Unmasking the Social Engineer E-Book

Christopher Hadnagy

• Herausgeber: John Wiley & Sons
• Kategorie: Wissenschaft und neue Technologien
• Sprache: Englisch
• Veröffentlichungsjahr: 2014

Seitenzahl: 269

Beschreibung

Learn to identify the social engineer by non-verbal behavior Unmasking the Social Engineer: The Human Element of Security focuses on combining the science of understanding non-verbal communications with the knowledge of how social engineers, scam artists and con men use these skills to build feelings of trust and rapport in their targets. The author helps readers understand how to identify and detect social engineers and scammers by analyzing their non-verbal behavior. Unmasking the Social Engineer shows how attacks work, explains nonverbal communications, and demonstrates with visuals the connection of non-verbal behavior to social engineering and scamming. * Clearly combines both the practical and technical aspects of social engineering security * Reveals the various dirty tricks that scammers use * Pinpoints what to look for on the nonverbal side to detect the social engineer Sharing proven scientific methodology for reading, understanding, and deciphering non-verbal communications, Unmasking the Social Engineer arms readers with the knowledge needed to help protect their organizations.

Leseprobe

Table of Contents

Foreword

Acknowledgments and Preface

Introduction

The Scholar and the Student

Using This Book as a Social Engineer

Part I: Building the Foundation

Chapter 1: What Is Nonverbal Communication?

The Different Aspects of Nonverbal Communication

How to Use This Information

Summary

Chapter 2: What Is Social Engineering?

Information Gathering

Pretexting

Elicitation

Rapport

Influence/Manipulation

Framing

Nonverbal Communications

The Three Basic Forms of Social Engineering

Using Social Engineering Skills

Summary

Part II: Decoding the Language of the Body

Chapter 3: Understanding the Language of the Hands

Communicating with Your Hands

Getting a Handle on the Hands

Summary

Chapter 4: The Torso, Legs, and Feet

Legs and Feet

Torso and Arms

Summary

Chapter 5: The Science Behind the Face

Just the FACS

What Is a Truth Wizard?

Perfect Practice Makes Perfect

Summary

Chapter 6: Understanding Nonverbal Displays of Comfort and Discomfort

Neck and Face Pacifying

Mouth Covers

Lips

Eye Blocking

Self-Comforting and Head Tilts

Summary

Part III: Deciphering the Science

Chapter 7: The Human Emotional Processor

Introducing the Amygdala

Hijacking the Amygdala

Human See, Human Do

Using Amygdala Hijacking as a Social Engineer

Summary

Chapter 8: The Nonverbal Side of Elicitation

Artificial Time Constraints

Sympathy/Assistance Themes

Ego Suspension

Ask How, When, and Why Questions

Conversational Signals

Conversational Signals of Emotions

Breaking Down Conversational Signals

Nonverbal Conversational Signals

Conversational Signals as a Social Engineer

Summary

Part IV: Putting It All Together

Chapter 9: Nonverbal Communication and the Human Being

Applying This Information as a Professional Social Engineer

Using This Book to Defend

Becoming a Critical Thinker

Summary

WILEY END USER LICENSE AGREEMENT

Foreword

From my initial research into reading the emotions of the face, to my more recent collaboration with the Dalai Lama in writing Emotional Awareness: Overcoming the Obstacles to Psychological Balance and Compassion (Holt Paperbacks, 2009), understanding people and their interactions with others has been my passion. I have spent decades examining not only how emotion is displayed, but also what people do and do not understand about why their emotions are triggered and how they behave once they become emotional. Doing so has enlarged my perspective on how to improve emotional life.

A little over four years ago, Chris reached out to me with his idea of blending my life's work with his research related to social engineering. It was very interesting to listen to him talk about his work. He made people aware of the manipulative efforts of certain people to exploit them, and he showed them how to reduce their personal and/or corporate vulnerability to such efforts. The goal of combining our work to help mitigate this risk was the key factor in my choosing to support Chris in the writing of this book.

Chris has nearly embarrassed me with his praise for my work and his interest in it. However, there is a benefit! He has worked hard to make my work known and, more importantly, useful to those working in social engineering. He also has been very responsive to the feedback I have given him and to the input provided by PEG trainer Paul Kelly, his technical editor. PK invested a great deal of time in reviewing this book, making suggestions and providing relevant examples of his own, drawn from his extraordinary experience in the fields of intelligence and national security.

Specifically, in reading Chapter 5 on facial expressions, and the section in Chapter 8 on conversational signals, you have the benefit of my work, PK's experience and insight, and Chris's knowledge of social engineering—an exciting, unique, and, I hope, rewarding blend.

Enjoy this book. Use its information and the decades of research that have been used to compile it to keep yourself, your family, your coworkers, and your business more secure.

Paul Ekman, PhD Professor of psychology emeritus, UCSF President, Paul Ekman Group LLC (PEG) November 2013

Acknowledgments and Preface

As I planned this book, many people inspired me and helped me along the way. First and foremost is my family.

My wife, Areesa: You are the most patient person I know. The deeper I get into writing, the more reclusive I become. You have supported me, encouraged me, and made this life possible. Not many women can deal with being married to a professional social engineer. Answering phone calls using a different name and speaking with people who believe I am someone else. Having fake social media profiles online. Traveling the globe breaking into places and teaching others how to do the same. You are a remarkably patient, kind, and beautiful person. I am truly honored to have you as my wife. The first 20 years have been amazing. Let's make the next 20 even better! I love you.

My son, Colin: I've never met anyone who loves to read and learn like you do. If I mention a topic during family time, you later read about it and then can talk about it intelligently. When I took you through the five-day course, I didn't know what to expect, or if you would like it. It was great to watch you grow and expand your horizons. I believe that you will do amazing things in your life, and that your happy, easygoing personality will make you a real success. I love you, buddy.

My daughter, Amaya: You are the reason behind my smile. I look at you, and my world lights up. I love you so much. I remember when you were little, you would sit on my shoulders while I worked, sometimes for hours. Recently you passed the Ekman training with an 89 percent! You inspire me to be a better person. Your unconditional love and support are an inspiration. Your joy for life, your smile, and your amazing personality are some of the things I cherish most in my life. I love you with all my heart. You've made me a better person, father, and human being.

Many other people inspired and encouraged me. Brad “the Nurse” Smith, one of the most inspirational people I ever met.

Nick Furneaux: I feel like I have known you my whole life, like we were brothers separated at birth. Your encouragement during this process really helped me—not just with this book, but with my life. You and your family have been a gift to my family. You really are like a brother to me.

Ben and Selena Barnes: You know I love you. You are truly the face of this book, because your pictures grace the pages. Your patience while I made you contort your faces and bodies made this book even better. How great it has been to get to know you and have you as part of our family.

The last year and a half I have grown a great team with my company, Social-Engineer, Inc. Amanda: Even though I have known you since you were a tiny little nothing, and I fire you about 50 times a day, and I stress you out by doing things that drive OCD people crazy, and you have to hear “I'm Batman!” about 400 times a day, you are great. You really helped me focus, taking care of things when I had to go “off the grid” for a bit to write. Just please don't try to clean my office.

Michele: Who would have thought one conversation with Ping (love ya, Ping) would change our lives forever? Thanks to her recommendation, this year has been amazing. I can't thank you enough for helping me with research, kicking me into gear often, keeping me grounded, and just being a source of solid support as we grow. I hope this is the start of a long relationship as we build Social-Engineer into an even more amazing company. As you said to me in one of my most stressed times, “There's always hope.”

Robin Dreeke: One of my favorite “I's” in the world. Who would have thought that when we met a few years ago it would turn into all this? You are a lot of fun to train with, and you have become a close friend. Thank you for all the great conversations and letting me bounce my ideas off you.

My thank-yous would be incomplete if I didn't thank the InfoSec community, which contains some of the most open-minded and amazing people I have ever met. Your encouragement to keep going and expand my knowledge helped me consider writing a second book. Thank you for the great feedback, the love, and even the occasional criticism. Thanks for all the hugs, too (except you, Dave; you can keep the hugs).

The introduction explains in detail how I came to work with Dr. Paul Ekman and Paul Kelly. I just want to offer a wholehearted thank-you here. PK, when we met, I didn't know if you would like me. You are one of the original microexpression wizards. You worked with Ekman for years and have a long history of working with the federal government, solving crimes, and protecting people. I am just a human hacker, but you had such an open mind for discussing how our paths crossed and how we could work together. Thank you, PK. You have come to be a close friend and a great source of advice and encouragement. Thank you.

Dr. Ekman, I'm not sure why you made that return call to me a few years ago. I'm not sure why you spent those hours on the phone with me, and why you let me sit with you in your home, talking about the future of social engineering and nonverbal communications. I may never know why, but whatever the reasons, thank you, thank you, thank you! Your firm direction and the kindness you showed me impacted my life and my direction. Your research and life's work were why I could spend time using, learning about, and then writing about social engineering in my industry. Paul, you are a great man and a wonderful mentor. Thank you.

Each person listed here has affected my life and helped this book come into existence. Thank you for your help in making this happen.

I remember how I felt when I began writing my first book. I just wanted to share my experiences and what I had learned along the path of who I had become. More than two years later, I sat down with a much more defined vision of what I wanted to accomplish in my second book. I knew I didn't want a 300-page rant that was just my opinions. If I were to write another book, I wanted it to be something that would be based on science. But I started to wonder, “Who am I? Why would anyone want to read a book about science by a social engineer?”

Then I attended a conference with my good friend Brad Smith. As we discussed this topic, he smiled warmly, touched my arm, and said to me with confidence, “Chris, you weren't born with these skills. Your path, your struggles, what you did to become who you are—these are life lessons that anyone with interest in this field would cherish.”

A year later Brad passed away, but his words stuck with me. I began thinking about my journey of running a social engineering firm, having employees, teaching a five-day class and services all centered around my skills. I started to think about the skills that had the biggest effect on me, and nonverbal communication was the one that changed how I communicate.

I hope you enjoy reading this book. I hope you keep an open mind and try a few of the techniques described here to prove to yourself that they work. This book represents a new chapter in my life—another chance to pour out my soul and share some of the things I've learned along my journey.

I'm sure this book won't please everyone. I'm sure you will find some errors. But I hope I was successful at taking the comments, ideas, criticisms, and reviews from my first book and making this one much better.

Thank you for letting me into your mind for a while.

Christopher Hadnagy October 2013

Introduction

I have taught myself to notice what I see.

—Sherlock Holmes

When I decided to write another book, I needed to spend some time thinking about the topic I wanted to cover. My Social Engineering: The Art of Human Hacking (Wiley, 2011) was one of the first books to walk the reader through all the skills that comprise an expert social engineer. These skills are flat, though, because you practice them and master them—there are no advanced topics.

Social Engineering is a simple and basic book that outlines what social engineering is and what I feel it takes to develop and use social engineering skills in your daily life. In addition, as many of my readers have noticed, I had to adjust my understanding, thinking, and training to come more in line with proven scientific facts.

As I thought about what excited me about social engineering and what skills I found helped me the most, I started to reflect on the journey I had taken over the last few years.

I've always found the psychology and physiology of human interaction fascinating. Although I do not have a degree in either field, I believe understanding these aspects of communication can enhance your ability to understand, interpret, and utilize skills related to these aspects in everyday communications.

As I began my research, I headed to a bookstore and bought books on particular topics that piqued my interest. This is when I first saw the books Emotions Revealed and Unmasking the Face by Dr. Paul Ekman. I bought them and couldn't put them down. This was before Dr. Ekman had a website with interactive training courses. I was determined to locate and speak with him.

As I began to read Emotions Revealed I began to understand things that I had been subconsciously registering for years—things like when facial expressions didn't match verbal content and expressions for emotions that were trying to be hidden. The topic fascinated me, so I started to read all I could on body language and facial expressions. After reading these books and practicing as much as I could with their photographs, I found a website selling Dr. Ekman's Facial Action Coding System (FACS) course. The FACS course picks apart every muscle in the face and describes how it is triggered, what it controls, and what it looks like when used. I quickly bought that course and found out it was a treasure trove of information, but not for the faint of heart.

At this time, I was working on developing a course that would help security professionals learn the arts and sciences involved in social engineering. The course became a five-day foundational training program that would help teach enough of the skills to give the students a head start. At this point in my life, I decided to do something that would change my life forever.

I decided that it was time. I couldn't contain myself any longer; I had to speak to Dr. Ekman. It took me a while to find Dr. Ekman's email address and phone number, but eventually he and I talked on the phone.

To this day I cannot tell you why he spent so much time answering my questions and telling me about his research. I do know the time he gave me had a massive impact on my life, because Dr. Ekman and I developed a friendship. Over two years later I found myself sitting in his home, talking about the future of social engineering research involving the use of nonverbal communication.

After I launched my course, Dr. Ekman reviewed my materials and helped me perfect how I taught the section on nonverbal communication. He also helped me see how important this topic is when reading and dealing with other people. Not just the face, but also the whole body offers important cues for understanding what someone is truly saying during communication.

I'm telling you this story because it's what led me to write this book. My friendship with, and respect for, Dr. Ekman, my study of nonverbal communication, and my using those skills in my social engineering practice over the last few years helped me decide to call this book Unmasking the Social Engineer.

Each part of your body tells a story about your emotions. Each piece, when combined with the others, can help you understand what someone is feeling and saying when he or she communicates with you or is trying to hide from you.

Why should you care about this topic? Suppose that, while communicating with your spouse, kids, boss, coworkers, and others, you could decipher signs of discomfort. Suppose you could tell whether they were feeling happiness, sadness, anger, fear, or other emotions they didn't want you to see. Suppose that, when asking for a raise, you could see that your boss has some doubts. How would any of this affect your ability to adapt, adjust, and enhance your communication style? Now consider a social engineering engagement. When you are speaking to your target, what would it do for you to see that he is feeling anger, sadness, fear, or happiness? If you could look across the room at two people talking and see that one is feeling uncomfortable, could this fact assist you in your approach?

Being able not only to see but to decipher these signs will enhance your communication skills, and that is the primary reason to read this book. Secondarily, this book will enhance the skills of any social engineering professional to get the most out of their engagements with others.

We have all listened to a “gut feeling” when dealing with others. Sometimes you instantly like or dislike a person, for example. Sometimes gut feelings arise without any or very little actual communication. Have you ever wondered why this is the case?

A lot of what you base your gut feelings on involves how someone communicates nonverbally. Your brain picks up on these cues and then triggers an emotional response that creates a certain depth of feeling toward that person. Learning how to turn on this talent and use it to your benefit will give you power during any communication that you will quickly grow to enjoy.

From writing my first book, I learned that I can't please everyone. You might disagree with certain points in this book. That is fine and I encourage and look forward to open communication about these topics from you, the reader.

Feel free to reach out to me about these things. I am always open to constructive criticism. My website is www.social-engineer.com. There you will find ways to communicate with me.

Also, I do not claim that this book is based on new research that has never been released. As a matter of fact, this book is largely based on the research and work of some of the greatest minds of our time. The reason this book is different is because, until now, no book has compiled all this research for social engineers. No book has shown you how to use these skills as a social engineer. No book has been written by a social engineer and edited, proofed, and checked for scientific accuracy by two of the greatest men in this field—Dr. Paul Ekman and Paul Kelly.

One of the questions I get asked so often is how I developed my relationship with Dr. Ekman. Let me take a few moments to answer this question in this introduction.

The Scholar and the Student

One of my fears in initially trying to reach out to Dr. Ekman was that he was a world-renowned scientist and researcher, known for pioneering a whole area of study and research. Me…well, I am just a guy who really knows how to talk to people and enjoys “hacking things.” I began to ask why he would want to spend his valuable time with me.

I first reached out to Dr. Ekman through his assistant and his website to invite him on my monthly Social-Engineer podcast. Truly surprised, Dr. Ekman asked to spend some time with me on the phone. We spent two hours talking that first day about my practice, what I did for work, and how it applied to his field.

Dr. Ekman may have been up in years, but he got the concepts of social engineering right away and saw applications for them. At that time he accepted my invitation to come on the podcast. We had one of our most downloaded podcasts ever with Dr. Ekman.

After that he reviewed the chapter of my five-day course related to nonverbals, helped me perfect my teaching method, and allowed me to use his Micro Expression Training Tool (METT) software in the course to help hone the students' skills during the day.

A few months later I found myself sitting on the balcony of Dr. Ekman's apartment talking about social engineering and microexpressions. It was then that I told him I wanted to write a book that took his decades of research and applied it to a field in which it had never been applied before.

But I told him I would only do it with his blessing and support. I would not take on this task without his help, training, editing, and correction. I am serious about making sure what is said in this book is backed by science, accuracy, and years of proof. About a year later, Dr. Ekman agreed to work with me and suggested that his longtime associate, Paul Kelly (or PK) would be a part of this process.

PK and I developed a friendship through this process that helped me to learn from one of Dr. Ekman's senior instructors. Dr. Ekman and PK spent a considerable amount of time with me to ensure that I understood the concepts and to help me make sure this book was scientifically accurate. Some of this collaboration is illustrated in Figures I-1 through I-4.

Figure I-1: Dr. Ekman and me reviewing some of the pictures for the book

Figure I-2: Dr. Ekman giving me some advice for proper facial expression usage for the book

Figure I-3: Dr. Ekman allowing me to explain my concept for using certain Pictures

Figure I-4: Dr. Ekman helping me understand the deeper dimensions of some expressions

Figure I-5: Dr. Ekman working with Amaya to perfect her expressions

Despite all of this, one of the things that moved me even more is the time that Dr. Ekman gave my daughter, Amaya. My daughter took an interest in Dr. Ekman's work and took his online facial expression reading course, scoring an 89 percent. When she heard I was going to meet him in NYC, she begged me to let her come.

During that session, Amaya showed Dr. Ekman some of her work that was inspired by his daughter, Eve. She had made a collage of facial expressions imitating Eve from Emotions Revealed. Dr. Ekman took one look and said, “If you don't use this young lady in your book you are doing a disservice.”

In the spirit of Eve Ekman from so many years ago, my daughter, Amaya, makes her debut in Chapter 5 of this book showing us her skill in mimicking facial expressions.

In the end, what I can say is that I am proud to have Paul Ekman and Paul Kelly supporting me in this book, as I know what I am writing is accurate and proven. Even more so, they have become my mentors and friends.

Let's quickly review the topics covered in this book.

Chapter 1 takes an in-depth look at nonverbal communication and how it works from a scientific point of view.

Chapter 2 describes what social engineering is and how it is used. This chapter discusses how several recent real-life attacks used social engineering and what you can learn from these incidents.

Chapter 3 considers the science of the hands, a subset of body language, describing how you can decipher emotions displayed through the use of the hands.

Chapter 4 analyzes the emotions revealed by other key aspects of body language—the torso, legs, and feet. What does it mean when someone points his or her feet toward the door? Are signs of comfort or discomfort hidden in how someone stands or leans? Being able to pick up on these cues will enhance your ability to read anyone fast.

Chapter 5 is chock-full of research, data, and facts about the human face. The science of the face is vital. The face is key to your emotions and is one of your biggest communication tools. Learning to understand, decipher, and use the face can make you seem like a mind reader.

Many people think that the science behind microexpressions (very brief, involuntary, and cross-cultural/universal facial expressions) is invalid and that no one can be taught to read facial expressions quickly. Chapter 5 is proof of the advancements in this science, led by Dr. Ekman, and how it is scientific fact. The vast majority of students improve this skill after as few as two hours of training, some significantly.

One of the greatest myths is that you can tell if someone is lying within seconds. That is untrue, but you can tell if someone is comfortable. Displaying signs of discomfort can reveal much about the person's state of mind and how it can be influenced. Chapter 6 focuses on how to look for and understand signs of discomfort.

Chapter 7 takes a small step away from the outside of the body and focuses on the brain, specifically the amygdala. This little portion of the brain that controls the nonverbal responses to emotional triggers will be discussed here. Also, this chapter answers the question of whether you can have your amygdala hijacked, and if so, how and to what effect.

Next we need to start applying this knowledge to the social engineering field, specifically elicitation, the heart of social engineering. Chapter 8 discusses how nonverbal communication affects the elicitation process.

Chapter 9 concludes the book with practical application as a security professional and answers the question, “How can this information be used to audit, educate, enhance, test, and protect yourself, your family, and your company?”

In this book, I convey what I know and how I have used this knowledge in my life as a social engineer. I have studied, researched, and talked with the world's experts about these topics. I have worked with them and gleaned knowledge from them to perfect my craft. Many people who have devoted their lives to understanding one or a few aspects of human communication have contributed to this book in some way.

My work with Robin Dreeke, Director of the FBI's Behavioral Analysis Unit and an expert on behavioral communication, has taught me a lot. I have learned how to read people's communication styles fast, how to build rapport with anyone quickly, and how to adjust my own style to be more appealing to others. He has truly changed my life.

On my Social-Engineer podcast, I interviewed great minds such as Dr. Ellen Langer, a Harvard psychologist who wrote a book on her theory of mindlessness, in which people go through their daily routines without thinking. Understanding this research affects how we look for and read signs of comfort or discomfort in those we are communicating with.

Paul Kelly has been an invaluable resource. His years with the US Secret Service as well as working with Dr. Ekman as a “natural” in reading microexpressions lend themselves to this book in helping to ensure that all I said was accurate. In addition, his friendship, support, and encouragement have been nothing but inspiring over these many months.

One of the most amazing conversations I ever had was with behavior economist Dan Ariely. His work and research on predictable irrationality have enhanced how we understand framing others and ourselves for complete change.

Kevin Hogan, a renowned expert on the psychology of persuasion, spent some time with me explaining how persuasion works and how his research can help us understand the power of making people do what you want.

I can't complete this Introduction without again mentioning Dr. Paul Ekman. Not only has he become a friend and mentor, but his books, training materials, and scientific research have changed how we understand communication. Dr. Ekman has taken a leap of faith in me and trusted me to take the “torch” of his life's work into a field that desperately needs it.

Using This Book as a Social Engineer

Voltaire is credited as being the first to say, “With great power comes great responsibility.”

When I give my five-day training courses, I have been told that learning about social engineering is like being able to read minds. I don't teach people how to read minds. But you can learn how to communicate the way your target wants to be communicated with, read his or her subtle nonverbal cues, and display reinforcing nonverbals on your side. Doing so gives the person you are dealing with the feeling that communicating with you is in his or her best interest.

I hope you are reading this book with the intent of learning how to be a better communicator. Some studies like to attach numbers to how much of what we say is nonverbal. Dr. Ekman has taught me that we can't really put a true number next to it because so much depends on what type of communication it is. In one setting it may be 55 percent, and in another it may be 80 percent. One thing we do know is, a large portion of what we “say” is through nonverbal communication.

If you are a security professional in charge of protecting your company, educating your staff, or battling the cyber war, this book can help you. You can learn how to read and use this very important aspect of communication to enhance your message, understand what people are truly saying, and even enhance your ability to test your company's defenses.

I hope you enjoy this book and that you will feel free to reach out to me and discuss these topics. Now let's move on to Chapter 1 and discuss nonverbal communication

Part I

Building the Foundation

Chapter 1

What Is Nonverbal Communication?

Emotion always has its roots in the unconscious and manifests itself in the body.

—Irene Claremont de Castillejo

My first book, Social Engineering: The Art of Human Hacking, touched on the subject of communication modeling. I talked about how important it is to develop and understand the model around which you and others communicate.

Communication modeling is understanding the methods used to give and receive information. For instance, if you are communicating through email the sender (you) has to transmit emotion, intention, and message using only words, emoticons, and phrasing. The receiver (recipient) has to decipher this based on their state of mind and the way they interpret your email. In the communications cycle, feedback, in its varied forms, is critical.

If you are communicating in person, on the other hand, the sender has not only the words spoken but the body language, facial expressions, and more to relay the message. This means that a social engineer needs to model their communication style, method, and content based on the manner of communication as well as the receiver.

This chapter focuses on nonverbal communication. Nonverbal communication is a rich and complex topic, so this chapter first identifies what nonverbal communication is before breaking it down into smaller subsets.

To understand nonverbal communication, you must also understand what each one of our senses adds to the way we communicate. That is the crux of this chapter. I will touch on these topics and give an overview of what comprises the whole of nonverbal communications.

For instance, suppose you are giving a speech in front of a large group. As you look into the crowd, you see some people yawning, some using their mobile devices, and some leaning on their hands with their eyelids drooping. What do these actions mean? Without any words, you probably can conclude that you are losing your audience and that they are bored and uninterested.