The Art of Deception: Controlling the Human Element of Security

Chapter 8. Using Sympathy, Guilt, and Intimidation

as discussed in Chapter 15, a social engineer uses the psychology of influence to lead his target to comply with his request. Skilled social engineers are very adept at developing a ruse that stimulates emotions, such as fear, excitement, or guilt. They do this by using psychological triggers—automatic mechanisms that lead people to respond to requests without in-depth analysis of all the available information.

We all want to avoid difficult situations for ourselves and others. Based on this positive impulse, the attacker can play on a person's sympathy, make his victim feel guilty, or use intimidation as a weapon.

Here are some graduate-school lessons in popular tactics that play on the emotions.

A VISIT TO THE STUDIO

Have you ever noticed how some people can walk up to the guard at the door of, say, a hotel ballroom where some meeting, private party, or book-launching function is under way, and just walk past that person without being asked for his ticket or pass?

In much the same way, a social engineer can talk his way into places that you would not have thought possible—as the following story about the movie industry makes clear.

The Phone Call

"Ron Hillyard's office, this is Dorothy."

"Dorothy, hi. My name is Kyle Bellamy. I've just come on board to work in Animation Development on Brian Glassman's staff. You folks sure do things different over here."

"I guess. I never worked on any other movie lot so I don't really know. What can I ...