Encyclopedia of Social Engineering

Embed Size (px)

Citation preview

  • 8/18/2019 Encyclopedia of Social Engineering

    1/37

  • 8/18/2019 Encyclopedia of Social Engineering

    2/37

  • 8/18/2019 Encyclopedia of Social Engineering

    3/37

  • 8/18/2019 Encyclopedia of Social Engineering

    4/37

  • 8/18/2019 Encyclopedia of Social Engineering

    5/37

  • 8/18/2019 Encyclopedia of Social Engineering

    6/37

  • 8/18/2019 Encyclopedia of Social Engineering

    7/37

  • 8/18/2019 Encyclopedia of Social Engineering

    8/37

  • 8/18/2019 Encyclopedia of Social Engineering

    9/37

  • 8/18/2019 Encyclopedia of Social Engineering

    10/37

  • 8/18/2019 Encyclopedia of Social Engineering

    11/37

  • 8/18/2019 Encyclopedia of Social Engineering

    12/37

  • 8/18/2019 Encyclopedia of Social Engineering

    13/37

  • 8/18/2019 Encyclopedia of Social Engineering

    14/37

  • 8/18/2019 Encyclopedia of Social Engineering

    15/37

  • 8/18/2019 Encyclopedia of Social Engineering

    16/37

    - Simply stated, for people we don't personally know: "They do those things because they are the typeof people that do those things."

    - e.g. Someone on the streets you said "Hi." to casts you a murderous gaze, snorts and stomps off. Yourconclusion: "That is a mean-spirited, bitter person." While, in actuality, he could just have just gotten

    news that his girlfriend cheated on him and he was on his way back to their appartment to confront her.We don't think of those possibilities, we just assume his actions characterize his entire person.

    - Ridding ourselves of the Fundamental Attribution Error is a key to reducing social anxiety,discrimination and depression. (e.g. "That person just had his kid die, that's why he was so rude to me,not because he's a rude person/I'm just a bad person."

    - Dispositional attributions are worsened by perceived intent, even when the intent of the wrongdoer inno way influenced the occurred situation.

    - As per Group Psychology, bad events are attributed internally (part of person) with members of out-group, while the converse is true for in-groups.

    - In short: How you act anecdotally is how you will be seen by out-group members. This can be bothbeneficial and detrimental. Be cautious.

    Golden rule, the:

    - There are three.

    - 1) The golden rule of persuasion: "Never try to make people do something. Make people want to doit."

    - i.e. Help people persuade themselves. Influence by eliciting, framing, and suggestion. The only wayanyone will ever do anything is if they want to do it themselves.

    - 2) The golden rule of sociability: “People like people who like them, and are like them; people areinterested in people who are interested in them.”

    - 3) The golden rule of social engineering: “An engineer is only as good as his information.”

    - i.e. No bit, string, or quantum of information is ever irrelevant, but in particular no information withany degree of emotional attachment.- For instance, the fact that a person you’re about to meet chooses to shorten his first name (e.g. Nick,from Nicholas) is important. The fact that he won’t let certain others not shorten it is important. The factthat he gets happy when he’s approached by someone shortening his name is important. The fact thathe smiles with exposed teeth is important. The fact that he has something stuck between his teeth is

  • 8/18/2019 Encyclopedia of Social Engineering

    17/37

    important. The fact that nobody pointed that out to him yet is important.

    - There are so many inferences and conclusions to be drawn from even what seems like the mosttangential piece of information. Never make the mistake of thinking you have enough, let alone all theinformation you could ask for. At most, you can be sure you have what you came for, or the minimum

    you need to get what you came for. Even then, more is always better, exponentially so.

    - I would go as far as restating this rule to: “An engineer is only as good as his ability to find and applyinformation.” Your mileage may vary.

    Groups, Psychology of:

    - People will, within a group, come to see themselves as the prototype for this group, and their ownqualites as the hallmarks of that group and its requirements for inclusion. They will want the generalidea of the group to be congruent with the idea of themselves. (Which also leads to the increased

    perceiving of homogenuity between members of that in-group.) When a member, for that member tomaintain a good self-esteem, the esteem of the group must also be rectified to that level. This leadsto not only a further increase of perceived homogenuity (likeness, common ground), but also to anincreased liking of the individual members of that group.

    - People don't want to think bad of themselves, so they won't want to think bad of membersof their groups. People want themselves to be liked, so they like peoples that like them, and they likepeople that are like them. (As they are an extension of themselves.)

    - Creating an in-group, and the bonds that go with it, with support of some members for social proof,

    with perceived authority so that the group consensus will end up conforming to your opinion -- theseare all uses of group psychology.

    - Principle of authority: people have a tendency to want to conform to the wills of an authority. Theyalso use this authority as an instructor on modes of behavior. They generally value the opinions andinsights of authorities beyond those of all but their closest peers.- Principe of conformity: people want to fit in, and they will go through great lengths to do so. They alsoestablish their own mode of behavior within a context by observing and mimicking others: Social proof.(Within e.g. public speaking, the influence of a communicator is enhanced or deprived by the opinion ofhis or her audience. Therefore, influence can be increased substantially with wingmen or conspirators.)

    - Both the principle of authority and conformity are so powerful as tools for influence that they canmake the target Rethink answers that practically stare them in the face.

    - Principle of affiliation: by being affiliated with a person, you become an extension of that person tosome degree. This is how wingmanning works, both in socializing and business. Introduction by a friendto a group can be enough to put you in-group. The good judgment on your person that introduction

  • 8/18/2019 Encyclopedia of Social Engineering

    18/37

    implies is very valuable to members of that group, in the same way you would generally value theopinion of your own friends over others.

    - Combined with Openness , (and the fact that, being in-group with another person, your opinionbecomes ever more valuable,) sharing sensitive information that the other person empathizes with

    or, better yet, recognizes themselves in, creates a much deeper and more resilient in-group, makingit easier to extract information from or bond more thoroughly with your target. (e.g. Primarily as awoman, being a fellow rape-survivor creates a more extreme sense of likeness and similarity. Gender-neutral, the same could go for being a fellow sufferer of the same condition (mental or physical illness)as your target.)

    - Regarding peer pressure, please refer to Google for information on the Young Male Syndrome .Basically, the extreme influential power of social pressure can lead to joining in on things ranging fromvandalism to gang rape and even hedonistic, cooperative murder. If pressure can be excessive to thepoint of disinhibition with regards to ultraviolence, with rape and violence being a bonding activity with

    other men and a way to find a group identity, imagine how much else it can accomplish. Simply put:Among our peers, it’s a matter of how others see us , not how we view ourselves, that determines ourbehavior.

    - Another extreme act undertaken to get in-group is suicide bumming, also known as ‘the gift,’ whereyoung gay men intentionally contract HIV so they can be done with the fear of contracting it andallowing them to be in-group with sexually promiscuous homosexual peers. Again, the lengths people goto get in a group, given the desire or need to do so, is highly extreme, and can be used in many ways toinfluence them.

    Halo effect / Horn effect:- The general human tendency towards extrapolation of one perceived good quality to the entireperson. A handsome person must also be smart, a good actor must also be a nice person, etc.

    - The Horn effect is the converse: these people are ugly, so they must also be dumb. These people areforeign, so they must also be violent. (This is also an issue of stereotyping, but the Halo effect is moregeneral, more broad, and is a preemptive bias of a different, sometimes overlapping kind.)

    - See also the fundamental attribution error, since they often work in tandem.

    Human Buffer Overload:

    - ...

    Incongruity:

    - …

  • 8/18/2019 Encyclopedia of Social Engineering

    19/37

    - Incongruity exists whenever you employ a script reversal, an antithesis, to elicit an emotional responsecontrary to what was expected by the target.

    - Whenever expectations are violated, our brains try to restore homeostasis. e.g. When you notice a

    date is mean-spirited because he just responded agitated to a waiter's request on the way to the table,you create a mental buffer that braces you for the impact of falling victim to similarly dishearteningbehavior. When, then, the date walks up and introduces himself with genuine kindness and warmth toyou, your brain's expectation is violated and it releases positive hormones to counteract the negativehormones that were there before. However, his act of kindness itself makes your brain release positivehormones, for a moment heightening your sense of well-being, long enough for you to attribute that tohim. Conclusion: you tend to like people who initially violate negative expectations more than peoplewho are positive from the offset. In that case, it can pay your date to be rude, though it will obviouslynot work consistently without upsetting you.

    In-group:- Any group you belong to yourself. (Sports Club, family, white people, etc.)

    - In-grouping means to try to affiliate with (members of) a group and become recognized as part of thatgroup.

    - People will try to support their in-group at high cost, even when the qualifiers for that in-group arecompletely arbitrary. Also known as us vs. them mentality.

    - People will actually try to make in-groups with whoever they meet (finding likeness, building rapport).

    When trying to establish a bond with a target, give your in-group qualities that you both possess. e.g. Ona date, you find out their interests, and eventually end up with a group like Dog-loving Liberal Baseball-Playing EDM-listeners. The more qualities members of a group share, the harder it is to break the group,and the harder it is to break into a group.

    Interview and Interrogation:

    - In general, elicitation is a complex process that involves practically everything to do with socialengineering. The interview and interrogation as used in police questionings have certain sets of qualitiesattached to them that can be learned from, but ideally, as a social engineer, you will never find these

    qualities exhaustive, and additions and subtractions must be made.

    - In the Interview: The subject talks, the subject leads the direction (or thinks he does), your tone is non-accusatory and soft/warm, the subject is at ease, and the interview is used to gather information early inthe investigation.

  • 8/18/2019 Encyclopedia of Social Engineering

    20/37

    - In the interrogation: You talk and lead the direction, your tone is accusatory and hard in nature, yoursubject is tense, and information is extracted through intimidation or revealing info in the hopes ofobtaining details relating to that info. Generally, this is the final questioning session.

    A good introduction to interview and interrogation, second half of famous lecture ‘Don’t Talk to the

    Police :’ http://www.youtube.com/watch?feature=player_detailpage&v=6wXkI4t7nuc#t=1644

    - In either case, take care to have as much information as possible beforehand, both to use in elicitationand in order to avoid redundancy.- Be careful of the immediate surroundings of your target.

    - Formulate a ‘status quo’ of the target’s behavior. Take note of changes in the behaviour of target,particularly groups of changes. -> See Lie-spotting

    Liking:

    - People like people who like them. Give people the impression you like them, and they will like you inreturn.

    Manipulation:

    - ...

    - A special breed of the more general influence.

    - Used in six ways:

    - Increasing suggestibility.- Gaining control over the target's environment.- Creating doubt.- Creating a sense of powerlessness.- Creating strong emotional responses.- Heavy intimidation.

    - Case-building manipulation: Create a problem, so you can provide the fix.

    Microexpressions:

    - … (For now: http://en.wikipedia.org/wiki/Microexpression )

    http://www.youtube.com/watch?feature=player_detailpage&v=6wXkI4t7nuc#t=1644http://www.youtube.com/watch?feature=player_detailpage&v=6wXkI4t7nuc#t=1644http://www.youtube.com/watch?feature=player_detailpage&v=6wXkI4t7nuc#t=1644http://www.youtube.com/watch?feature=player_detailpage&v=6wXkI4t7nuc#t=1644http://en.wikipedia.org/wiki/Microexpressionhttp://en.wikipedia.org/wiki/Microexpressionhttp://www.youtube.com/watch?feature=player_detailpage&v=6wXkI4t7nuc#t=1644http://www.youtube.com/watch?feature=player_detailpage&v=6wXkI4t7nuc#t=1644http://www.youtube.com/watch?feature=player_detailpage&v=6wXkI4t7nuc#t=1644http://www.youtube.com/watch?feature=player_detailpage&v=6wXkI4t7nuc#t=1644

  • 8/18/2019 Encyclopedia of Social Engineering

    21/37

    - The seven culturally independent and universally identifiable emotions are also the ones most readilyexpressed and recognized in microexpressions. These are: 1) Anger, 2) Contempt, 3) Disgust, 4) Fear, 5)Happiness, 6) Surprise, and 7) Sadness. The signatures of each of these emotions:

    Anger:

    - Lips narrow and tense.- Eyebrows tighten, get pushed together.- Glare forms (eyes get narrower).

    Contempt:- Contempt is only experienced about people or their actions. (Further: This is only applicable to thosesituations where the person or their action causes them to be perceived as below you, rather than just asunsettling (disgust). We might look down upon serial killers in contempt when we interact with them, butwe feel disgust towards the actions of serial killers upon hearing them.)- Nose wrinkles on one side of the face, and lip is raised on the same side.

    - Accompanied by expressions of anger.

    Disgust:- Strong emotion triggered by intense dislike of a certain something (like contempt).- Can be triggered by a mere thought.- Upper lip is raised.- Nose wrinkles.- Cheeks are raised.- More general than contempt, which is person/action-specific and accompanied by anger, rather thanthe surprise that sometimes accompanies disgust.

    Fear:- Raised eyebrows, eyebrows pulled together.- Mouth slightly opened and corners of lip pulled back.- Eyes opened wide.

    Surprise:- Similar signatures to fear.- Eyebrows raised but not pulled together.- Jaw unhinged and opened slightly.

    Sadness:- Overwhelming and strong emotion.- Mouth dropped slightly.- Corners of lip down.- Lips in place, raised cheeks.- Look down, upper eyelids droop.

  • 8/18/2019 Encyclopedia of Social Engineering

    22/37

    - Can be very subtle (e.g. only one part of the face).- Easy to trigger and motivate actions with.

    Happiness:- Real smiles require the cheeks to raise, and the eyes to wrinkle, the latter of which separates forced

    smiles from genuine smiles. (Though you can force genuine smiles with training.)- Real smiles affect your own happiness as well as that of others.- “Faking” real smiles can be trained using Sincere interest . (“Faking” is in quotation mark because, givenenough competence to be/appear sincerely interested at will, and/or given proper Rethinking allowingyou to smile, your smile will actually be genuine - It just won’t necessarily be in response to whateveryou’re feigning responding to. )

    Cautionary warning:

    - Microexpressions are limited indicators , of both emotion and intent. Though they can show the

    subconscious emotion before the target is able to control it, it might also have changed by the time youcontinue the interaction. What might have been controlled sadness might now be genuine surprise orhappiness, and- Like with eye-locations (NLP), it tells you nothing of the why behind both their emotion and thecontrolling itself. ( E.g. Target might be upset (Microexpression: anger) because they remembered anawful event that took place, and they controlled it because it wasn’t relevant to the conversation anddidn’t want to take the anger out on you, rather than that they are upset because of what you are sayingdirectly and controlling it to hide their disliking of you. ) Which brings us to:- Use the information gained from reading microexpressions for elicitation . Do not be assumptive .

    So, how to utilize micro-expressions?

    - To elicit or cause emotions subliminally when used by self. -> See Emotion Elicitation- To detect deceit. (Keeping in mind the warning made above.)

    NLP:

    - Doesn't quite mean what it used to mean, but even what it means now is rather ambiguous. Ignore itas a be all, end all of social engineering. It has some techniques that are discussed elsewhere, but thetechniques are important, not the school of thought they came from.

    - Most noticeably, check out the Human Buffer Overload and remember to evoke feelings, particularlyby summoning memories of the target's experience, either by insinuation, implication or simply askingthem.

    Consider the rest at your leisure:

  • 8/18/2019 Encyclopedia of Social Engineering

    23/37

    - NLP emphasizes the use of intonation and pre-planned sentence structures to ‘load’ sentencesand ‘embed commands’. It comes down to the following: ‘How you say something is more importantthan what you say.’ (Which is true universally, NLP or not.) -> See Ultimate Voice

    Obligation:

    - Action one feels he needs to take due to some sort of social, legal or moral requirement, duty,contract, or promise.

    - Closely related to Reciprocity , but not limited to it.

    - Can be used in small doses by utilizing smart complimenting.

    - Simply asking can create obligation. A question left unanswered creates an awkward atmosphere.There is an inherent need in humans to answer questions, even if not explicit or out loud. This makes

    questioning great for influence. (See additional theory on questions.)

    Order effect, the:- The order in which you present or feed information to your targets will determine how they will think.See also: Framing .

    - Also remember the effect: People will generally remember only the first and lastbit of information you give them, given they have equal potential to elicit emotion. These two effectscombined mean that you should always give the most vital, case-deciding/defining information first.(And possible repeat it at the very end.)

    Perception:

    - Of intent : Perceived intent is more important than actual intent. This is where most faultycommunication lies. Do not assume that a person knows your intent just because it is evident toyourself. Always be as sincere and genuine as possible and explicitly show your intent, where "yourintent" means the one you want your target to perceive.

    - Of self-interest : Perceived self-interest is key in any matter of influence. It doesn't matter if what youoffer or what you ask is in their best interest, as long as it is perceived to be so. Conversely, it doesn't

    matter that what you offer/ask is actually in their best interest, because they will not care to do a thingif it isn't evident to them.

    - Certain kinds of influence go deep enough to affect the perception that targets have. In particular, it’sworth noting that providing false feedback (or feedback of any kind) can cause someone to confirm orreject a perception, and so behave in accordance to that feedback. This makes it so that, fairly easily,you can demonstrate an intent and an interest to a person that isn’t actually there.

  • 8/18/2019 Encyclopedia of Social Engineering

    24/37

    - Social fights are not won by ‘strength of facts,’ but ‘strength of impression. ’ Coupled with Suggestion ,what your perceived status, intent, or even perceived action is, decides in large part the verdict of theother parties and the course of your interaction. E.g., if someone thinks you are disagreeing with them,and furthermore things you’re doing this out of spite, there will be hostility and perhaps conflict, even if

    in reality you are agreeing with them and you are simply frustrated because they don’t understand that.

    Positivity:

    - People respond to enthusiasm and positivity with a similarly uplifted response. Note that peopleemulate and mimic emotions present in their direct vicinity, but they treat them as part of their ownemotions. When introducing a negative atmosphere, or a stressed atmosphere, their response will beequally negative and stressed.

    - Even after negative phrasing ("I am against x!"), there should only be talked and possibilities and

    actions, never in complaint. The same goes for the general "how to make friends/have people likeyou" attempts. Positivity through reward, praise, creating dreamlike (but plausible) prospects andinspirational speech.

    - When confident and positive, and feeding into their self-interests, people will find it hard not to listento what you're saying.

    Pretext:

    - A pretext is a created personality that is used by a social engineer as a cover for his hack.

    - A pretext is no less a person than you or I. It has a background, a manner of dressing, grooming, adistinct personality, attitude and mannerisms. All are assumed by the engineer in an effort to becomethat person, via Method Acting.

    - Pretexting is not an act, it is not a pretense, it is not a show -- for the duration of the hack or howeverlong the pretext is necessary, you are the pretext . Where it begins, you begin, and where it ends, youend. It is not an extension. It is not an expansion. It is you . Therefore, the pretext should be as natural asyour natural self.

    - To increase your pretext’s chances of success:

    1) The more research or planning goes into your role, the better the chance of being able toidentify with your character, and the more natural your character will seem.

    2) Involve your personal interests, emotions, and memories into the character. This is asignificant part of method acting. The more your pretext is like you, and the more his memories andmore emotions are yours, the more easily you can draw from your personal experience to fill in your

  • 8/18/2019 Encyclopedia of Social Engineering

    25/37

    character, making your pretext more flexible and natural.3) Practice dialects and expressions . Aside from generally being a good skill to have, practicing

    a new dialect or vernacular is the ultimate in transformation.4) Stay in role at all times , but in particular take note that using the phone should not reduce

    the effect of your pretext. This signifies the difference between being your pretext and acting like your

    pretext.5) The simpler and less rule-bound the pretext, the better. Real personalities are fluid, not

    rigid, and making a pretext out to be more bound to specific rules and archetypes/prototypes makeshim a less complex person, paradoxically, and therefore less believable.

    6) The pretext should appear spontaneous. You should be naturally inclined to undertake thethings a pretext like that would be naturally inclined to undertake. Spontaneity and its confines is keyto determining who a person is , and, for others, to determine who your pretext is.

    7) Provide a logical conclusion or follow-through. This means that the end of your socialinteraction should be the natural end that would occur given the pretext. Don’t leave people thinking ordoubting. If you’re a tech-guy, end by leaving for the server room, then end the next interaction bygiving the all-clear. If you’re a businessman, make sure to pass them your card; the same with others inrelevant functions, like officers of law; “make sure to give me a call when...”

    8) Like with business/personal cards, make sure to have the materials match your pretext . Abusiness card can give support to any identity, so can uniforms, gadgets, accessories, etc.

    - Establishing your credibility: Within a conversation as a pretext, portray your intelligence andConfidence by discussing and using a topic of mutual interest. Find a path to such a topic, or Elicit orSuggest such a topic. This gives credibility to your pretext, creates likeness, and ensures minimal roomfor error, given mastery or at least higher understanding of the topic discussed. It’s not necessary thatthey are skilled in the topic at hand, as long as they are interested, and they can understand that you are skilled in the topic at hand. (Though in some odd circumstances, just a passing recognition of the topic isrequired. For example, out-boring someone as a Pretext server maintenance guy.)

    - Be who you say you are: Confidence is imperative! Your behavior must not, cannot, and will not existin dissonance with your pretext. Avoid red flags, signalling you are not who you claim to be! Adhere toSPICE and maintain it!

    - Regarding accents/vernacular: If you can’t make it sound natural, don’t try. However, to practice youraccents and vernacular, find recordings (or make them) and speak along. Record yourself and correctyourself. Use a partner to get an independent opinion. Lastly, apply your accent in public. Make nomistake: Your speech pattern is part of the 40% (non-verbal) of the most important 90% (non-verbal,eye-contact included) in communication. It requires every bit the same amount of depth and attentionthat every other aspect of your pretext requires!

    - Regarding failure anxiety, or fear of being ‘found out:’ The person you are talking to has no idea whatyour intentions and motivations are. Barely anyone even knows what a pretext is, let alone understandsit, let alone watches out for them. The odd ones that do are called ‘paranoid schizophrenics.’ Thus, you

  • 8/18/2019 Encyclopedia of Social Engineering

    26/37

    cannot ‘mess up’ a conversation . If you fail to qualify as a ‘tech guy,’ the other guy will most likely thinkyou’re dumb or uneducated, not a malicious social hacker. Be realistic in your assessments. Shave withOccam’s Razor!

    - Regarding simplicity: In conversation or phone calls, use an outline or prototype, not a written-out

    script. Adaptability, flexibility, creative freedom, spontaneity, etc., all these things comes from makingthe pretext a part of you, rather than changing who you are entirely .

    - i.e., If a pretext relies on intricate details it is likely to fail. Giving only the bare minimum of informationallows for targets to fill in the gaps (as is done with Cold Reading ), and thus makes it easier for them toaccept. Don’t give too much information, or you might contradict their automated minds, and makethem consciously think about you. That’s the last thing you want. As can be seen with psychic mediums(i.e., those using Cold reading ), simplicity and lack of detail in this way make something more believable,not less.

    - Additionally, making mistakes is natural, so making a few mistakes makes the conversation morenatural. Don’t get stressed out or shy away from mistakes. (This is good life-advice as well.) You’re not arobot, and your making mistakes convinces people of that in an effective manner.

    - A few short notes of advice to close off this section:1) Don’t think too much about how you feel - it leaves no room for your pretext’s feelings.2) Don’t take yourself too seriously. Failure is good. Embrace and appreciate failure (Cool

    philosophical lecture on failure: http://www.youtube.com/watch?v=aK4pR1Uatqw )3) Learn to identify and focus on what’s relevant. Be sure to listen to your target. Get out of your

    head and into the world. Even if you don’t normally, act as if your pretext does.

    4) Seek to gain experience everywhere. Simple little conversations enormously help spontaneity,basic social skills, empathy, minor influence, etc. Practice, practice, practice. Everything is a practiceopportunity. In fact, life is a giant practice opportunity. Like with information (see also: Sincere interest ),nothing is ever a waste.

    Prototype, Conversational:

    - ...

    - This will be an article separate from the encyclopedia, as it’s more of a guide than an explanation.

    - Mostly novel statements here until it’s separated from the encyclopedia. This means the rest can befound/concluded from reading the other sections.

    - These are generally good things to do, but it varies vastly depending on the situation.

    http://www.youtube.com/watch?v=aK4pR1Uatqwhttp://www.youtube.com/watch?v=aK4pR1Uatqw

  • 8/18/2019 Encyclopedia of Social Engineering

    27/37

    1) Smile genuinely, and charmingly, and as often as is reasonable. Don’t overextend your smiles at riskfor them being misinterpreted for laughter or irony.2) See Touch for specifics, but try to keep the gestures and touches as neutral as possible while stillkeeping them personal (i.e. don’t create tension with them).3) Keep eye-contact as close to 90% as possible when listening, and as much as is comfortable for the

    other party when speaking (should be around 50%). Use a soft, thoughtful gaze, so you don’t come offas staring.4) If you must look elsewhere on their bodies, don’t stress yourself, and do just that right after your firstgreeting. This eliminates the tension you get from not trying to look into her overly exposed cleavage, orthat unsightly piece of jewelry, etc.5) Be complimentary, but in a complementary way. Fill in and add to the conversation withcompliments, don’t make them a different topic and draw attention away from what the conversation isactually about. People like compliments, but people also like focus and attention.6) On posture, it’s important to do all of this within the confines of what is needed to establish Rapport .In general, place your hands on the table, raising them only when you speak - don’t hide them, don’t putthem in the way of your Heart-to-Heart connection. Make sure nothing interrupts the line connectionfrom your target’s body’s centre to yours. Straighten your back, but don’t sit up straight unless you wantto be intimidating. Sit forward instead, head tilted slightly.7) Don’t interrupt, ask open-ended question, give conversational feedback based on what you’rehearing. When talking yourself, be inviting (in the sense that your tone and pacing ‘invites a response’),talk about things in terms of the other person’s interests (and with the ‘you’-principle), and be bothconfident and emotionally driven in what you’re saying. (i.e. Show that you know about the topic and care about it.)8) Sit opposite a person for an intimate or intimidating interaction (generally a bad idea, situationallygood). Sit your chair at a 90 degree angle from a person, if necessary turning your body to face them at a45 degree angle. This is a good and intimate, yet personally and physically secure way of interacting.9) LOTS MORE TO REMEMBER

    Openness:

    - Largely discussed in the context of other terms, but there is a very large advantage in conveying asense of absolute openness and disinhibition, especially when eliciting through Reciprocation . Though Irecommend complete openness only in relations with friends or romantically, I recommend exerting anaire of openness in practically every situation.

    - People act and converse as others act and converse, generally, but especially when good rapport hasbeen established (there are some exceptions, but none deserving of specific mention). Unconditionalopenness is a good rapport-builder and a good eliciter when rapport has been established. ThroughReciprocity , Obligation due to it, and Empathy , all building trust when your openness appears genuine(which is really inherent to its conveying), being open all but necessitates your targets to trust you andopen up themselves.

  • 8/18/2019 Encyclopedia of Social Engineering

    28/37

    - It is essential for engaging in an open and stimulating (eliciting) conversation to make the otherperson the sole topic of interest. Experiences (whether in work to elicit work-related info, or personalto elicit sensitive information, for example in a therapeutic setting) should always be relevant to theother person and invoke in them a sense of empathy and understanding; never should this mean youdominate over your target in the conversation. It might be a story about you, the conversation is still

    about them .

    - As discussed in Flipnosis (the book), intelligent and sociable psychopaths (understand the differencebetween asocial, meaning not-social, and antisocial, meaning going against societal rules -- the latterdoesn’t preclude social skills) very easily come across as open, because openness is nothing more thandisinhibition put into effect (comparatively easy for one attaching no value to telling sensitive info,whether fraudulent or genuine).

    - This is to say: what you share is not important, and whether or not it’s true is not important, as long asit appears true and is valuable to your target .

    Rapport:

    - …

    - More extensively discussion on the possibilities can be found in Group Psychology, but building rapportwith crowds is vastly more difficult because you cannot match tone and posture -- however, you canmatch attitude and wording to a large extent.

    - Rapport is likeness and understanding (cognitively, emotionally and physically), but when not normally

    someone you'd build rapport with, requires effort to establish a send of likeness and understanding.When in agreement, and when inclosed, your target will be locked in rapport.

    Reciprocity:

    - The inherent expectation that when others treat you well you respond in kind.

    - Important because often done unconsciously.

    - Usage: Created indebted feelings, then ask for what you want.

    - Is really about the compliance with an established social protocol, and by extension compliance withthe trade agreement the social engineer creates.

    - There are interesting possibilities with the use of reciprocity in otherwise suspect situations. Forexample, suppose you are shoplifting and they have (or don't have) an "always-show-your-bag-to-the-cashier"-policy. Show them the largest cache of your backpack, and they'll almost always feel morally

  • 8/18/2019 Encyclopedia of Social Engineering

    29/37

    obligated to not check the other caches, because you've done them a favor already.

    Scarcity/Exclusivity:

    - Objects and opportunities that are rare or hard to obtain are more attractive and considered more

    valuable.

    - Can be introduced into social situations in an attempt to make something one has go up in value. Also,remember: time is the most valuable asset anyone has, because it's the one thing you can never getback!

    - Scarcity of attention is a great way to make people want to get your attention.

    - Impressions of low demand are worse than impressions of high demand, because of the principle ofexclusivity and Social Proof . However, bear in mind, impressions of low demand will lower the value of

    something, even when the actual demand is high. Conversely, impressions of high demand can makesomething more desirable even when the demand is actually low. (Used extensively in marketing.)

    - This principle of exclusivity also extends to a social setting, combining with Social Proof . Strictlyspeaking, a person is exclusive to one other person in a romantic sense. Even the inconvenience of aladies’-man being a ladies’-man, namely the many women that chase him (target), is mitigated for thewoman thinking about seducing him exactly because the numerous affections he receives validate thatwoman’s choice for him, as they make him more prestigious to have. Even the attentions displayedby the ladies’ man towards a woman who proclaims to not be into ladies’ men are amplified by theseprinciples. (i.e. Rationalized as “Of all girls, he chooses me!”)

    - In fact, financial and emotional investment when bidding, as occurs in ‘mating,’ occurs because of athrill to compete and get exclusivity.

    Signature:

    - Any recognizable identifying characteristic of a person, no matter how small. (Always wearing a pinkshirt, always buying a single apple at the supermarket, etc.)

    - People remember odd things out, and it makes them think of (and talk of) you, even if it's not about

    your signature. It's hard to not remember unique or striking things you encounter during the day.

    - Make sure it isn't weird in a disturbing way (excessively noticeably bright clothing with mismatchedcolors). That ensures quite the opposite type of recognition you'll want.

    Simplicity:- …

  • 8/18/2019 Encyclopedia of Social Engineering

    30/37

    - K.I.S.S.!

    Sincere apology:

    - Due to the nature of human social interactions, it is better to have conflict and resolve it than to

    never have conflict. This creates tension. And due to the points made in Sincere interest, it is betterto never have real conflict. This goes outside agreeableness, and extends into warmth. Remember thefollowing: "It's better to make an error and sincerely admit it than not to make an error at all."

    - That includes errors intentionally made for the express purpose of apologizing.

    Sincere interest:

    - The only way one can become charismatic in the warm variety is by evoking in the subject a sense ofbeing recognized. However, even for the trained charlatans interest is difficult to feign, and so the only

    way to establish a friendly pretext is by becoming sincerely interest in both their person and their owninterests and well-being.

    - Caution: this could cause you to start caring deeply about practically everyone, and honing this skillmay cause you to become empathetic to a great many things. If you wish to be a cold-hearted loner, thismay not be for you.

    - Used by all social engineers (of the good and bad variety) extensively, and is usually done byestablishing (via a principle similar to those in method acting) that their interest is your interest. This isnearly universally the case, so it is quite easy. It is equally easy, counter to the second note, to disregard

    this attachment after obtaining your interest.

    - Reaches beyond mere interest. If every interaction becomes a game of maximizing both pleasure forboth parties and your own interests, you will also come to be very easy to get in conflict with. Onceunderstood that nearly no interaction benefits from argument (Ask yourself: Would you rather win anargument, or win a friend?), this sincere interest in their well-being will allow you to resolve argumentsbefore they begin, and admit openly and sincerely to have been at fault even if there was no fault toplace. With trained empathy there can always be conceived of a frame of reference where one canapologize earnestly, no matter the situation.

    Sincerity:

    - …

    - See sub-topics of sincerity for more extensive explanation.

  • 8/18/2019 Encyclopedia of Social Engineering

    31/37

    - Exerting an air of honesty and openness is the key to all successful communication, be that in speech,touch, eye-contact, honest smiles or other applicable non-verbal components of communication.

    - Social skill , and social engineering skill, must not be social proof! Lacking empathy, and lackingemotional interest, is fairly easy to subconsciously pick up on. It will seem dishonest and disingenuous,

    or ‘formal,’ or ‘pleasing/ingratiating,’ that you are socially conforming, in short: It will seem like youbehave the way you behave because that’s how you’re ‘supposed to’ behave. Do not make thatmistake. Genuinely aspire to be a good conversational partner. Do not fake it.

    Social proof:

    - A psychological phenomenon that occurs in social situations when people are unable to determine theappropriate mode of behavior. Keep in mind: The way we see others depends on how others see others .

    - Will mirror the consensus of social behavior visible when there is no frame of reference for how tobehave in a situation.

    - Uncertainty or ambiguity in the situation and similarity to self of people to mirror will create the mostinfluential circumstance for social proof.

    SPICE:

    - Simplicity

    - Perceived self-interest.- Incongruity - Confidence- Empathy

    - These 5 are the key components of flipnosis, on the spot instant persuasion, though they are alsogenerally necessary in all other affairs of influence.

    Suggestion / planting:

    - …

    - Making it so that a desired plan or behavior or emotion is planted in another person's mind, so thatthe idea seems theirs, not yours. That way, you won't need to persuade them to do what you want, andthey won't feel like they're doing something for you. Rather, they will do it on their own accord, andwon't feel like you are indebted to them, or have been unreasonably demanding.

  • 8/18/2019 Encyclopedia of Social Engineering

    32/37

    Suggestion, negative:

    - As explained in "White bears and other unwanted thoughts," simply not wanting a thought is enoughto think obsessively in an attempt to rid oneself of it.

    - Combining this with the idea of commitment all but ensuring actions ("Could you watch my briefcase,I need to go to the bathroom?" - 90% defend against theft vs. 0% ), and the idea that questionsare automatically answered internally (Doc: Theoretical - Questions) we end up with the followingexample: "Don't you miss me too much, okay?" This firmly plants you in their mind.

    Sunk-cost fallacy:

    - The human tendency to inefficiently attribute value to spent resources and what is obtained forthose resources, even when the received item in the exchange itself is unfavorable to possess. It iseconomically (and socially) “irrational” behavior, which springs from the target’s assumption that they

    have passed the point of no return.

    - An example is going to the movies, and, due to the money spent on a movie ticket you’ve bought, youwill want to finish watching the movie, even when you’re feeling ill or the movie is plainly unenjoyable,so as to not “waste resources.”

    - Socially, this leads to a number of interesting phenomena, mostly tying into Consistency andCommitment .

    - As I’ve mentioned, you should never feel obligated to fulfill further commitments to remain consistent

    when you are losing value by doing so. People tend to stay in relationships that are destructive andunsalvage not mostly due to the fact that they believe it is salvageable (which is also a factor), but duethe fact that they think they stand to lose all the resources they’ve put into it with nothing to show forit.

    - As you by now understand, this is highly exploitable. By committing (either for Reciprocation or by committing material resources) almost anyone will extend a relationship far past the pointwhere it benefits them, merely due to the expectation that it will benefit them in the future and theunwillingness to resign all their efforts and input energy. It is thus fairly easy to either gain more out ofa relation/interaction than you put in, and even continue to do so by minorly returning favors at some

    point . (This is also why battered wives exist. They are unwilling to let go of something destructive for thefew benefits it has, as well as their idea that “all has been for nothing” should they resign from it.)

    Touch:

    - …

  • 8/18/2019 Encyclopedia of Social Engineering

    33/37

    - Touch itself flows upwards in hierarchy. When you touch another person, you are showing them one ormore of three things:

    1) You are not intimidated by them. You cannot touch someone that scares you or is above you socially.(You can also not touch co-workers of the other gender too much, as that could result in a lawsuit.) This

    shows power.

    2) You trust them. Especially among the erstwhile (read: at first) socially awkward or emotionallydamaged, this rings particularly true. You need trust to be able to touch someone socially, both in themand in yourself. This shows warmth and (social) power, and either creates Rapport and a sense of trustfor them, or it creeps them out, depending on your intentions and presentation.

    3) You elevate them to your standing socially. It can be an equalizer in this regard. It says, implicitly:“You are of value to me.” The hier-ups (in work settings, personal settings and in general social settings)will touch the lower-downs, and elevate them with that. Again, it builds trust and familiarity incredibly

    fast. It shows warmth, presence, and in certain ways it shows empathy.

    - All of these show confidence and presence. Otherwise noted is just “in particular.”

    - Touch is so incredibly important that I can scarcely wait to type more about it.

    Ultimate Voice:

    - [...] Just notes for now. Will expand after all notes are finished.

    - Extension of the intonation and linguistic usage in NLP.

    - Note that questions end with ‘up-swings’ in your intonations, while commands use ‘down-swings.’Using up- and down-swings in other parts of your sentence can either make your target considersomething as unsure (up-swing), or something else as imperative or true (down-swing). Try to practicesubtle up- and down-swings to create minor influences.

    - A careful consideration of sentence-structure is necessary for this effect, as well as for communicationin general. [...]

    - To practice intonation, 1) move around your voice as is done in singing lessons, going High-to-Low andLow-To-High. 2) Resonate, humming the vocalizer “um” following the same pitches as before. Allow lipsto vibrate as you do so.

    - Practice vocal tones and emphasis by dramatizing sentences, then slowly work on making youremphasis be more subtly and natural.

  • 8/18/2019 Encyclopedia of Social Engineering

    34/37

    - Choose words and word orders carefully (e.g. Negative words with negative things, and vice versa). [...]

    - Create a list of command sentences. [...]

    ‘You’-principle:

    - …

    - One of the most highly-recommended change to speech mannerisms within marketing (e.g. sales-letters) and political rhetoric is talking engaged through using the ‘you’-principle. Focusing on youraudience as both the target and the subject of your entire interaction creates engagement by and toyour argument more than any other influence principle out there.

    - Practice of this principle is done in three ways. 1) Substitute “I,” “they,” etc. for “you” whereverpossible, 2) add “you” wherever possible in a neutral sentence, and 3) prioritize “you” over “I” by placing

    it first in any sentence.

    - Example of 1): Rather than “I’d like us to work together on this one…” say “I’d like you and I to worktogether on this one...” or one step further, even better, “So, do you think it’d be good to work togetheron this one?”

    - Example of 2): Rather than “John stole my bike last year, so it figures that...” say “ As you may know,John stole my bike last year, so it figures that...”

    - Example of 3): Rather than “Out of all people, I’d expect you to know that,” say “Out of all people, you

    should know that.”

    - Preferably, and this ties in with a lot of things (Doc. Theoretical: Questions, elicitation, suggestion,agreeability), try to always ask things that have to do with the ‘you’ in question: “Do you know who…?”“Have you and John…?” “What do you think about…?” (As always, preferably open-ended to keepthe ‘you’ engaged, but close-ended when needed.

    Unedited Notes:

    ///

    ////

    !Don't forget to recheck the .docs that were sent to you!

  • 8/18/2019 Encyclopedia of Social Engineering

    35/37

    Five-factor model, big five: Extraversion (sociability), emotionality (anxiety), agreeableness (conformity),and Openness to experience (curiosity).

    Situations and personality influence behavior. Change situations if the behavior is not conform your

    desires.

    People construct their own meanig from experience; they assign value based on interactionbetween 'raw matter' and their mental faculties.

    Remember that even objective reality is just a widely agreed upon interpretation.

    Conditions of worth; meet these citeria to be loved.

    UPR - Unconditional Positive Regard: Need full acceptance to reach potential. Criticize situations and

    behavior, not people.

    ---

    Eye-contact; at least 90% while listening, 50% while talking. (Can be trained)

    Empathy; When we are vulnerable, we are at the height of our persuasive powers. (Evoke empathy witha sob story)

    Dilated pupils signifies attraction, and with rapport indicates interest.

    Commitment; When your target approaches you, they've made a much larger commitment. Whenpossible, have them approach you or make the suggestion, then trap them.

    Empathy; Nonchalance helps with openness. 'It is not important or it cannot harm you.' Avoid lookingemotionless or indifferent.

    Onbewust laten denken 'het is ok/normaal/goed zo.' Fake it until you make it, social proof.

    Reasons and justifications are processed under some circumstances like functional words like 'of.' Most

    check long enough to see if there is a reason, not what that reason is.

    ---///

    Emotion Elicitation:

  • 8/18/2019 Encyclopedia of Social Engineering

    36/37

    > Physicality decides emotionality: A body does what the mind feels, and vice versa. Holding a sadposture makes one sad. Good for pretext/acting and for summoning emotions one wants. (MC)

    > Emotion elicitation: If producing the facial expression can cause that respective emotions, that mustmean that our facial movements can affect the emotions we ourselves feel, and the emotions others

    around us feel. (As long as they aren’t significantly incongruent .)

    > A person can manipulate another person to a certain emotional state by displaying even subtlehints of emotion. Subtle hints of nervousness can break charisma, subtle hints of anger can make aconversation hostile, subtle hints of joy can make another person happy, etc.

    > For subtlety, using Micro-Expressions to cause an emotional response works well. Learning to exhibitsubtle hints of emotions (Micro-Expressions), either consciously or through consciously evoking anemotion and then controlling it, when applied causes the mirror neurons of the target to kick in anddisplay the same emotion, evoking it by the principle Physicality decides emotionality .

    //////

    Lie-spotting/Lying:

    - …

    - All principles stated here, as well as those in Pretext and Sincerity , can be used to become a skilled liar.

    - Any change from normal behavior indicates deceit. There are 100s of markers that can indicate deceit,

    but only if they deviate from the norm (i.e. base-line) of that person’s usual behavior and personalityshould you assume those behaviours indicate deceit.

    - Cautionary note: Never be assumptive. Knowing deceit is taking place (through behavior analysis, orreading Micro-expressions, etc.) tells you nothing of the why .- Another cautionary note: Even an honest person is not necessarily telling you the facts you need tohear. Truth and facts are very different, and only one is objective. A person can not only misinterpretthings, but it is perfectly possible to lie to yourself for an extended period of time and earnestly startbelieving your own lies. It needn’t even be conscious lies. (False memories are an example of that.)- Generally, untrue stories can’t be told in reverse. (...)

    - Hesitation can indicate deceit, but only if their answer has not been prepared.- Liars tend to look more at the person they’re lying too, not less. (Which, by the myth of “liars shyaway,” makes it very easy to appear honest.)- Contradictions indicate deceit, but the nature of the defense after pointing out the contradiction tendsto verify it. People misremember things, explain them incompetently, and all around forget things thatthey fill in. This does not mean they are intentionally deceiving you.

  • 8/18/2019 Encyclopedia of Social Engineering

    37/37

    ///

    NLP Core principles:

    - Anchoring

    - Swish Pattern- Reframing- Belief change- Nesting Loops- Chaining states- Submodalities applications- Golden voice- Human Buffer overload

    ///

    - Sections to add: Lie-spotting, Lying, Emotion Elicitation

    - Note to self: create sections on the various heuristics. They are treated in other sections, but availabilityheuristics require special attention. > Wonder where I can now put in the piece where “the brain hasan unfailing capacity to jump to conclusions, which you can rely on.” It’s in part the Halo effect, in partFirst Impression, and in part Availability Heuristics. Remember people: in most cases, omission of data isREALLY IMPORTANT when giving a first impression.