Image
 
linkedin_logo.png rss_logo.jpg
twitter_logo.png youtube_logo.jpg
Latest Additions
 
EH-Net Login
Welcome Guest.






Lost Password?
No account yet? Register
Who's Online
We have 243 guests online
 
Free Business and Tech Magazines and eBooks

You are here: Home arrow Columnsarrow Hadnagyarrow [Article]-Look Mom, I`m a Thespian: How to Use Acting Skills as a Social Engineer
EH-Net
May 20, 2013, 03:53:12 AM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: Go back to The Ethical Hacker Network Online Magazine Home Page
 
   Home   Help Calendar Login Register  
Pages: [1]   Go Down
  Print  
Author Topic: [Article]-Look Mom, I`m a Thespian: How to Use Acting Skills as a Social Engineer  (Read 3735 times)
0 Members and 1 Guest are viewing this topic.
don
Editor-In-Chief
Administrator
Hero Member
*****
Offline Offline

Posts: 4165


Editor-In-Chief


View Profile WWW
« on: February 24, 2012, 01:07:41 PM »

In our continuing series of articles on making you a better head hacker, he's some great advice on where to get skills that won't be taught in a tech manual.

Your homework this month is to share with us your stories of how your own acting prowess helped you in social engineering... even if not for a pen test.

As an example, I did a lot of acting when in HS and college. I can honestly say that it not only allowed me to pass over the biggest fear most people have, public speaking, but it also gave me the confidence in delivering a written line. These skills help me pretty much every day in my business life as it makes me comfortable speaking, hosting webcasts and making business calls. People often mention that I social engineer my way into getting all of the great Monthly Giveaways here on EH-Net. That's not far from the truth.

Your turn...

Permanent Link: [Article]-Look Mom, I`m a Thespian: How to Use Acting Skills as a Social Engineer

Quote


Chris Hadnagy

Social Engineering is a complex beast.  It is not simply lying or telling someone a deceitful story to get them to give over their passwords.  Social Engineering (SE) is defined, well at least by me, as any act that influences a person to take an action that may or may not be against their best interest.  With that definition in mind there are many different principles that influence SE and the skills needed both physically and psychologically.

The concept behind this column is to provide the tools, techniques and direction to the readers that would like to either incorporate more SE into their current work or to become a full-time social engineer. I would like to take this month’s article to talk about at least one of the psychological principles involved in SE that should be considered foundational and required. It makes a huge difference in your ability to be successful.


Have fun with this one,
Don
Logged

CISSP, MCSE, CSTA, Security+ SME
ajohnson
Recruiters
Hero Member
*
Offline Offline

Posts: 1057


aka dynamik


View Profile WWW
« Reply #1 on: February 24, 2012, 01:58:38 PM »

One of my personal favorite SE stories was going on-site as a "pest inspector." I met with the client the morning before the engagement, and they candidly told me that they didn't expect me to get into any of the locations because they have such a good security program (it actually indeed turned out to be above average compared to what I usually see). Challenge accepted!

I had an approximate 40-minute drive to the first location, so I had a bit of time to do some scheming. I had already sent fake emails to the local managers informing them of the inspection, which usually goes a long way if they're well done (I bought a similar domain, that used alternate letters, that was virtually indistinguishable from the real one, and I used the ops manager's name, signature, and formatting), but I felt I needed to go a little further for this engagement.

I ended up stopping by a grocery store and picking up a box of pastries for each location. As soon as I went into each location, I told the manager how much we appreciated their business in this economy and how much we valued them as a new customer. Not only did the managers go for it, but I'd randomly see people walking around the facilities with the pastries, and they'd exclaim, "Did you bring these!? Thank you so much!"

I was everyone's best friend and was able to go wherever I wanted, unescorted. It was utter annihilation. I also learned that sensitive information is worth as much as a box of pastries. It reminded me of the study where people shared their passwords in exchange for candy bars.

Like the article says, confidence is key. I don't consider myself to be "smooth" by any stretch of the imagination, but I was able to remain cool and collected despite the butterflies in my stomach going out of control, and that's what sells it.


Logged

WIP: GCFA | www.infosiege.net | @infosiege

The day you stop learning is the day you start becoming obsolete.
lorddicranius
Sr. Member
****
Offline Offline

Posts: 447



View Profile WWW
« Reply #2 on: February 29, 2012, 01:23:46 AM »

I love reading SE stories Smiley

I'm thinking about other scenarios where acting comes into play and one scenario that comes to mind is the simple trick of "hey, look!" while you point behind the person you're trying to get to turn around.  I can see how actions needs to back up words in this scenario, and can also be accomplished without the use of words.  A facial expression to express bewilder instead of just yelling "hey, look!", the slight turning of your head in the direction you want them to look, maybe jutting your head forward just a tad in that direction as well.

Anyway, just some thoughts I thought I'd share Smiley
Logged

GSEC, eCPPT, Sec+
Pages: [1]   Go Up
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.18 | SMF © 2013, Simple Machines
Joomla Bridge by JoomlaHacks.com
Valid XHTML 1.0! Valid CSS!
Page created in 0.09 seconds with 23 queries.
 
Exclusive Deal

sansfire13_245x90_cw90.jpg
SANSFIRE 2013
June 15 - 22

5% Off w/ Code: EHN_5

SANS Deals 4 EH-Netters
5% OFF Any SANS Course in Any Format!
Coupon Code: EHN_5 Including SANS Rocky Mountain 2013 & SANS Boston 2013
Polls
Compared to this year, 2013 will be:
 
Recent Forum Topics
EH-Net News Feeds
Latest Additions
 
         
Advertisement

© 2013 The Ethical Hacker Network
Joomla! is Free Software released under the GNU/GPL License.