woensdag 12 september 2007

Social engineering technique: listen!

One of the social engineering techniques I use is intimidation. While it isn't always a pretty sight, it will often get the job done. The problem I had in the beginning was, it didn't work for everyone. Some people would get very compliant, while others would just get stubborn and refuse to cooperate.

It was only after I actually started to listen to what people actually said, that I was getting consistent results. For instance, when I asked a secretary some questions about her boss, she answered them. She also told me he was a nice guy, and she loved workin for him. I noticed then that, as soon as I started using intimidation (using the future policeman con), she clammed up, and refused to answer any more questions.

On the other hand, when I talked to a system operator at a government organisation, he would not answer me, and kept on referring to "the rules". At that point I told him that I was investigating a fraud case, and that I found it remarkable how he did not cooperate. After that point, he became an avalanche of information, and I eventually had to hang up to stop him blabbering.

The big "secret" I found out eventually? If you pay attention to what people say, and how they say it, you'll know how to deal with them.

Here's how:

- if someone is talking towards something (a person, a case), then he/she is often loyal to that case, and intimidation won't work. Flattery or sympathy will work better here.Examples of people talking towards something:
"Oh mr. Renaldo, yes, I know him, I worked with him on my last project!"
"Yes, I work on the new marketing project. It's very exciting!"

- if someone is talking away from something, then he/she isn't loyal, and often has issues with that person/organisation. At the very least, they're desinterested. In this case, intimidation can give them that little push so they'll start to cooperate and give you the information you want:
"Renaldo? Oh him.. Yeah he works around here, but I don't know him that well."
"Yes I work in marketing. Is this going to take long? I have a lot to do today."

By just listening how people say certain things, I am now able to use intimidation only when it is effective. The other times, I'll use something else, like sympathy or a desire to help. That way, I can make someone's day better and get the information I want at the same time!

Geen opmerkingen: