Unmasking the Social Engineer: The Human Element of Security (2014)

Part III. Deciphering the Science

Chapter 7. The Human Emotional Processor

Let's not forget that the little emotions are the great captains of our lives and we obey them without realizing it.

—Vincent Van Gogh

It is an oversimplification to say that our brains are similar to computers. A computer has a series of hardware components that all interact to create the desired output.

As you double-click the mouse to open a program, code is run to call a request for memory in your computer to be allocated for the program. The kernel of the computer then will load the code for the program into memory, and then it jumps to a particular area of memory and starts running the program. If all goes as planned, you get a graphical output from your desired input. As I typed this sentence, I pressed keys on the keyboard that triggered code inside the computer to use both its memory and processing power to put the desired letters on the screen. If I just bang away on my keyboard, I will get gibberish. If I close my eyes and type without thought or without looking, I will get gibberish. Sure, there is a chance that some of it will spell words and make sense, but it is unplanned and unfocused.

This is not much different from our brains and emotional content and how we process it. Our senses take in external stimuli (much like using the keyboard and mouse). Our memory, or life experiences mixed with actual memories (what is in our storage), appraises how that content triggers emotions and responses. Our internal processors (like a computer processor) trigger code that runs and tells us how to respond based on previous experience and present “processing power” (i.e., how is your emotional content at this time?).

Understanding this is key to understanding nonverbal communication. Engaging with humans while ignoring this type of knowledge is equivalent to just “banging on the keyboard.” You will have some success, maybe even a few good lines, but overall you will produce gibberish.

One important point to remember is that our emotion affects our perception and reaction to a situation. For example, when I was young I used to love eating eggs. My mom would make what she called “egg in the bread” (I know, not very ingenious). She cut out a circle in some white bread, fried it in a pan, and cracked an egg in the middle. I looked forward to the buttery goodness of this breakfast.

We kept chickens, so we always had fresh eggs. One day I ran out, grabbed a few eggs, and started to make my favorite breakfast. As I cracked the first egg into the pan, a bloody half-formed chick emerged. I gagged and started to heave. The sight of a tiny chick in a frying pan was so disturbing that I couldn't eat eggs again for almost 12 years. In this instance the emotions that were linked to that scene were so strong that it took me over a decade to control the disgust emotion linked to the thought of eggs. That emotion modulated my perception and affected my memories, triggering a very strong reaction.

Because each person's memories, life experiences, and emotions are different, we should not assume that our emotions or feelings on a matter are the same as the person we are interacting with.

Emotional responses to a situation can differ greatly from one person to the next. In addition, our “processors” will try to figure out how relevant the stimulus is before they give us the emotional reaction. In 1960 Dr. Magda Arnold published a work titled “Emotion and Personality” that stated that our emotional appraisal process is unintentional and automatic. Although some researchers disagree, most agree that emotion involves an appraisal process that occurs in our internal processors to create a response.

What is this processor? The easy answer is the brain. But the brain is so complex and carries out so many functions, can we really pinpoint an area that is responsible for this processing?

Introducing the Amygdala

In their 2002 paper titled “The human amygdala: a systematic review and meta-analysis of volumetric magnetic resonance imaging,” researchers Brierley, Shaw, and David describe the amygdala (pronounced uh-mig-dull-uh) as “an almond shaped mass of gray matter located within the anteromedial, or the front toward the middle, part of the temporal cortex” (see Figure 7-1).

Figure 7-1 The amygdala is a tiny portion of the brain that processes emotion.

Additional research indicates that the amygdala has a dense core of nerve nuclei that processes input from all modalities, or senses. In essence, all our sensory input passes through this area of our brain and then is projected to various brain regions.

Researcher D.G. Amaral states in his 1992 research that “the amygdala has dense projections to many brain regions, including the brain stem, hypothalamus, hippocampus, basal ganglion and the cortical regions.” These regions all play a part in processing emotions and our responses.

How the Amygdala Processes Information

Wataru Sato from Kyoto University in Japan released an excellent paper titled “The Information Processing Role of the Amygdala in Emotion.” He breaks down the processing roles of the amygdala and how our sensory inputs and outputs are affected by that processing.

One of the studies referenced in his work talks about how emotion can be elicited from someone without his or her conscious awareness of the stimuli. To prove this, a study done by Kochiyama Sato in 2004 showed negative (angry) and neutral (no emotion) slides subliminally to the patient's unilateral visual fields. He found that the patients had a higher electrodermal response to the negative slides than to the neutral ones.

Combining this research with other work suggests that emotional processing by the amygdala can occur subconsciously and can be affected by sensory input. Combine that with the 2002 study by Dr. H. Oya titled “Electrophysiological responses in the human amygdala.” Dr. Oya's research indicates that the amygdala is activated as soon as 50 to 150 milliseconds after the stimulus is presented. Since it has been proposed that the visual cortices activate at around 200 to 300 milliseconds, the rapid activity of the amygdala could point to the fact that it is processing this emotion subconsciously.

As a social engineer, I find this combination of research fascinating. I interpret it to mean that our brains (amygdalas) start processing the stimuli presented to them on a subconscious level before the individual even begins to thoughtfully process these cues. While embedded with U.S. combat troops in Afghanistan, author Sebastian Junger, in his book War, made several observations about the amygdala. It can process an auditory signal in 15 milliseconds, but, though fast, can only trigger a reflex and wait for the mind to catch up. He also noted that the amygdala requires only a single negative experience to decide that something is a threat. These stimuli include facial expressions, clothing, and other visual cues, as well as sounds, smells, and other sensory input.

This discussion demonstrates that good social engineers need a lot of information on their targets. Knowing what likes, dislikes, hobbies, problems, and so on are part of the target's life helps the social engineer avoid any looks, expressions, or clothing styles that may be negative or offensive to the target. Information also helps the social engineer see what topics should or should not be discussed.

If all this is true, there must be a way to hijack someone's amygdala to create emotional content that you want there—to influence the person to have emotions that will make your job easier.

Hijacking the Amygdala

Suppose you are sitting at your desk, frustrated. Your work is piling up, and there seems to be no end in sight. Due to budget cuts, some of your team has been let go. Your phone is ringing. You have three meetings scheduled for today. Your spouse texts you that the car needs to be fixed. Your email dings. Your coworker is telling you that the report you sent has incorrect data, and you need to fix it pronto and to avoid handing in such shoddy work. You click Reply and type a terse, angry email that sets him straight. Right after you click Send, a sense of relaxation comes over you, followed by dread. You go to your Sent folder, read what you just wrote, and begin to wonder if jumping out the window will make everything better.

What happened? This is what researchers have called amygdala hijacking. When the emotional processor (the amygdala) kicks into high gear, the logic center processors (neocortex) get almost turned off and blocked. Adrenaline, hormone levels, and blood pressure rise, and our memories become less efficient. We begin to lose the ability to communicate effectively, and we turn to a form of autopilot to make decisions.

A group of researchers from Case Western Reserve University performed some tests to see if this is true. They recruited 45 college students and asked them to spend 10 minutes inside an MRI machine five times. The researchers presented them with a random set of 20 written and 20 video problems that required them to think about how others might feel. Then they received 20 written and 20 video problems that required physics to solve. After each question, they had to answer yes or no within 7 seconds. They were given 27-second rest periods in between, as well as variable delays lasting from 1 to 5 seconds between trials.

The findings were amazing. When the students were asked to answer questions and solve problems that triggered empathy, brain regions associated with analysis deactivated, and social regions of the brain activated. When the subjects solved problems and answered questions dealing with physics and logic, brain regions linked to empathy deactivated, and the analytical network activated. When the students had downtime lying on the table with no questions being asked, both regions of the brain were activated, allowing them to access both the analytic and moral/social regions of their brains.

What does this mean for the social engineer? Triggering, or hijacking, the emotional, empathetic, or social regions of the brain can shut down the person's ability to think logically.

Scam artists have known this (even without all the science) forever. This is why they use natural disasters, dying children, sickness, and other emotional triggers to part victims from their money. It works. When you find a story line that triggers that empathetic response, the person stops reasoning and starts handing out money.

Social engineers are no different. There are many accounts of social engineers using sadness, fear, and other emotional triggers to scam information, actions, or money from their targets.

Recall the example in Chapter 5 in which my goal was to infiltrate an organization using a USB key containing non-malicious malware. Recall that my pretext was to dress in a suit, walk into the company holding resumes that were wet with coffee, and ask the receptionist if I could use my USB key to reprint my resume before my job interview. As I approached the receptionist's desk, what happened? The gatekeeper (the receptionist) processed the external stimuli:

· Who is this?

· What does he want?

· How will I respond?

These questions might have been going through her processing centers. I needed to hijack her processing centers and turn off her logic center. This is where my story came in. Because I displayed sadness and concern, her amygdala processed the external stimuli of my story and facial expressions, which triggered her empathy center. This shut down her logic center, causing her to process my request in only the social regions of her brain.

I've found a few more pieces of research that drastically affect a social engineer's ability to utilize amygdala hijacking, as described next.

Human See, Human Do

A group of researchers from Northwestern University and the University of Wales Bangor (Li, Zinbarg, Boehm, and Paller) joined forces and wrote a paper titled “Neural and Behavioral Evidence for Affective Priming from Unconsciously Perceived Emotional Facial Expressions and the Influences of Trait Anxiety.”

As stated in the paper's abstract, “Affective judgments can often be influenced by emotional information people unconsciously perceive, but the neural mechanisms responsible for these effects and how they are modulated by individual differences in sensitivity to threat are unclear. Here we studied subliminal affective priming by recording brain potentials to surprise faces preceded by 30-msec [millisecond] happy or fearful prime faces.” In essence, Li et al., wanted to see if the brain subconsciously recognizes nonverbal communications and then reacts, or allows decision-making ability to be affected by them.

First they set a baseline using research from Raichle and Gusnard (2001, 2005) that theorizes that humans have an automatic system that constantly surveys their environment for stimuli. In other words, the system looks for nonverbal feedback that triggers people's understanding of the world around them.

This can explain why we sometimes feel nervous, tense, or even afraid in situations that seem to present no clear reason for those feelings. Our brains' “radar” may be taking in the environment around us and notice someone nonverbally displaying anger, fear, or other negative emotions, and this triggers in us feelings that put us on alert.

The researchers decided to show the students faces displaying surprise because the emotion of surprise can result from either a positive or negative experience. The researchers “reasoned that ambiguous expressions of surprise might be sensitive to the influence of subliminal happy or fearful primes [images shown before the images of surprise].” The study contained 140 surprise faces from 70 different people, seven happy faces, and seven fear faces.

Li et al., placed the students in a dimly lit, sound-controlled chamber facing a screen and communicated with them over an intercom. Each student viewed 70 faces showing surprise. These faces were primed (preceded) by either a fearful expression or a happy expression for 30 milliseconds. The face display was randomized and changed for each student. The students were asked to rate the surprise face as “extremely positive,” “moderately positive,” “mildly positive,” “mildly negative,” “moderately negative,” or “extremely negative.”

As the paper states on page 101, “Affective priming was demonstrated by a significant difference in mean ratings for surprise faces preceded by fearful versus happy faces.” In other words, Li et al saw a significant increase in the surprise face being rated as either positive or negative based on what kind of 30-millisecond prime face preceded the surprise face.

Although Dr. Paller gave the same caution that Dr. Ekman always gives, which is not to read too much into why a person feels a certain way, he stated, “The ability to detect microexpressions may allow an observer to be more empathetic and sense someone's true intentions and motivations.”

Another piece of research, the “visual cliff” experiment described in Chapter 1, demonstrates that even from infancy, our nonverbal communications play a major role in our reactions to a given situation. For social engineers this is a vital point to understand—for the three reasons described in the next sections.

Reading Other People's Expressions

Learning to read other people's nonverbal communication can help you understand their true intentions and motivations. Learning to notice subtle or not-so-subtle displays can help you as a social engineer communicate more effectively.

To reiterate the caution, knowing how to read an emotion is a powerful tool. But it's important not to get too caught up in looking for every little sign to the point that you forget to listen actively. Listening to the person you are interacting with can create a powerful connection of rapport and trust.

Balance is required when utilizing these skills.

Your Own Emotional Content

Facial expressions and nonverbal communications can alter a person's ability to make decisions.

What happens when you are stressed or nervous? Your muscles get tense, you may start to sweat, and you can become unfocused. That tension shown on your face and body can create tension and nervousness in your target. Unless your pretext is showing fear or stress, displaying that emotion can be confusing to the target.

Just like a baby who waits for nonverbal approval to cross a “visual cliff,” people we make requests of are looking for cues to trust us or not. Therefore, it is important to practice and gain control of that tension and nervousness so that we display the right emotional content.

The same goes if your pretext is nervousness or fear, like the story I told the receptionist about how I spilled coffee all over my resumes right before my job interview. If I displayed calm, cool confidence during this distressing story, this approach might not have worked, because my nonverbal communication would be incongruent with my verbal communication.

Nonverbal Social Proof

Besides noticing your target's nonverbals, it is just as important to get the feel of the room. What is the crowd feeling? Take notice if there seems to be a somber mood, or if there is laughter. Noticing the mood of the room can help you to set your emotional content to match.

One time I was on a flight that arrived so late that I had missed not just one connection but two. As the plane approached the airport, the pilot came over the intercom to tell us that lightning had struck the airport and the electricity was out in certain sections.

The lightning had knocked out not only the main power but also the backup power. As I walked into the terminal, the only light was coming from airport security's flashlights. The concourse was in mayhem. Passengers were yelling at the employees, furious about missed flights and delays. I went to the gate I thought I was assigned to and found a long line of very angry people.

What was happening was a classic example of social proof, or the idea that the crowd's mood can give us permission to act a way we normally wouldn't act or take an action we normally wouldn't take. Everyone was mad, the scene was tense, and it was affecting all those around. Granted, your pretexts usually won't take place in such a tense situation. The point is that emotional content sometimes affects not just one or two people, but an entire room.

Even if you encounter a secretary at a company who puts on a sincere smile, noticing tension in the room can help you temper your emotions to match the mood or display emotion more appropriately.

When you keep these points in mind, as a social engineer, you can influence a person's ability to make decisions. The goal of the social engineer is to create an environment where empathy is easy to display. As you have learned, empathy shuts down the brain's logic centers. When those logic centers are not all firing together, that's the time to make your requests. The best conclusion to this section is to quote legendary New York talk show host Joe Franklin: “The key to success is sincerity—once you can fake that, you've got it made!”

Using Amygdala Hijacking as a Social Engineer

After reading the last few pages you may be wondering what any of this has to do with social engineering. Remember, the goal of a social engineer, whether good or nefarious, is to get the person to take an action. Understanding how the brain makes decisions can greatly aid the social engineer to get someone to make the decision you want them to make.

Personally, I like to simplify all these complex scientific findings so I can understand them better. The basic equation for amygdala hijacking is: (Sensory Input > Empathy) + Logic Center Shut Down = Amygdala Hijack + Request Made.

In essence, this says if a request is made after triggering the empathy response from a person, the request is more likely to be honored. How can this be used?

Our brains are hardwired to mirror the emotional content we see from those around us, so it is logical to say that if the social engineer can show mild sadness signs, those signs will trigger empathy in the person they are dealing with. Once empathy is triggered, and if the social engineer's words and story create an emotional bond with those words, then rational and logic centers in the brain shut down momentarily. This leaves the full processing power of our brain focused on the emotional center, so as a decision is being made based on the request, what is reasonable goes out the window.

I was doing a phone elicitation test once for a company. The goal was to call a company and try to elicit information that they should not have provided.

On one particular set of calls I decided to pretext as a fellow employee of the company named Jim. I made a few calls as “Jim” and was very successful in obtaining information and facts that would help me create a security program for the company.

I wanted to step up my game and decided to call the tech support group as Jim and see if I could get them to give me “my” VPN credentials over the phone. The call started like this:

“Tech support; this is Sue Smith. How can I help you?”

“Hi, Sue, I am having an issue. I deleted my VPN credentials while doing an online virus scan and now I can't get back in. I have a report due. Can you help me?”

“Sure, can I have your name?”

“James, but you can call me Jim.”

“Jim, what is your user ID?”

“Actually can I just give you my full name? I always forget a few digits.”

“Sure.”

“James Ballo.”

“Jim? Jim Ballo? Wait, you didn't recognize me? Its Suzie.”

The conversation had been underway for about 30 seconds to this point, but now I was presented with a situation in which Suzie knows Jim and I am not acting like I know her. Facial expressions won't work because I'm on the phone, so how did I tackle this?

First, I let out an audible sign of frustration; it was long and definitely sounded stressed. Then I followed up with:

“Ah, Suzie, I am so sorry. I am such a moron (self deprecation). Today has been pure hell. I have a cold, which is why my voice sounds different (empathy building), then I deleted my certs, then I got yelled at by some other security guy (more empathy) for using an online scanner without permission, plus I got a flat tire this morning....” (more empathy). Then I let out another huge sigh.

“Oh, Jim, I am so sorry, sounds like a terrible day. What can I do to help?”

“I need to get this report over to my boss, and you know what he is like, and I can't get on the VPN. Can you just give me my credentials again?” (The request.)

Within moments I was being given the credentials I asked for, but why?

The equation again states that if I build empathy and mix it with my request I can shut off the brain's logic centers and get a person to take an action solely based on how they feel about a situation.

In the case in which I posed as Jim, I was not in person so I had to build empathy with limited nonverbals (the sigh) then the words (the sob story) before I made my request. Once I knew that Suzie was empathizing with me, even after having to explain away the fact that I should have known her, I then made my request, which was honored.

This is powerful in the way it works, and if done right, there is not much anyone can do to combat it. The key is knowing how to build empathy to the proper degree before making the request, and that comes with practice.

Summary

A social engineer doesn't need to be a researcher or a neurologist or a psychologist, but a good social engineer will at least understand what makes people tick.

To recap, let me outline the simple equation that makes up amygdala hijacking: Supporting nonverbal + emotional content of empathy + make the proper request = amygdala hijacking.

To simplify, a social engineer wants to build emotional content—especially empathy or sadness. The best way to do that is to support your words with proper nonverbals of sadness and empathy. Once the person's amygdala is triggered, the logic centers will shut down and that is when the request is made. If the request is reasonable, it will be honored, despite the best logical response.

Researchers like Dr. Ekman and the ones mentioned in this chapter have spent their lives trying to understand how emotions affect people. Reading and applying their research can go a long way toward developing your ability to hijack the emotions of the people you deal with.

On the flip side, when security professionals work with their clients, and they know about this research, they can notice environments where emotional hijacking can easily happen. Then they can help plan mitigations or training to enhance awareness of these types of attacks.

Knowing how these things work can help the social engineering professional find vulnerabilities and develop training and patches to fix them.

The next chapter takes these principles and expands on a topic covered in my first book—elicitation. Instead of covering all the details of elicitation, I will focus specifically on those aspects that utilize elements of nonverbal communication.

All materials on the site are licensed Creative Commons Attribution-Sharealike 3.0 Unported CC BY-SA 3.0 & GNU Free Documentation License (GFDL)

If you are the copyright holder of any material contained on our site and intend to remove it, please contact our site administrator for approval.