Social Engineering - Christopher Hadnagy [42]
The goal is getting small and seemingly useless bits of information that help build a clear picture of the answers you are seeking or the path to gaining those answers. Either way, this type of information gathering can help give the social engineer a very clear path to the target goal.
How do you know what type of questions to use?
The following sections analyze the types of questions that exist and how a social engineer can use them.
Open-Ended Questions
Open-ended questions cannot be answered with yes or no. Asking, “Pretty cold out today, huh?” will lead to a “Yes,” “Uh-uh,” “Yep,” or some other similar affirmative guttural utterance, whereas asking, “What do you think of the weather today?” will elicit a real response: the person must answer with more than a yes or no.
One way a social engineer can learn about how to use open-ended questions is to analyze and study good reporters. A good reporter must use open-ended questions to continue eliciting responses from his or her interviewee.
Suppose I had plans to meet a friend and he canceled, and I wanted to know why. I can ask a question like, “I was curious about what happened to our plans the other night.”
“I wasn’t feeling too well.”
“Oh, I hope you are better now. What was wrong?”
This line of questioning usually gets more results than doing an all-out assault on the person and saying something like, “What the heck, man? You ditched me the other night!”
Another aspect of open-ended questions that adds power is the use of why and how. Following up a question with how or why can lead to a much more in-depth explanation of what you were originally asking.
This question again is not “yes” or “no” answerable, and the person will reveal other details you may find interesting.
Sometimes open-ended questions can meet with some resistance, so using the pyramid approach might be good. The pyramid approach is where you start with narrow questions and then ask broader questions at the end of the line of questioning. If you really want to get great at this technique learn to use it with teenagers.
For example, many times open-ended questions such as, “How was school today?” will be met with an “OK” and nothing more, so asking a narrow question might open up the flow of information better.
“What are you doing in math this year?” This question is very narrow and can be answered only with a very specific answer: “Algebra II.”
“Ah, I always hated that. How do you like it?”
From there you can always branch out into broader questions, and after you get the target talking, getting more info generally becomes easier.
Closed-Ended Questions
Obviously, closed-ended questions are the opposite of open-ended questions but are a very effective way to lead a target where you want. Closed-ended questions often cannot be answered with more than one or two possibilities.
In an open-ended question one might ask, “What is your relationship with your manager?” but a closed-ended question might be worded, “Is your relationship with your manager good?”
Detailed information is usually not the goal with closed-ended questions; rather, leading the target is the goal.
Law enforcement and attorneys use this type of reasoning often. If they want to lead their target down a particular path they ask very closed questions that do not allow for freedom of answers. Something like this:
“Do you know the defendant, Mr. Smith?”
“Yes I do.”
“On the night of June 14th, did you see Mr. Smith at the ABC Tavern?”
“I did.”
“And at what time was that?”
“11:45pm.”
All of these questions are very closed ended and only allow for one or two types of responses.
Leading Questions
Combining aspects from both open- and closed-ended questions, leading questions are open ended with a hint leading toward the answer. Something like, “You were at the ABC Tavern with Mr. Smith on June 14th at around 11:45pm, weren’t you?” This type of question leads the target where you want but also offers him the opportunity to express his views, but very narrowly. It also preloads the target with the idea that you have