Me Talk Good: Language and Social Engineering

| March 20, 2009

stones.jpgIt’s a fact, Jack. Nearly 100% of social engineering engagements will involve the use of language.

Yes, that was trite and obvious. But it’s also true. Which means that if you want to engage an organization or individual as a target for a social engineering attack, your ability to use language will be a significant factor in the success or failure of your attack. Even more precisely, you have to know the different ways that language can be used, and the differences in the language patterns and formats for each of those uses. Only then will you be empowered to structure your language in such a way as to have maximum impact.

Before talking about how to use language, you have to be aware of language. While most of us are not aware of it, language has two (and only two) distinct actions: the movement of information and the act of influence on another person.

Active Image
Active Image del.icio.us

Discuss in Forums {mos_smf_discuss:Murray}


chicagoconlogo.gif
Mike Murray will not only be teaming with Chris Nickerson for the Social Engineering Master Class at CHicagoCon 2009s, he will also be hosting his own breakout session during the event on Saturday called, "The Doctor Is In" as an open dialog on career advancement.


Imagine the following sentences:

• "The computer is sitting on the table."
• "Where is the server room?"

These sentences are both used for information transfer. (As, you will probably note, are most of the sentences in the article that you are presently reading.) Another example, however:

• "Stand up, walk across the room, and then sit down against the wall."

This sentence conveys no information. It requests an act of influence that tells you nothing, and attempts to influence you to perform an act.

I have yet to come up with an example of a linguistic act that is not part of one of the above classes. All utterances are designed either as part of information transfer or as part of an attempt to influence.

Most people could probably arrive at that conclusion. However, what most people fail to note is that the language used to perform each act successfully is quite different. The key to success in information transfer is precision, while the key to accomplishing successful influence is the ability to maintain agreement. (Note: the example sentence above would have been particularly poor at influencing).

Precision and Information Transfer

There’s something that I need you to know. It’s vital that you understand what I’m getting at. Ready?

The thing that happens when you do something is really not so good. In fact, it’s down-right bad when you do that thing and set off the other thing.

Got it?

Of course you don’t. You have absolutely no idea what I’m talking about.

Why not? My sentences made sense. They were grammatically correct and properly formed. They contained a subject, an object, and appropriate use of language. But you lack understanding of the information that I was trying to convey because there was not one precise statement in that entire idea.

As a source of information transfer, the key ingredient in effective communication is precision. Clear and effective information transfer uses precise and unambiguous words to ensure that transfer of information conveys the meaning of the conversation.

For an example of precision, I’ll use the following example:

"On my morning run, I saw a flower."

As you read the sentence, what kind of flower did you imagine that it was?

Note that this is ambiguous precisely because you had to imagine it. In order for me to be more effective at transferring information to you about the flower, I would have had to be more precise about the flower. Better would have been:

"On my morning run, I saw a red flower."

Even better:

"On my morning run, I saw a 7 inch high red rose growing on a bush, with thorns on the stem."

Note that this can get ridiculous, and the important skill in information transfer is always knowing exactly what level of precision is required, but that’s a future article. In fact, we’ll dive a good deal deeper into language, information transfer and precision in future articles. For now, just know that information transfer is the first type of linguistic act.

Influence and Agreement

Most of us grew up in the western academic tradition. We are "Voltaire’s Bastards," as John Raulston Saul called us – we believe in the importance of rational discourse and reason as triumphing all other methods of communication.

In layman’s terms: we learned, as children, that the way to convince someone else was to structure an argument that contained more and better logical points than our "opponent". And that the person who had more facts and better logic would "win."

Unfortunately, modern neuroscience has proven that this is all wrong. It turns out that our grandmothers had it right when they said: "Those convinced against their will are of the same opinion still." Neurology has found that being "convinced" is unlikely to make someone change their behavior.

The reason for this is what pioneering hypnotist Dave Elman referred to as the "critical faculty" (and what some have called the "memetic immune system"). Our minds work to maintain consistency with the things that we currently believe. And, when an idea shows up that is inconsistent with the person’s current set of beliefs, a part of the mind raises the "b.s.” alert, and the mind becomes immediately resistant to influence.

I’m sure you’ve had the experience of being in a conversation, and the conversation is going along smoothly. Suddenly, the person with whom you’re talking says something and you find your brain reacting. You’re suddenly on high-alert for everything that they’re saying.

That person somehow activated your critical faculty.

To sum it up simply, when thinking about influence, your goal is to never activate the critical faculty in those who you are working with. This is achieved by using language that always allows the target to maintain agreement with what you’re saying.

We’ll go far, far deeper in to how to do that in future articles. As well, Chris Nickerson and I will be giving a whole pile of ways to do that in our training course, the Social Engineering Master Class, at the upcoming ChicagoCon 2009s.

That’s a quick overview of the first important skill of a social engineer: the ability to use language. Obviously, there’s much more to come on this topic in the future. Next time, I’ll be going in to the second major skill of the social engineer: awareness of others. If you aren’t aware, you’re not able to react.

Category: Murray

Comments are closed.