"When people talk, listen completely. Don't be thinking what you're going to say. Most people never listen. Nor do they observe. You should be able to go into a room and when you come out, know everything that you saw there and not only that. If that room gave you any feeling you should know exactly what it was that gave you that feeling. Try that for practice." - Ernest Hemingway
Social Engineering
As the bad actor in an adversarial assessment you must explore all avenues of attack. If you carefully examine past incidents involving security breaches, you’ll quickly learn that the human element of security is often the weakest. The success of an attack is most often the result of human negligence. So, for a moment, let’s put aside all of the technical skills that you and your group would need to be an effective red team. Can you have and maintain a conversion with a stranger? If you needed to extract information from your target without your expensive high-tech gadgetry, how would you do it?
There is a scene in The Bourne Identity that is often overlooked and actually used to bring levity to the story, but I feel it is most realistic scene in the entire film. Bourne tasks Marie with gathering records from a hotel regarding a certain Mr. Kane. He gives her an exhausting list of directions to follow once she enters the hotel. As she walks inside, she sees a male front desk agent, he smiles at her. Suddenly, the scene cuts to her meeting Bourne outside, records in hand. Now, how do you think Marie was able to acquire those records without following Bourne’s direction? Her feminine wiles? Following Bourne’s questioning, she states she simply asked for them. Don’t we all wish red teaming was that easy? Marie tells Bourne that she told the desk agent she was Mr. Kane’s personal assistant. Although, she provides a simple answer, the engagement was likely more complicated than that. I believe she was able to tap into the most receptive part of the human person.
Human emotion.
A few days ago, I had an interesting conversation with my girlfriend. She works in property management. On top of her daily tasks, she is constantly fielding problems, dealing with vendors, addressing tenant complaints, and managing her employees. During our conversation, she said, “Whenever you need something from someone, never demand it. Saying, ‘please,’ won’t help you either. Instead, put yourself in a position of the needy. State your problem and ask for help.” People that ask for help are automatically people you feel you can trust. Why? Because they are trusting you to help them.
People in need of help trigger something in human beings. They trigger emotion, it can be sympathy, sadness, in some cases it can even be pride. When you put yourself in a position of need, especially in this particular way, you put your target in a position of power. It will make your target feel like they hold all of the cards. Whether or not that is true is irrelevant. Although, you never really see Marie’s engagement with the hotel agent, I would like to think the encounter was more complex than the movie makes it out to be.
This method of social exploitation, by it’s very nature, runs contrary to what you would normally expect from an adversarial engagement. The goal is to be noticed. You want your target to focus on you. However, it is also important to understand the culture of the environment in which you are going to work. Some people are more willing to help a man wearing a Verizon shirt asking for a restroom than they would a panhandler. Remember your ABCs.
Emotional Awareness
To be truly effective in a social engagement, emotional awareness is essential. To be aware of others, you must learn to be emotionally available yourself. All of our emotions are inherently good. Although, some may be uncomfortable, they are still good. They are primal tools, which inform us of ourselves and our surroundings. In the information age, emotional insensitivity seems to be norm, not the exception. This leaves us at a disadvantage. If it takes you more than sixty seconds to identify what you’re feeling at any given moment, you probably have an issue.
If you think about how the human body responds to stimuli, your body reacts first, then your emotions, and finally your intellect. All three are meant to compliment each other. Once your body reacts, you are meant to feel, and then temper those emotions with your reason. So, how do you begin to put this into practice? Next time you read a book, have a glass of wine, or dinner with your significant other, ask yourself how it made you feel. The emotions are there, you just have to start giving them their proper attention.
Once you gain a better understanding of your own emotional state, you can purposefully begin to engage others. Years ago, when I realized I was a bit emotionally underdeveloped, I decided to make a dramatic career shift. The work forced me to engage people on a daily basis. I encountered numerous difficulties. In spite of that, I had to remain proactive, and I had to challenge myself. And after two years, I found that I had I changed and grown in ways I never thought possible.
So, if you find yourself lacking in emotional awareness, you know have work to do. Red Teaming is a multifaceted and multidisciplinary field. This particular skill will eventually be applied to any large scale social or cultural intel gathering activities. Challenge yourself, do not fear failure, and embrace your own suffering. It is the man that can properly harness his emotional state and recognize the emotional state of others, that will find success in whatever he chooses to pursue. So, do you still want to be a red teamer?
“There are some games you don't get to play unless you are all in.” - Jordan B. Peterson
