Social engineering. When you’re the mark…

2019-07-23T10:06:43
ID PENTESTPARTNERS:3E4078507C6C0E3FCD26A437B4D2A359
Type pentestpartners
Reporter Scott Thackery
Modified 2019-07-23T10:06:43

Description

Who am I? I am Scott, and you may have met me, if you did your recollection of me will be unique most likely. I am a social chameleon. I can be your best mate, the lost friend you never knew you lost and even an expert in things you are interested in. I live off your stories and I weave my way into your life in such a way that you don’t mind as I pick your brain.

If I was in poorer company you’d call me a con artist, but I bleached my hat white a long time ago and I play for the good guys. That doesn’t mean I don’t have to practice from time to time and I have a series of tools in my bag that have been honed over the years. The names may not be the “scientific versions” but I just call them adaptability and survival modes. Here are a few, and examples of how they work:

1. The shaggy dog story

Let me tell you a story, it’s long and involves lots of personal details, I’m really open about all sorts and I rapidly go from someone you don’t know to someone you really know almost too much about. It begins with me, and I spin this tale in many directions, the twists and turns of this plot seem both right, but oddly random on remembrance. Didn’t we start talking about swimming with dolphins? And now we are onto where we were born. “and where were you born?”, “who do you work for? Doing what?”

…and from those meagre beginnings you can adapt and eventually get to more dangerous paths. “our company has a ridiculous policy for passwords! Is yours anything like that?” and often the dog comes up for a friendly pat on the head and drops the stick of information you were after all along. Sometimes you gotta take the dog on a long walk, sometimes they drop what you need 5 minutes in. Each dog has it’s day.

2. Brothers in arms

I will be your brother, I will fight by your side, I will hate who you hate and dislike who you dislike. I will agree with you and be on your side. I will create a metaphorical foxhole for us to climb into and we will fight against the “others”. In doing so I will share with you my deepest secrets, and in turn I will ask you for yours. We are in this war together after all. “My password is “SillySausage123” and this has kept me safe from the “others” and the “them”, what clever password do you use?… you can tell me, we’re brothers in arms after all.”.

3. The ego stroke

You are the most interesting person I have EVER met, how on earth does no one not recognise your sheer brilliance. I do… and I feed it. Your ego will burst at the seams and I will make you boast about your triumphs. I will ask for details, seemingly uninteresting ones, to those not in awe of your presence, but I wish you know more about how such a person could think up such wonderful ideas.

Tell me more about that project you are working on, what developments will you leave the world? What greatness can we expect? And what does the great unwashed not know that only you could enlighten them with? What secrets of the world do you hold that no one else knows… I am your follower and I wish to be bathed in your light of knowledge. Then I will walk away and you will never see or hear from me again.

4. If only a stranger would help me

I’m lost. I’m new. I’ve not been here before. I am seemingly alone in the world and could use a friend like you. Maybe you can help me? Is this the way into the office? Is this desk free? Is this the admin portal I need to access the system I am supposed to be working on? I tilt my head gently to one side and look like the world may fall apart if someone doesn’t reach out and lend me a hand… maybe it’s you? Could you just log me into the wireless if I hand you my phone? That way I don’t need to know the password… please help? Is that a pass on your desk? Maybe while I’m asking for help I’ll just slip that into my pocket and and keep you looking up something for me. I’ll find my own way now… thanks so much for your help.

5. The snake oil salesman

Roll up, roll up I am an expert in the topic you obviously don’t know a lot about! I am knowledgeable and full of truisms, I am happy to share and teach. I will make you feel intelligent and stupid at the same time, If you don’t know about this topic…. maybe I can help you? That’s the smart choice! Confused? Good. Try not to keep up, it helps the whole process and when I ask for your input I will use this confusion to force topics and questions on you that seemingly have no relevance… but you are keen to be seen as an equal.

6. Your shadow

Am I following you? Maybe. I’m not being obvious about it. I’m just coming from the same direction and happen to be headed in your direction. Are those the doors to a building we are both headed towards? Is that two sets of doors? One open and one with a swipe card? Well let me move forward and take the lead… let me open that door for you! I wasn’t following you… you were following me! And now as you pass through the door I step in line behind you, waiting for you to return my act of kindness and hold the door open for me. Why thank you! You are so kind. I always smile at those who help me out. Maybe we will meet again inside at another set of doors and I will smile again.

7. The runner

I’m late, I’m busy, I’m important, and you aren’t. I’m obviously here officially and I don’t look overly happy. Maybe you are in a position to make people like me happy? Well ARE YOU? Let’s not dawdle here, give me what I need and let’s move on… we’re all busy people and have jobs to get on with, now do yours and let me get on with mine. Yes I will need a pass, and yes it will need to access all floors, do I look like a person who has boundaries? You are compliant, how lovely, thank you so much and I shall speak to your line managers about how helpful you’ve been.

8. The juggler

I have 4 coffees, a laptop bag, some lunch and phone under my chin as I dance into your life. I can barely hold it all, I’m telling the people who are obviously on the other end of the phone that their coffees are coming… soon! Oh no! A barrier! I’m a good Samaritan and I can’t drop all this to get out that small insignificant piece of plastic to get through those gates… maybe.. you could just open them and do us BOTH a favour? Yes? You are so kind, and I promise I won’t drop any of it as I precariously make my way through those security gates.

9. The old man

I’m broken, I’m borderline disabled. I limp and every single step looks like the pain will overwhelm me. My bladder isn’t what it used to be, I really need the toilet… I might actually soil myself in your reception. Oh, you can’t let me through… let me wince with pain and declare I may be forced to relieve myself right here.

I’m old, in your eyes, and really need to use the facilities. Can I just have a pass to get in and out like a normal human being? I’m not an animal to be trapped in this space you know. Do you treat your parents like this?!? Your mother would be proud of you for helping this old person in their time of need. A pass will do nicely and I promise to bring it back. The young aren’t all bad.

10. I’m here to help

I’m a team player. I love to give a hand. Are you struggling with that? Here, let me help… now you can open the doors, while I carry this for you! Let’s take it straight to your desk! I’ll find my way once we get all this settled for you. I see others in need of assistance. I’m off to save the day once more! Here, let me help you with that technical problem you are having, I’m an expert, let me just crawl under the desk for you, that way YOU don’t have to. Let me just adjust a few things.. and plug in a few things, there… it should all be working now. Anyone else need help?

Conclusion

These are just a few examples, and they all work. I know. I’ve used them all to varying degrees of effectiveness over the years and they still work now. If you can grasp the essence of what I’m saying in these vectors, then you will make a great Social Engineer. Or you’ll get caught. Either way, Smile, it’s your ticket to success no matter which way the tree falls.