want to place an order for your product that could be more than 10,000 pieces. My employer wants me to get three quotes to see whether we can do better. I have uploaded the quote package to our website; can I give you the URL? I am going to a meeting in two hours. Could you look over the package and get me a preliminary