Social Engineering Tactics

A social engineer uses psychological tactics to manipulate a target into taking a desired action. The social engineering lesson in the first unit met two of them, intimidation and urgency. This lesson names seven, those two among them.

The table below holds four messages that one adversary sent over two days to the reservations clerk at a state park campground. The desired action is a single step: sending the season's camper list to audit-review@example.com, an address outside the park system.

The first email opens on a fee audit by the State Comptroller's office. That sentence applies no pressure. It explains why an office outside the park would write to the clerk and want the camper list.

The reason fits the clerk's job. The reservations office takes a fee for every campsite booked, and the camper list records who booked which site. So an audit that starts from the list reads to this clerk as routine work.

The director of state parks runs the whole system, so the director has power over the clerk. The first email's second sentence speaks for the director, and the Wednesday text is signed as the director. The email relays an instruction, and the text impersonates the person who would give it.

Refusing the audit now means refusing the head of the clerk's own park system.

The second email names a different person, the ranger the clerk trained with this spring. The ranger has no power over the clerk, so this is a separate tactic. The email only claims to know the ranger, though the adversary could just as easily have posed as one, and either would be familiarity.

The second email opens with ten of the fourteen parks having sent their lists. Sending now looks like what the whole system does, and holding back makes this park one of four still out.

The Wednesday text adds a limit: the audit team will take emailed lists from only two more parks, and the rest get an audit on site. Two places for four remaining parks turn the request into a competition the clerk can lose by waiting.

The last email's first sentence states a consequence: a park with no list on file loses its listing on the state reservation site. Its second sentence adds a deadline, Friday, before the holiday weekend. The email arrives Wednesday afternoon, so the clerk has two days to send the list or lose the listing.

The tactics reach the clerk together, and each answers a reason the clerk might stop. The pretext explains why an outside office wants the list. Authority and familiarity vouch for the sender, and consensus says the other parks have complied. Scarcity and urgency leave no time to check, and intimidation puts a price on refusing.

All of them rest on the pretext. The parks sent their lists to the audit, the director wants this park in the audit, and the deadline belongs to the audit team.