Social Engineering - Christopher Hadnagy [67]
My eyes opened wide, while my eyebrows crunched together inward. My lips pulled together and out towards my ears. Of course, I didn’t realize all this as it was happening but afterward I was able to analyze what had happened and I knew I had felt fear. I then analyzed the way I felt my face move and determined that if I repeated the expression I felt that same emotion all over again. I am sure I looked similar to what is seen is Figure 5-7.
Try to see whether you can generate this emotion in yourself by following these steps:
1. Raise your eyebrows as high as they will go.
2. Drop your mouth open slightly and pull the corners of your lips back.
3. If you can, pull your eyebrows together while raising them as high as you can.
How did you feel? How about in your hands and arms and your stomach? Did you notice any semblance of fear? If not, try the exercise again but think back to a time when you were in a situation (something similar to my plane experience, or a car in front of you screeching to a halt) out of your control. See how you feel then.
Dr. Paul Ekman
Figure 5-7: Clear signs of fear.
Most likely you will feel the emotion. Browsing the Web I found this picture of U.S. Senator Olympia Snowe, who is showing very clear signs of fear (see Figure 5-8). Whatever question was asked of her before that picture was snapped caused a very distinct feeling of fear. Her eyebrows are raised high with her lips slightly open and pulled back, and her eyebrows are almost forced together while being raised as high as they can go.
From a social engineering standpoint, fear is often used to cause people to react a certain way. Malicious social engineers use fear tactics to get an unsuspecting user to click a banner or give up a valuable piece of information. For example, malicious banners might claim “Your computer is infected with a virus. Click here to get fixed now!!” These banners work against non-technical users who fear the virus and will click, only to be infected at that point.
Figure 5-8: Senator Snowe showing clear signs of fear.
One company I worked with was hit by a malicious social engineer who used fear to gain access to the building. Knowing that the CFO was out of town on an important business meeting and could not be disturbed, the social engineer went into the company as a tech support guy. He demanded access to the CFO’s office, which was promptly denied. He then played this line, “Mr. Smith, your CFO, called me and told me that while he was away at this meeting I better come down and fix his e-mail problem and that if it is not fixed while he is gone, heads will roll.”
The secretary feared that if it didn’t get fixed, she would be to blame. Would her boss really be angry? Could her job be at risk? Because she feared a negative outcome, the secretary let the phony tech support guy in. If he was a skilled social engineer he may have been watching her facial expressions and noticing whether she exhibited signs of worry or anxiety, which are related to fear. He then could have played on these signs more and more, getting her to cave in to her fear.
Fear can be a big motivator to do many things that you (or your target) would not normally consider doing.
Surprise
As mentioned earlier, Dr. Ekman and many other psychologists in the area of microexpressions have concurred that surprise is closely linked to fear because of certain similarities. Even so, some marked differences exist, such as the direction the lips take and the way the eyes