Christopher Hadnagy - Unmasking the social engineer: the human element of security

Emotion always has its roots in the unconscious and manifests itself in the body.

Irene Claremont de Castillejo

My first book, Social Engineering: The Art of Human Hacking, touched on the subject of communication modeling. I talked about how important it is to develop and understand the model around which you and others communicate.

Communication modeling is understanding the methods used to give and receive information. For instance, if you are communicating through email the sender (you) has to transmit emotion, intention, and message using only words, emoticons, and phrasing. The receiver (recipient) has to decipher this based on their state of mind and the way they interpret your email. In the communications cycle, feedback, in its varied forms, is critical.

If you are communicating in person, on the other hand, the sender has not only the words spoken but the body language, facial expressions, and more to relay the message. This means that a social engineer needs to model their communication style, method, and content based on the manner of communication as well as the receiver.

This chapter focuses on nonverbal communication. Nonverbal communication is a rich and complex topic, so this chapter first identifies what nonverbal communication is before breaking it down into smaller subsets.

To understand nonverbal communication, you must also understand what each one of our senses adds to the way we communicate. That is the crux of this chapter. I will touch on these topics and give an overview of what comprises the whole of nonverbal communications.

For instance, suppose you are giving a speech in front of a large group. As you look into the crowd, you see some people yawning, some using their mobile devices, and some leaning on their hands with their eyelids drooping. What do these actions mean? Without any words, you probably can conclude that you are losing your audience and that they are bored and uninterested.

Why? One simple reason: nonverbal communication. Many studies attach a percentage to how much of what we communicate is nonverbal. Some say that more than 50 percent of communication is nonverbal. In my work with Dr. Ekman, I have learned that it is hard to attach a real percentage to this phenomenon because it changes according to the type of communication, its purpose, toward whom it is directed, and many other factors. However, everyone agrees that the percentage would be high if a percentage could be attached to it.

Think back to the last time you received a text message or email that you interpreted as being harsh or sarcastic, but later you found out that was not the sender's (transmitter's) intent. Why does this happen? When you are reading a message without the transmitter present, you interject your feelings and present emotional state into the message.

I remember one hectic day when my brain was going in 50 directions and I was stressed out. Someone sent me a message that said something like I tried calling you a few times. If you decide to actually work today, give me a call. I was seeing red. How dare he accuse me of being lazy! Doesn't he know how much I've done today? I've probably accomplished more today than he has in the last three weeks! I'll give him a piece of my mind!

I wrote a long email, chewing him out. But as I reread it, I began to hear in my head how angry I sounded. I thought about who had sent the email and how we always joked around. I was stressed and under pressure and had put my emotional state on the sender of the email. Emails lack voice tone, facial expressions, and body language to help us get the message the sender is trying to send.

If I had been sitting in front of that person, I would have seen his smile and jovial nature. These would have quickly quelled any misimpression that he had negative thoughts about my work ethic or time-management skills.

Nonverbals are such an important part of how we communicate that some people have devoted their life's work to understanding them. This book delves into the research from these people, such as Dr. Ekman, analyzing the research to understand how it applies to social engineers.

Dr. Joseph J. Campos, head of the University of California Berkeley's Institute of Human Development, along with Drs. Anderson, Witherington, Uchiyama, and Barbu-Roth, performed a visual cliff experiment to demonstrate the importance of nonverbal communication. An infant who was old enough to crawl but not old enough to speak was placed at the end of a table with a Plexiglas top and a checkerboard pattern underneath. It looked to the baby as though, halfway across, the tabletop dropped off steeply, like a tall step down, but this was an optical illusion.

At the far end, past the dangerous cliff, was a toy. Over the edge of the table, near the toy, the baby could see the face of his or her mother. The mother was instructed to use no words, only facial expressions, to encourage her baby to come to her. When the baby arrived at the cliff, the mother was to show a macroexpressiona very long facial expressionof either happiness or fear. If the mother was happy, she displayed a smile that produced wrinkles on the outer sides of each eye (what Dr. Ekman describes as a sincere smile) and told the baby everything was okay, as shown in .

How would the baby feel at seeing this expression on his mother?

How would the baby feel at seeing this expression on his mother?

When the mother showed signs of happiness, the baby was more likely not to notice the visual cliff and to crawl straight across to his or her mother. If the mother showed signs of fear, the baby displayed caution. One baby even shook his head when thinking about crossing the cliff.

This and similar experiments prove how important it is to understand the depth, seriousness, and impact that nonverbal communication has on the people we communicate with. Taking this a step further, we see how important it is to understand how professional social engineers can use nonverbals. Using this experiment as an example, if a social engineer's face shows fear when approaching a target, it will create feelings of fear in the target and cause them to wonder what is going on. If, on the other hand, the social engineer shows happiness, it is easier to develop rapport and achieve the desired goal.

So far I have classified all nonverbal communication into one large group, but this type of communication has many aspects.

Nonverbal communication can be broken into different aspects. Numerous researchers have spent thousands of hours dividing it into many categories. This section discusses some of the aspects I feel can really help you understand nonverbal communication.

In particular, this section discusses seven aspects of nonverbal communication: kinesics, proxemics, touch, eye contact, olfactics, adornment, and facial expressions. The following sections briefly describe each.

Kinesics is defined as a systematic study of the relationship between nonlinguistic body motions (as blushes, shrugs, or eye movement) and communication.