Unmasking the Social Engineer: The Human Element of Security (2014)

Part II. Decoding the Language of the Body

Chapter 6. Understanding Nonverbal Displays of Comfort and Discomfort

Comfort zones are most often expanded through discomfort.

—Peter McWilliams

Whenever I teach a class about social engineering, I cover body language and facial expressions, in a similar manner to the previous chapters of this book. Some students are overwhelmed by all the things they are told to look for and feel that trying to notice too many things will distract them. Instead of trying to come up with tricks to help them notice all the expressions or signs, I tell them to do one thing: Look for signs of comfort and discomfort. Noticing that someone has a certain baseline body language that changes to discomfort can tell you a lot as a social engineer. PK, one of the “truth wizards” mentioned earlier, notes that Dr. Ekman refers to such changes in baseline as “hot spots.” Dr. O'Sullivan, who coordinated research on the “wizard project,” noted that the wizards often cited recognition of such displays while observing their subjects as a factor in their assessments.

Imagine that your target is Ben. Your goal is to start a conversation that will lead to elicitation. As you approach him, you see him sitting with his hands behind his head and a contented look on his face, as shown in Figure 6-1.

Figure 6-1 Ben is content and feeling comfortable and confident.

As you start speaking to him, your conversation starts to move toward a few questions about his company, and then he displays what is shown in Figure 6-2.

Figure 6-2 What has changed with Ben?

As Ben contemplates his decision, he starts feeling uncomfortable. His neck muscles tense, and he begins wondering if he is making the right decision by continuing the conversation and answering your questions. He goes from a confident pose to one of high discomfort.

For the social engineer, this is a huge tell. You can clearly see the emotion Ben is feeling and how it affects him. At this point, a smart social engineer will quickly determine if he can push harder or back off, depending on the goals of the engagement.

This short chapter is about noticing these subtle or not-so-subtle signs of comfort and discomfort and how a social engineer can use them. The following sections break this topic into a few areas you can watch for.

Neck and Face Pacifying

In addition to the neck-rubbing behavior just discussed, the social engineer can notice other signs that can be strong indicators of discomfort. The key is to watch for a change in behavior that indicates that something is making the target uncomfortable.

Similar to when a man rubs the back of his neck, when a woman feels scared, threatened, or worried, she often covers the area of her neck called the suprasternal notch, as shown in Figure 6-3.

Figure 6-3 This neck-pacifying move shows discomfort.

I have spoken with people who have reviewed security videotapes after a child has gone missing in a store. They have noticed that the first thing the mother does is the gesture shown in Figure 6-3.

Another thing that a social engineer may see is a baseline of comfort transition into face rubbing, as shown in Figure 6-4.

Figure 6-4 Rubbing the face like this is pacifying.

These moves, when noticed, can tell the social engineer that the person is feeling threatened, unsafe, or uncomfortable with the decision or situation at hand. Dr. Ekman and other psychologists might classify such nonverbal movements as “manipulators.”

When you're trying to make hard choices, it can be comforting to rub or touch two nerves that run through the neck and upper chest—the vagus nerves and the carotid sinus.

What to Watch For

As a social engineer, watch for changes in these behaviors. It is important to notice if someone is comfortable when you first approach him but then starts rubbing his face or neck. If you see this happen, quickly determine whether something about you or something you said caused this behavior.

I was talking to a law enforcement agent once about face and neck rubbing. He told me about a time when he went to a home to inquire about the whereabouts of a relative of the residents, who was fleeing from the law. Every time my friend brought up the person's name and a certain location on their property—the garage—he noticed that the mom would move her hand to her neck, as seen in Figure 6-3. After seeing this happen a couple of times, he decided to pose the question twice more. He then asked if police could search the premises since she had nothing to hide. After she said yes, he went straight to the garage and found the person he was looking for hiding there.

Watch for these changes in behavior to give you “tells” about someone's emotional content. Once you understand that something is causing a change, if the change is desirable, decide whether to throw in some elicitation questions that will confirm your suspicion.

In one engagement in which I had a chance to use these skills, I was tasked to get past third-party security guards into a large warehouse. The rule was that the security guard had to have the photocopy of any visitor's government-issued photo ID (driver's license or passport, for instance) before the visitor was allowed in.

Getting through the mantrap and to the security desk was not difficult, but then at the front desk the security guard said, “Before I issue you a badge please give me your driver's license for a photocopy.”

I generally leave my wallet in the car when doing engagements, so I first used a discomfort sign: I raised my hand and rubbed the back of my neck, and while looking back at the very large metal mantrap I said, “Oh man, I'm sorry, I left it in the car in my wallet.” I noticed a stern look on the security guard's face, and before he could speak his command to tell me to take the walk of shame, I said, “Wait, all you need is an official picture ID identifying me as the person I say I am?”

“Um, yeah, basically.”

“Then will a company ID do?” I said, before continuing,

“Oh excellent, then I am OK.” Then, relaxing my face and body, I pulled out my fake corporate ID: “This ID has my picture and the barcode here contains all my personal details. You can just photocopy this.”

Moments later I was being handed a visitor's badge and escorted into the facility.

Another thing to remember as a social engineer is that these gestures give off the feeling that a person is uncomfortable. You can use this feeling to influence someone's emotional content. For example, if you are trying to pretext as someone who has shown up at a company late for and nervous about a job interview, displaying this action can add credibility to your pretext.

Mouth Covers

While reading a newspaper or magazine story about some disaster, it is not uncommon to see people at the scene displaying what is seen in Figure 6-5.

Figure 6-5 Mouth open and covered in shock or surprise

As mentioned in Chapter 5, when we are scared or surprised, we gasp to prepare for the “fight or flight” response. It is believed that we cover our mouths as an automated response to self-comfort, much as we self-comfort using face and neck touching. The shock, surprise, or fear is followed by a feeling of discomfort, which is followed by self-comforting actions.

If you see a calm baseline change to the type of action shown in Figure 6-5, reevaluate your approach and make sure you are not the one who is causing the shock.

What to Watch For

If you observe someone covering his or her mouth, try to figure out what could be causing this action. Remember the importance of the “why” question that Dr. Ekman stressed. Is the display followed by anger, sadness, or fear? These emotions should alter how you proceed. You can use them to become a member of a tribe if the reaction is to a public event.

Imagine being at the scene of a crime or witnessing some horrible event. While everyone else is mouth covering, gasping, and looking away, you see one person in the crowd with a big smile on his face. What would you think? He has not fit into the tribe; he stands out, and not in a good way. Similarly, as a social engineer, notice the crowd you are approaching and if they are shocked or surprised by an event; an easy way to start fitting into the tribe is to take on the emotional content of the crowd around you.

For example, on 9/11 I was standing near a group of strangers when the news showed the second plane hitting the second tower. The shock and horror that caused many gasps were followed by all of us becoming one tribe very fast. We bonded over the emotions from that event and our reactions.

As disturbing as it is to discuss looking for—or, even worse, creating—a situation in which you use a major event as a tool to join a tribe, unfortunately malicious attackers use this tactic all the time.

I do not recommend that a social engineer use this display without a good reason to. The person you are interacting with will be confused or even angry if he feels he was made to feel shock or fear for no reason.

Lips

The lips are a huge source of information on comfort versus discomfort. This is not just because they form words, but, maybe even more importantly, because of what they do when words are not being used.

Sometimes the lips tell us that the person wants to say something but is holding back. The lips also can tell us that someone is nervous or lacking in confidence. Learning to pick up on these subtle signs can give you that extra edge as a social engineer.

Suppose you're at work, and you're dealing with a manager you dislike. You say something a bit harsh to her, and she gives you a look like the one shown in Figure 6-6.

Figure 6-6 Pursed lips are tight like in anger.

As she looks at you, her lips are pursed, as shown in Figure 6-6. Tight lips are a sign of anger, even when that anger is suppressed. In essence, pursed lips hold the mouth shut to keep you from forming the words you may desperately want to say. Pursed lips can also indicate that the person is deciding whether to take some action—deciding between possible actions or reactions.

Another sign to watch for is the puckered lip. Similar to a pursed lip, it can indicate that words are being held back, but there is no anger. Instead, this display indicates uncertainty. Suppose you ask someone a question she is unsure how to answer. Would you see a response similar to Figure 6-7?

Figure 6-7 Showing some signs of uncertainty

Selena looks a little indecisive in this image. She was asked a question and is deciding how to answer.

In Figure 6-8, Ben shows a little more discomfort. Not only is he unsure whether he wants to answer, but he also is showing some signs of frustration with the questions being asked. His eyebrows coming down and together can reflect cognitive load (thinking)—and possibly anger. Look for signs of lip puckering after a difficult question is asked to see if the person you are talking to is showing signs of discomfort.

Figure 6-8 Discomfort and uncertainty

Although by itself none of these is a clear sign of deceit, if a social engineer sees these signs, he or she can target that area of information to see if deception is in play.

One last lip display I will discuss is one of high discomfort. Lip biting indicates anxiety, as shown in Figure 6-9.

Figure 6-9 Lip biting and signs of anxiety

As shown in Figure 6-9, you can see anxiety not only in Selena's lip display, but also in her eyes. The wideness of her eyes is similar to what you might see in fear or surprise, indicating she may be feeling anxious. Some people have a habit of doing this, so notice when it starts and stops, because it can indicate a baseline; then look for changes. Generally this display occurs when someone feels anxious.

Sometimes the lips are not the only things that get bitten when someone feels anxious. You may also see displays similar to Figures 6-10 and 6-11.

Figure 6-10 Finger biting is another sign of anxiety or nervousness.

Figure 6-11 Object biting or chewing can indicate nervousness or contemplation.

Figures 6-10 and 6-11 both show a display that can indicate contemplation, anxiety, or thought (cognitive load).

What to Watch For

In all these lip displays, a social engineer would be smart to look for changes. Notice when a person starts these displays, and remember the conversation or questions that occurred at the time. Similarly, a person licking his/her lips, along with all the other lip displays, can fall into the category of nonverbal manipulators. An increase in displaying manipulators is a departure from a baseline—and can be a hot spot for you to note.

These can all be indicators of stress, anxiety, or holding back—all good signs that discomfort is setting in or has set in.

As a social engineer, you should notice if your communication is causing this reaction and then adjust your behavior. Similar to other areas mentioned in prior sections, you can use your own lip displays, subtly, to influence someone's emotions.

For example, when you ask someone for a favor, a little lip bite or pucker can show that it is difficult for you to ask, eliciting sympathy from the person. Or suppose you're telling a story, and you get to the details of how you might lose your job if this task doesn't get done. Displaying some lip pursing can add weight to your story, showing how difficult it is for you to say what you have to say.

Whether you are watching for these signs or using them, learning to recognize their meanings can make a huge difference in your success as a social engineer.

Eye Blocking

Often when someone is extremely sad, she squeezes her eyes shut or even covers them, as shown in Figure 6-12. Why? A physiological response causes us to block or cover the object making us sad. This same display can be seen when someone is not extremely sad but is trying to block an object that irritates, saddens, or angers her.

Figure 6-12 Eye blocking is a classic sign of sadness.

If you see the person you are engaged with displaying this sign, it is a good idea to analyze the topic of conversation—the “why” question—and see if it is a basis for this emotion.

When I was young, a popular kind of insult began with “Your mom” or “Your mama.” It seemed to fit any situation, and it generally brought smiles and laughter. One time I was with a close friend, and we were trading insults when I threw in a “Your mom.” I was met with something similar to the image shown in Figure 6-12 and then some tears. I had forgotten that, only a couple weeks before, my friend's mom had died. My insensitive and callous remark caused her to think about her painful loss, and she tried to block out the object of that pain: me.

What to Watch For

If you see an eye-blocking display, and it was not caused by something you said, the best question to ask is, “Is everything okay?” There's no quicker way to build rapport with another person than to notice that she is in pain and to show concern.

As terrible as it sounds, this display can also be used to elicit sympathy from people. Showing this display subtly and at the right time can create a feeling of sorrow for you and cause someone to approach you and ask if you are all right. Con men and social engineers have used sympathy and assistance themes for years.

Self-Comforting and Head Tilts

I always find this portion interesting. In the 1980s, so-called “sales gurus” used to teach that if someone crossed his arms, this meant that he was uninterested and closed off. Research has helped us see that this is a wrong conclusion. Some people stand like that simply because it is comfortable, others because they are cold, and still others because of habit.

But a social engineer can look for something that can help determine a person's change in emotion from a baseline. Mainly women assume a stance that is considered self-comforting. They fold their arms across their bodies, under their breasts, as shown in Figure 6-13.

Figure 6-13 Self comforting and a sign that something may have changed

The key is to notice if the display starts at a particular point. Suppose you approach a group and notice a woman standing with her arms at her sides. She sees you coming and crosses her arms. This may be a good point at which to analyze your approach to see if it is causing her discomfort.

Reviewing the circumstances, the surroundings, and what might have changed can give you a good indication of emotional changes. A good social engineer will analyze a person's level of discomfort, try to determine the cause through observation and questions, and then adjust accordingly.

The last comfort display I will discuss in this chapter is head tilts. This concept is similar to open ventral displays. A good head tilt, combined with a smile, is a powerful tool. Just remember that the smile must be genuine, and the head tilt must be subtle. A fake smile and severe head tilt will make you look deranged, not trustworthy. But the proper angle will give you a powerful sense of trustworthiness and friendliness, as shown in Figure 6-14.

Figure 6-14 The comfort of a good head tilt and smile

Here Ben displays a genuine smile and a subtle head tilt. This display says, “I trust you, and I'm happy to see you, so you can trust me.” This high-comfort display creates a warm feeling in the person you are interacting with, as shown in Figure 6-15. This display says to the person you are talking to, “I trust you, so you can trust me.”

Figure 6-15 Selena's not-so-subtle head tilt says she is open to this relationship.

Selena is happy, trusting, and ready to participate in this relationship. You can see that her whole face is involved in the smile, and her head tilt, not as subtle as Ben's, says that she is open.

Mixing the head tilt and smile with an open ventral display is a powerful tactic. Former U.S. president Bill Clinton had this down pat. He would hold up his palms, smile, tilt his head, and invite you to join his cause. He won the hearts of the American people using this nonverbal display.

Former U.S. vice presidential candidate Sarah Palin also tried to use this display. She had a great smile and a good head tilt, but when she used her open ventral displays, she often added a shrug to the mix. This one gesture made her seem unsure of herself and her message.

What to Watch For

As a social engineer you want to watch yourself when it comes to this display. When you get nervous, you become tense, and tension will make you look rigid and stiff. If you're tense, you won't be able to give a good head tilt and smile. So, firstly, watch your own displays and make sure you are showing the proper emotions for your pretext.

Also, I know I said this a lot in this section, but I can't tell you how important it is to continually watch for subtle changes in the baseline that can be hot spots. Recently my wife was telling me about a situation in which she was with some friends. While telling the story, she had a warm smile, and she was open. I asked her about a particular person and she crossed her arms in front of her, her voice lowered and she became stiffer. At that point, I knew something had happened between them, but I also knew I couldn't just ask, “What happened?”

I said, “Hey, are you OK? You seem tense.”

“Well…,” she contemplated telling me or not, “actually I am. Let me tell you what happened.” And I got the full story. Being alert to changes in the person you are talking to can give you enough to change your body language, then change your conversational style to elicit more information.

Summary

Herein lies a lesson for all those interacting with other people: Nonverbal displays influence how others view you, so use them wisely, use them with caution, and use them with practice. If you want people to feel comfortable and at ease, then you must practice conscious application of nonverbal displays.

Also note any negative or discomfort displays that can hurt your interactions. They can be useful to back up a pretext, but use caution.

Noting levels of comfort and discomfort is a good starting point for you to begin your journey into deciphering nonverbal communications. Learning to pick up, use, and control the displays you make can change how you communicate for the better. Even more powerful, it can change how others view you.

As you finish this chapter on nonverbal communication, some questions are left unanswered. Primarily, can these actions be controlled? Can you pinpoint the location in the brain that controls nonverbal language? The next chapter covers all of this and much more.