This section covers some of the natural human quirks, namely reciprocity and consistency, and highlights how those can be used for social engineering.
There have been other studies to find out quirks of the human brain, other than the magic word “because”. These 6 quirks I’m going to talk about are relevant to social engineering, because they can help you disclose info, they can help you get a job, and they can help you get a raise. And I’m going for a job interview tomorrow, so I’m probably going to be using these.
1. ReciprocitySo, the first one is reciprocity (see right-hand image). We tend to return favors regardless of the original favor. Even if we didn’t want the original favor, our brain is rather flattered by the fact that someone tried to do us a favor. So, this is exploited commonly by charities. Before they ask you for donating money, they usually hand you flowers or a drink, maybe bourbon, your favorite scotch or something, or snacks, or a souvenir. Then they ask for a donation. It exploits the temptation to give back. Unfortunately, it doesn’t work for the Nigerian scammers, I just don’t know why. But this also works in negotiation (see left-hand image). When negotiating, if you make a concession and then ask for one in return, you’re more likely to have the person you’re negotiating with comply with you, regardless of what that concession was. You’re being seen as basically taking a step forward to make the process work, to make an agreement, and you’re giving something up.
This is commonly exploited in bartering: you see all these Pawn Stars and other ridiculous shows on TV that take over what should be some History or Discovery or learning show. In every instance of those people arguing about price, always the guy who’s the shark offers an outrageously high price first, or an outrageously low price first. So if they’re buying, they’ll offer the low price, if they’re selling, they’ll offer a really high price. And then the other person is like “No, I’m not doing that; most I can do (or least I can do) is that”.
And so when they make that first concession down to that top range of what they’re willing to sell this for or the bottom range of what they’re willing to buy this for, the brain is tricked into thinking: “Ok, there’s some progress here, we’re getting closer to an agreement”. Just by the very act of that one concession people leave the negotiation, the bartering feeling happier.
There have been studies where people were allowed to negotiate a price, and they’re getting ripped off in the same way. And there are studies where people have to pay a thought price and are still getting ripped off. But in the first trial where there’s negotiation they make it so it never drops below the second trial’s price. So you’re actually still paying more in the instance where you’re able to negotiate. And then they asked people after each: “How happy do you feel?” Everyone felt happier in case 1. Really interesting.So, reciprocity can be exploited for initiating tricky conversations (see right-hand image), especially when asking for a raise, which is a tricky subject. If you’re seen as basically having done something for someone else – perhaps, done a favor for someone else: “Hey, I fixed that printer for you. Is this a good time to talk about my performance evaluation”, – it actually eases the initiation of a tricky conversation. And so, this can actually be used to get information disclosed perhaps about the target network, and so on, perhaps a boss’ schedule, I’ll let you guys imagine.
2. ConsistencyThe next trick is consistency (see right-hand image). The human mind tries to be consistent with its prior actions, even if the reasons for the original actions have changed. Charities have really successfully exploited this, I think the American Cancer Society – there is a paper. I heard a story about American Cancer Society. What they do is they get a list of people that they’re going to call and ask for donations. Before they call and ask them for donations, they call them and they don’t identify themselves as the Cancer Society. They say: “Hey, we are center for American charity, and we just want to ask you 2 questions: would you be willing to donate a small amount of your time for charity that you like if you were asked to?” Mostly people say “Yes” to this. And then they ask some other irrelevant question to throw the trial off.
Two or three weeks later the ACS would call and say: “Hey, we’re the American Cancer Society. We fund cancer research, we’re for curing cancer in children and all sorts of people. Would you like to donate money to us? And if you do donate money, could you spend a little bit of time calling other people you know for us?” And they actually get a much higher compliance rate with that prior phone call than they do just by cold calling people with this question, because the human mind is tricked into being consistent with its previous decisions.Salesmen exploit this (see left-hand image), and I’ve fallen for this myself. I’ve disclosed a retarded amount of information myself, especially when they visit me and it’s too early in the morning for my brain to start working. When they’re talking to you, they get you to start filling paperwork before asking you to commit, but still telling you the details: “Let me just get this paperwork started with you”. And as you start filling out, you probably leave some things blank, because you don’t want to give your Social Security Number right away, because you don’t know what they’re selling just yet.
And so it’s really surprising how much information you can get. You usually can get someone’s Social Security Number before you tell them what you’re selling. After they start filling out this information, the brain has unconsciously made a small commitment. Studies have shown that by using this paperwork technique they can get a higher sales compliance rate than just by saying: “Hey, this is our product, would you like to make a decision, yes or no? Yes? Ok, start filling out this paperwork afterwards”. They actually get a higher compliance rate because when you start filling out the paperwork beforehand, your brain has made a small amount of commitment and it likes to justify its previous actions. This is just an evolutionary flaw that our brains have.
Read previous: The Anatomy of Social Engineering 2: Evolutionary Triggers