| August Newsletter |
Volume 03 Issue 35
|
In this issue
Social-Engineer NewsThe first ever Black Hat Social Engineering Class went amazing. Watch for all the Vegas Details coming soon! Check out the schedule of upcoming training on Social-Engineer.om Social-Engineer.Com has launched their
Social Engineer Penetration Testers course. It is literally the
first of it's kind. As a subscriber to the newsletter you are
getting first dibs on knowing where and what is happening.
Nov 2012 Bristol UK - Some Seats Still Available We are limiting the number of attendees in each class to 22 and under, so first come first serve.
If you want to ensure your spot on the list register now - Classes are filling up fast and early! Do you like FREE Stuff? How about the first chapter of Chris Hadnagy's Best Selling Book: Social Engineering: The Art of Human Hacking?
If you do, you can register to get the
first chapter completely free just go over to http://www.social-engineer.com
to download now! UNSUBSCRIBE by sending an email to [email protected] Check out the awesome music of Dual Core - IT geek, Rapper and all around awesome guy... To contribute your ideas or writing send an email to [email protected]
- Want a very
cool website? Check out Social-Engineer.Org's graphic and web dev at
Tick Tock Computers.
|
Priming: For Better or
Worse
Last month, Chris
Hadnagy’s newsletter article explored how a person’s abilities
can be increased by merely adorning one’s self with a jacket
believed to be a jacket belonging to a doctor. This month, we will
take that idea a step further, deeper into the world of Priming. For
those of you unfamiliar with the topic of Priming, I recommend you
read my article, “A
Primer on Priming”,
to get an introduction to the topic. Priming is exposing your target
to specific stimulus in order to predictably influence their
behavior when exposed to future stimulus.
As you can see by Table 1, participants receiving the professor prime did significantly better than the secretary primed group and the control group. An unexpected result was also seen by this experiment. Those primed with the secretary prime completed the tasks faster than the professor or control prime. Not enough testing was put into this to give concrete explanations, but it’s hypothesized that secretaries are stereotypically known to be efficient at handling large amounts of tasks quickly. It is important to note that the priming task and the quiz task were believed by the participants to be completely unrelated, as proven by exit surveys conducted by the professors. The participants did not believe the two tasks were related and, even when told the priming exercise could influence their scores on the Trivial Pursuit questions, rejected even the possibility. Even though these targets did not know they were being primed, our previous research shows that even if you are aware of the prime, it works. Experiment two was designed to test whether the duration of a prime would affect the performance during the testing. The prime was applied here in experiment two in the exact same way it was applied in experiment one except for the duration in which the prime was applied. In this experiment, group A spent 2 minutes writing down traits related to professors, group B spent 9 minutes, and group C received no prime and went immediately into the question portion of the experiment. In this experiment, the testing questions were increased from 42 to 60. Table 2 - Professor prime (duration)
Table 2 echos the results of experiment one and also shows performance increased as the length of the prime is increased. The longer your target is exposed to the prime, the more in-line, stereotypically, the target becomes with the prime. Experiments one and two show that your target can be influenced to the positive, but is it possible to influence people to do negative things or to perform negatively? In general, people do not desire to perform poorly or act negatively. Can we unwillingly influence the target to go against nature and to act in a negative way? Experiment three was designed to answer this question. In experiment three, three groups were formed and primed using duration as in experiment two, only this time instead of being primed with professor to achieve positive testing results, the groups were primed with the term soccer hooligan, stereotypically associated with stupidity. Can we actually cause negative performance? Can we actually cause an individual to subconsciously go against the grain of nature and perform poorly? As you may have guessed, the answer is, YES! Table 3 - Soccer Hooligan prime (duration)
Table 3 shows that participants primed with a negative stereotype pertaining to intelligence and lack of patience not only did worse than the no prime control group, the degradation of performance was increased with increased exposure to the prime! We’ve seen how priming stereotypes can make the target behave in line with the perceived traits of those stereotypes. Is it possible to skip the stereotype all together and prime with the desired trait? Experiment four took four groups. Group A was primed with professor, group B with intelligent, group C with soccer hooligan, and group D with stupid. As in the experiments above, the groups primed with intelligent or stupid were given paper and asked to think about the concepts of intelligence or stupidity. They were then asked to list synonyms and behaviors characteristic of their assigned trait. As expected, those primed with professor or intelligence did better than those primed with soccer hooligan or stupid. Table 4 - Stereotype vs. Trait
Making Sense of the Experiments The results of the experiments are incredible. We know that by priming our targets we can influence them in positive or negative ways, but how is this possible? Did the groups primed with professor or intelligence magically become smarter? Obviously the answer to that question is no. So what’s going on here? There are three points of discussion here. Perhaps pr iming with the professor stereotype subconsciously makes the participants concentrate on the task and to think harder. Perhaps the prime encourages the targets to simply think smarter when it comes to problem solving. It is also hypothesized that, perhaps, the prime enhances the participants confidence in answering the questions and not to second guess themselves. Further investigation into the “why” is definitely needed. Caveats Further research was performed by Ap Dijksterhuis and Ad Knippenberg that showed when you prime someone with an extreme direct term, such as Hitler or Einstein, the opposite effect happens. The reason for this is priming with specifics such as Einstein invokes comparison. When you prime with professor, you’re leaving your brain to fill in the blanks. You are interpreting the word professor to mean smart, etc. When you prime with extreme specifics, such as Einstein, your brain says, “well, I’m no where near an Einstein” and you end up performing worse. This only works if your contrasts are exemplars such as Hitler or Einstein. Implications for the Social Engineer As a fellow social engineer or fan of social psychology, I’m sure the wheels are already spinning. As Bargh, Chen, and Burrows (1996) noted, “the perception- behavior link may be of crucial importance to our understanding of a large number of social psychological phenomena: Compliance and conformity, emotional and behavioral contagion, empathic reactions, imitating and modeling, mass media effects on behavior, and behavioral confirmation of stereotypes are expected to be at least partly under the influence of the perception-behavior link.” In your study of social engineering, one of the topics that should have caught your eye is pretexting. The study of priming can increase your success in a pretext. In the research above, the “targets” were able to adjust the mental faculties just by thinking about words and ideas that coincide with a specific stereotype or trait. As a social engineer, once you chose your pretext the use of priming can increase your chances of success. Let’s say your pretext revolves around playing the role of a janitor. The cultural stereotype of a janitor is that of a layman. Obviously this is not true of all janitors, but remember, we’re dealing with perception here. Right before your engagement, prime yourself by taking a piece of paper and writing down everything that comes to mind when thinking about a janitor relating to behavior, lifestyle, and appearance. Then allow that list to flow into your pretext, altering not just the physical appearance, but the actions you will have while in your pretext. Pri ming is another tool in the arsenal of the professional social engineer and one that can make you a master at pretexting.
written by: Eric "Urbal"
Maxwell
As part of the newsletter group, you will be the first to receive special offers to services and products by Social-Engineer.Com.
Gold Sponsor for The Social Engineer CTF at Defcon 20:
Sponsoring our Kids SE CTF at Defcon 20:
Also check out our website
sponsor: |
