real.machiavelli
Member
Finding Information on Security Procedures
The best way to find information on a business’s security procedures is to ask! However, that information is obviously going to be closely guarded, so you have to have the right approach. Anybody with any type of relevant information is going to be guarded and suspicious with it.
The best method I have found is to stage an interview. You create a job opportunity that matches the type of information you are looking for. However, again, these people are paid to be suspicious, so you need to set it up properly if you want your fishing attempt to be successful.
Step 1: Creating the perfect job
The first step is to create the bait, the perfect job for somebody in the industry you need to learn about. This is going to vary greatly depending on the type of information you are looking for. You need to ask yourself about the types of employees that will have access to this information.
If you are looking for basic information on security procedures, you can go for general low level employees. This is as simple as searching Monster.com or CareerBuilder.com and finding a job that is similar to what you are looking for. I would recommend finding a couple. Pick phrases from each to create a job listing.
Again, to avoid raising suspicion, don’t make it obvious what you are trying to find out. I would recommend adding qualifications that are general and obvious. I always include bullet points such as “providing outstanding customer service,” “team driven performer,” “extremely detail oriented,” and other general corporate management speak. This is mainly filler.
Obviously, the most important thing is the requirement that they have worked in whatever area you are probing for information. Be Specific! Example: “Must have 1-2 years working in loss prevention for a major electronics store.” You want people that exactly match the information you need. It does no good to be vague here.
Post the job online, or in the paper, and wait for the replies. Due to the nature of the job market, you will get scores of people that respond even if they don’t have what you need. Just delete these resumes – or save them for practice later.
1a: The Executive
Often the information you might need is not readily available from low level employees, and requires a much more nuanced approach. For example, you might need high level information about how a company investigates fraud or internal accounting procedures. This information is very closely held, and the people that hold it are very suspicious types.
These people will always do their homework before talking to anybody, so it’s imperative you do yours!
The easiest way is to create the listing for an existing company. You can pull their information online, and point to their website. However, I would not recommend this. Too many things can go wrong. The company can find the job listing, the target might have contacts in the company, might call the number listed on the site instead of the number you gave them, etc.
I would recommend creating a new company. Pick a name that is fairly generic, but not overly so. A great way to do this is by referencing a geographic feature. EX: “Lakeland *Name of industry.” Those types of businesses are a dime a dozen, and won’t stand out.
At this level you will have to have a website. I would recommend looking at other companies in the industry, and find the one that has the least amount of information on the site. Mimic – but don’t copy – the site. You want it to look professional. I would strongly recommend hiring a web designer for this if you aren’t an expert in web design. ANYTHING that stands out can ruin the operation.
The might check to see how long the domain has been registered, so include “Welcome to our new home on the web” on the homepage, so there is an explanation there if they do check.
They will probably look for your address. I do a web search for industrial or business parks in the target area. Look for someplace with lots of corporate clients, and use that as the address. Don’t include a building or suite number.
The people can be difficult to reach with your job listing, so I would recommend looking for a headhunter. These people are extremely effective at pinpointing the exact person you are looking for. They also get paid a percentage of the salary if you make an offer, so they are essentially free.
---------- Сообщение добавлено в 01:26 AM ---------- Предыдущее сообщение размещено в 01:25 AM ----------
1b: Don’t be too good to be true
Don’t fall into the trap of making the job seem too good to be true. Include salary information that is actually in line with the position. Do research on this on career websites. A good way to make the position seem legitimate is to make the salary incredibly specific. EX: $14.26 an hour or $52,328 a year, etc.
There is a fine line to straddle here, as you need the position to be attractive enough that they certainly want it, but not unrealistically so.
Also remember the motivations of your target. If you paint a picture on how this job will help their professional development, they are more likely to bite.
Step 2: Create a plausible scenario
This is a very important step. A failed attempt to gain information can be disastrous; as they will know they have an impending attack, and tighten/change security procedures.
The trickiest part is that your target will really know what they are talking about, and some of the important you are looking for is considered common knowledge in the industry, and not knowing it is a red flag.
You need to come up with a plausible story in advance on why you do not know this information, and why you are asking for it.
2a: Diffusion of responsibility
I’ve found the best way to approach this is by setting up a scenario with shared responsibility.
In Corporate America, many organizations use what is called a “matrix organizational structure.” The defining characteristic here is that each person has two bosses – one in a functional team, and one that is role specific. For example, say you have a marketing team. The team will have a team leader that is responsible for the day to day operations. If you are a web designer on that team, you would have another boss that is responsible for overseeing the web operations for the company. You would report to him on all matters relating to the web.
When you are creating your scenario, use this to your advantage and position yourself as somebody with a role that is related to the position, but not an expert in the field.
For example: if you are looking for a “security manager,” you can position yourself as the head of physical operations. You would responsible for physically implementing the measures, installing cameras, etc., but you would be able to plausibly explain why you aren’t an expert in security procedures. Another good one is “VP for Strategy,” as nobody really knows what that means.
Another good example: if you are looking for an “accounting manager,” positioning yourself as the head of sales or marketing is good. You don’t have to have any experience in accounting, but it would be logical that they would still report to you in some areas, as you would be responsible for customer service and ensuring the clients are taken care of. Thus, the head of accounting would report to you in all service related matters.
You establish at the beginning of the interview your position relative to the one you are interviewing. Then if they ask you something you can’t answer, tell them that you are not the person that *if* they advance in the hiring process the next step would be to interview with the position that would be closest related to what they would actually be doing, and that they are the ones that will go over the day to day operations side of things.
If you want to explain why you are contacting them first – not really needed unless you are going after a really big fish – paint a scenario where you are looking for a new “accounting manager” because the last one drove away a big client. Your interest is making sure they have the customer service skills for example, before you move on the actually qualifications for the position.
---------- Сообщение добавлено в 01:35 AM ---------- Предыдущее сообщение размещено в 01:26 AM ----------
Step 3: Preparing for the interview
You need to create a script before you begin – DO NOT ATTEMPT TO WING IT!
You should plan for the interview lasting 45 minutes to an hour. Anything less than that will raise red flags, and that is appropriate time for a legitimate first interview of this type.
3a: Be in the right mindset
You need to be in the right mindset. Don’t make the position seem too easy, like they already have the job. You want them to think that it’s going to be a long, arduous process – because it normally is for real jobs.
This is the part where most people fall apart. The bottom line is that in the today’s employment crisis, companies have never had more applicants, and have never been able to be more selective and picky.
Make it clear this isn’t their only interview – that it’s a first interview, or even better, a screening interview to determine who you will interview for the position.
You will want to do this over the phone, so explain that there will be an in person interview at another date – or that you will fly them to your headquarters for it.
The most important thing here is that you don’t appear defensive – or worse apologetic – about it. Don’t overly explain, you want to mention it in a detached, offhand way.
This means you don’t want to say all of it in the beginning. A good way to convey the information is to start a question by mentioning it. EX: “Obviously if we invite you to a formal interview at our headquarters we’ll go over this in much more depth, but can you briefly tell me…” Another good one: “Obviously the *other manager* will ask you a lot more about this, but can you tell me…”
3b: Set the stage
People want to know what to expect, and if you don’t tell them, they will create their own expectations, or worse, ask you about them.
This goes back to the previous point, so remember your mindset. You are a successful executive, who has ruthlessly worked to get to where you are, and you have hundreds of people applying for this position, and you will decide whether the lowly mortal you are talking to is worthy. You are a puppet master, they are the puppet. If they want this job, they have to please you and do everything you say.
Since you are representing a corporate job, you should act like it. This means if you need to send an email, make sure it comes from a legitimate domain – not GMAIL! Include a signature. Corporate signatures are very elaborate, have addresses, websites, fax, and often multiple numbers, one for you directly – a prepaid cell – and one for the general corporate number – an answering service.
Don’t forget to include the standard legal disclaimer at the bottom: “This message is confidential. If you have received this message in error, immediately delete it from your email and contact the sender immediately.
Another popular corporate email element is the: “Please consider the environment and do not print this email unless it is absolutely needed.” Include a clipart of a recycling logo or a tree or something.
3c: Opening the Interview
Corporate hiring is a convoluted process where everything is run by lawyers. Its alien to people that don’t have experience with it, but is out of place to not have it for people that work in the corporate system.
I always start by going through some “boilerplate” legalese. Be off hand about it, after all it’s the millionth time you’ve gone through it. Start by “I’m sure you know this, but…”
I start by stating the company is EEOC (Equal Employment Opportunity Commission) compliant, and that they should not *disclose* - always use that word – any protected information. By law, companies are not allowed to consider many things when hiring. These include: Ethnicity, Age, Disabilities, Sexual Orientation, Family Status, or Religion. I go through the list and ask if they understand.
Next I tell them that I will pause during the interview while writing information. They should not take my silence to mean that I am necessarily looking for more information. It’s pretty obvious, but it’s a standard disclaimer made at the top of every interview.
Finally, I open by telling them that all applicants will be treated equally during the interview, and that means we are asking the same questions of everybody. It’s a somewhat standard disclaimer, but it’s important because you can also say that you have to provide the same information to everybody, so at this stage of the process you are limited in the information you can provide, and can only answer in general terms. This plants the seed for later if they ask you a question you don’t know the answer to. You can say that you can’t answer that because you have to keep the interviews consistent *at this stage.*
3d: The “About Us” section
This will be different depending on the type of information you are looking for, and the level of the person in the organization. If you are going for a low level employee, then you won’t need a convincing backstory. You can just tell them a little – no more than 3-4 sentences about your organization, and then go right into your questions – DO NOT GIVE THEM TIME TO ASK YOU ANYTHING HERE, UNLESS YOU HAVE A REALLY GOOD BACKSTORY!
For higher level positions, it would be common to ask what they know about your company. Obviously use discretion here, and make sure you have good backstory. If you have a good website they will probably use information on that.
However, be warned that high level people will do an unbelievable amount of research. They will search for information in business directories – if you can get yourself in one, you should, just list your company as privately held, and don’t provide any more data. They will look for information on revenue, etc. If you are going after a big fish and really need this, make sure its consistent and plausible. Look at what other companies are doing, etc.
Again, the goal here is to get through it as quickly as possible. If you don’t have good backstory, you can use the standby that you “of course” are going to discuss it in much more detail at a later stage.
3e: Diffuse Suspicion
If you start off asking questions about their security systems, they are doing to be on the defensive and suspicions will be raised. Never start off by asking what you really want to know. Instead start with generic interview questions. Make sure the questions are logical for somebody in your position.
For example: if you are positioning yourself as a marketing or sales guy, ask questions about how they view customer service, deal with difficult clients, etc.
A great question to start with is “Can you tell me a little about yourself?” Keep the questions open ended, the more they talk, the less questions you need to ask, and there are fewer opportunities for you to slip up.
I also use scenario questions here, where I’ll describe a situation, and ask how they will deal with it. This is important because later you will want to use scenario questions to find out how they will respond to whatever it is you are planning, and you want them used to it.
A generic one that works for almost all positions is asking about how they would deal with an employee that does his job well, but is always late. Whenever you ask them about it, they always have a legitimate sounding excuse. How would they deal with it? At what point would they begin an official disciplinary action?
You don’t need to get carried away here, just ask enough to avoid suspicion. You will also want to do something similar after you get the information you are looking for. Never begin or end the call by asking sensitive questions.
3f: Getting the information you want
This is obviously the most important part of the call. This is why you are doing what you are doing. It’s also where the wheels can come off your plan if you are not careful.
You want to avoid asking about their security directly. If you ask them point blank, they almost certainly won’t tell you, and their suspicions will be raised greatly. It will be almost impossible to succeed at that point.
Obviously the questions you ask will vary greatly depending on the organization, industry, and level of the person you are talking to. Still, there are some basic things you will want to do in every situation.
A great way to do this is to ask hypotheticals. If you are looking for a new security manager, ask them how they run a department. They will tell you in general terms, but it is almost always how their current organization does it.
Another great one: “What is one thing you would change in your current position if you were able.” They might answer this by talking about a general company related change – employee retention for example – but they often mention a security flaw that you can use later.
I’m a fan of: “Obviously, no organization can be 100% secure, as concessions have to be made in order to do business. How do you balance security concerns with general business operations?” What you are looking for here is how to exploit cracks in their system. For example, the sales team in an organization is usually very aggressive. If they had their way, they would sell to anybody. Order processing on the other hand would prefer to sell only to people they have extensive relationships with, so they don’t get caught holding a bill for something later. Each organization has to come to an equilibrium between the two. Knowing where that is can help you create an approach to use later on.
One that is almost always useful: “What do you do when you suspect fraudulent activity? What are your legal requirements, and how do you handle the situation?” Again, you are asking the question in general terms, but they normally answer it specifically. If they don’t, feel free to ask follow-ups but still keep it general. EX: “Can you tell me about a specific situation?” This is somewhat risky, but within the acceptable range.
Scenario questions are great here. Create a scenario that is exactly what you are planning to do, and ask how they respond. Make it detailed, but make sure you keep it general. You are asking what *they* would do, not what their organization *does.*
Another one: “What do you do if you suspect somebody in the organization is acting illegally or fraudulently? What do you look for in employees when investigating?” This will generally tell you who to approach and what the responsibilities are.
Once you have the information you want, remember to ask more filler questions.
3g: Ending the interview
You need to end the interview by giving them an idea what to expect in the future. Of course, nothing will happen, but you need to paint them a picture.
I tell them that I am finishing the first round of interviews this week, and if they are selected for a second interview, the other manager will contact them next week to set up a time. Ask if there are any special considerations, being out of town, etc.
You will also need to ask if they have any questions. Not doing so is a very big red flag. Obviously this part is tricky, and covered more in a later section. To limit the potential damage, start with the disclaimer that you “obviously I am limited in the amount of information I can give you since we need to make sure we give everybody the same information at this stage.”
4: Practice, Practice, Practice, and then Practice more
The key to a successful social engineering operation is preparation. When you get your target on the phone, your body will dump a gallon of adrenaline in your system. Be prepared!
Rehearse the script several times. You need to feel comfortable saying everything. If you are nervous, your target *will* pick up on it!
Feel free to add in some random events. EX: If your phone supports the feature, put them on hold for 3 minutes, say it’s a call you absolutely have to take, but it should only be a minute. Come back and say something like “Sorry, *sigh* we have a situation here.” That’s it, don’t elaborate, don’t explain, remember, your time is more important than hers!
Also remember to pause after they answer each question. You are taking notes! Even for the filler questions you don’t need, still pause! Go for 30-45 seconds after each question!
For higher level targets, call some of the crap resumes you will get. They don’t have any valuable information, but it’s important that you get experience talking to a real person.
4a: Things will go wrong, expect it!
The saying that no plan can survive the battlefield is apt for these situations. No matter how careful you plan, something will go wrong!
There is no way to know what will happen and no way to plan for every contingency. That is why it’s so important to practice. If you are trying to respond to the unexpected, you really have to have the rest of it down.
5: Putting all the pieces together
Now that you have your script, and you’ve practiced, its time to put your plan in motion.
5a: Be fluent in the language of your target!
You either need to be fluent in the language – as in little accent – or have a GREAT backstory. Obviously not doing so will be a major red flag.
If you are not fluent, there are still things you can do depending on the level of the target. For low level targets, place an ad online, saying you are a headhunter or employment agency. You need somebody to help screen potential applicants. You’ve prepared a script that they are going to use for each one, and record the answers.
This will only work for low level targets, as the higher ones would not submit to such a “screening” from a random low level worker!
For high targets, you can use headhunters. Give them a list of questions you want them to ask, and tell them they can only submit 3 candidates. This is a common instruction, as they have incentive to just flood you with candidates in the hopes you will hire one of theirs and get a commission.
VERY IMPORTANT: IF YOU HIRE ANYBODY TO DO THIS, ACTUALLY PAY THEM!! A call from a stiffed worker to your target after the interview will ruin everything!
5b: Schedule the interview
This is best done via email. Follow the above instructions, and make it look legitimate.
Again be aware of the level of the target. EX: if you are looking for low level targets i.e. loss prevention workers for a chain, then include something about making sure they are prepared when you call. This would be appropriate at this level, but insulting to a high level executive.
5c: Call on time
Make sure you call them when you say you will. A few minutes late is fine, or even desired, if “things got a little hectic.”
5d: Slow Down!
No matter how much you prepare, you will get a massive adrenalin surge, and you will start to talk very, very fast. Resist the urge to do this!
6: When things go wrong
You should expect to have things go wrong. You cannot prepare for every situation. That being said, there are a couple of common situations that you should attempt to plan for.
6a: Questions you can’t answer
Dealing with professionals in the industry, they will likely have questions you can’t answer, and many will likely be specific, so you can’t give general answers. One thing you can do to prepare is always have their resume in front of you. Know what’s in it. It’s sometimes easy to just change that information. EX: If they ask you a question about revenue, and list the revenue generated by their current department on the resume, use that and just change it a bit.
6b: If you can’t answer one question, answer a different one
It’s a political trick, but it really works. If they ask you how much revenue your company generates, respond by talking about how your strong internet marketing team is reaching new customers, and how it’s great by industry standards – and about this exciting new thing you are going to try next year – and how your sales are exploding.
Pretend to misunderstand what they ask. Most of the time, they won’t follow it up. If they do, then you can’t talk about *yet* as you have to be consistent in the interviews.
6c: They will try to impress you
Interview trainers constantly tell us that we need to have a question prepared in advance, something to show you’ve done your homework. These are the hardest. They are impossible to foresee, and usually really detailed since they are trying to show what they know.
The only good thing is that they typically don’t really listen to your response. They just wanted to ask the question to show how analytical they are.
Typical questions might be on how the economy is affecting your industry, who your biggest competitors are, what are the biggest challenges you face, opportunities for growth, etc.
These will be broad industry questions usually, so you can’t credibly claim you can’t discuss it at that point. To prepare for this do a little research on the industry, know who the competitors are so you can name drop. Keep it vague – talk about how you are in a perfect position to capture increase market share in the pending economic “uptick.”
This is also a great opportunity to answer a different question. If you are a marketing manager, then you can answer any question with a marketing related answer, same for web, etc. Remember, you got to where you are by being passionate about your area, so it’s natural for you to answer and question in those terms!
It’s also a great opportunity to…
6d: Have an anecdote prepared
I cannot overstate how useful it is to have an anecdote prepared. This makes you more plausible, and can be used to avoid answering questions.
If they ask a broad industry or company question, respond with a specific event.
EX: “Can you tell me how your company is responding to the economy?”
“Sure. It’s obviously a challenging time. We’ve had great success with internet marketing. We’ve been able to capitalize on…”
Take it from a general question to something specific. They won’t ask a follow up.
6e: I don’t do that!
You’ll get questions about your background, how long you have been in the field, etc. These are questions you really can’t avoid answering if you want to avert suspicion.
A great way to deflect the question is by making it clear that they have the completely wrong idea about what you do. “I’m not that type of _____! *laugh*”
EX: “As a security consultant, do you have a military background?”
“I’m not that type of security consultant! I’m not one of the guys you call if you think Al-Qaeda is going to attack your chemical plant, although I work with plenty of those guys. No, I’m the type of person you bring in if you think one of your employees is selling company information to a competitor.”
You’ve killed two birds with one stone. You’ve deflected the question, without having to explain how you got into the field without that type of background. Also, you’ve discouraged them from asking similar questions because they were so off base. In the above example, you can always use “Well, obviously, most of my work is confidential.”
6f: Know the local area!
This was a mistake I made too often when starting out. I didn’t know anything about the area I was supposedly from.
Always know the weather, look it up online. They ask about that *all the time.* Know where you live, find a listing for a home in the price range of the person you are representing. Know the name of the neighborhood. Also, know if they have any local sports teams – you don’t have to, and probably shouldn’t, pretend to be a fan, but at least know what they are.
ALWAYS KNOW THE TIME ZONE! If you are in a different time zone, get a clock on your computer, or set your watch for the time zone you are supposedly in. I guarantee that if you try to do it in your head when they surprise you with it, you will blank out and it’s a major red flag.
6g: Know nothing about the local area
Alternatively, you could choose to know nothing about the area you are supposedly hiring for, but its only applicable for certain types of positions.
EX: You are hiring a security manager for a large electronics store that is opening soon. They might ask you something about the store’s location, foot traffic, etc. They will likely be well versed in this information, so you can’t wing it.
In a situation like that, I might go with something like “Oh, I have no idea. To be honest with you, I’ve never set foot in *city name.* Obviously I’ve seen the location on a map, but I don’t know the city at all, so I can’t really give you a frame of reference. Obviously, as the director of marketing, I’m not involved in the day to day operations. I would of course be there for the store opening, but that’s probably the only time we would physically meet. We’d be communicating primarily through a weekly conference call. If you talk to the regional manager, he’d be the one to talk to you about that next week.”
Deflect and use the division of responsibility you set up earlier to explain why you can’t answer.
6h: They start to get suspicious
You will probably make a mistake at some point. Or they might get suspicious when you are asking sensitive questions.
The best way to tell is to listen for changes in their voice. If they want the job, they are very eager to please. You can hear it in their voice. They talk fast, and have lots of adrenaline in their system.
When they get suspicious, their voice will change. It will lose the eagerness, and they will talk slower, choosing their words more carefully.
To deal with this, you need to remember your mindset. You are a legitimate company, you are an important part of it, why would somebody not want to work here? If they aren’t interested, you have a hundred more that are.
If you think they are getting suspicious, don’t try to address the situation directly. Instead, question their motivation.
Try something like: “I might be reading too much into this, but I am sensing a little ambivalence about the position.” Don’t make it a question.
Make the assumption that they are not suspicious; they might not really want the job. If they don’t want to talk to you, this gives them an out. They can say they don’t think it’s right for them, not ready to make a change, etc. This should prevent them from realizing you are fishing.
If they aren’t ready to do that, then they will have to respond by selling themselves on the position. That it’d be a great opportunity, etc.
I would then toss a softball question in before returning to what I really wanted to get at.
6i: Are you on Facebook/LinkedIn?
This is becoming an increasingly popular question as social networking has become a staple of corporate communication strategy. If they are tech savvy, they probably already tried to look you up on these sites to find out who they are dealing with. A proactive way to deal with this would be creating a few accounts, filling in only basic information, and setting everything else to Private. They can’t find out anything, but this is pretty common.
If you are representing a large organization, this is a bigger problem. Even if your company does not have a presence on these sites, your employees would, and list you as their employer.
If you need a large number of employees, or if you are supposed to be a web based company, you need to represent it on these sites. The easiest way to accomplish this would be to hire an internet marketing company to set up a ton (approx. 200) of accounts. They will do this cheaply, and link them together.
If they ask for your personal information, tell them you do not give that out.
7: After the interview
If you are pursuing a high level target, it’s unlikely they will have an interview and never hear from you again.
Have an exit strategy.
7a: End the hiring process
If you are in the area you claim to be in, get a generic letter stating that you are unfortunately unable to offer them a position at this time. Make sure it looks nice, and print the logo on the letter AND THE ENVELOPE!
7b: Call them for a follow up
If that isn’t an option, you can call back and ask a follow up question about something on their resume. Something like: “I’m sorry I should have asked you this when we spoke previously, but I noticed you didn’t mention what type of computer system you use to do _____. Do you have any experience using *some random system.* Whatever their answer tell them thanks. You don’t need to respond again. It shows you were considering them, and have all the information you need. They will figure it out on their own that they didn’t get it, and you’ve planted the seed that they didn’t get it because they lacked whatever it is you asked them.
7c: If they call you after the interview
They might call you to “thank you” for the opportunity, or some such nonsense. If so, they are fishing for information on their chances. You can either thank them for their time, or tell them they didn’t get it.
If they ask for feedback, etc. tell them that corporate policy does not allow you to answer any questions. Tell them you are sorry.
7d: Invent a scenario
If they contact you, or you contact them, have a story ready.
EX: It could be that the position was cancelled due to a hiring freeze. Apparently the company has been taking massive losses on a side project, and they kept it secret until now. Don’t say it, but try to convey you are very worried.
A killing blow would be for you to ask about the company they work at now, and if they need whatever it is that you are. They will never call you again!
8: Miscellaneous
8a: Obviously
I’ve used the word “obviously” many times in this tutorial. It’s a great word, it conveys that you have a thorough knowledge of your industry, and this is all common knowledge. It shows you know your stuff without you actually needing to know any of it.
8b: It’s ok to be obnoxious
If you want to be obnoxious, and the type of boss nobody would want, feel free. It’s not something you need to do. But if you want to make it so they don’t want the position after they talk to you, that’s fine.
If you do this however, it’s important you don’t mention race, sex, or any other federally protected status. People can and will file a complaint on your “organization” if you do this.
Better would be insulting the customer, or calling your staff idiots or lazy. Mention you cheat on your wife. Its borderline sexual harassment, will paint you as an asshole, but shouldn’t cause them to actually file a complaint about it.
8c: Have a random hobby
Prepare some general random personal information. If you can work in offhand your love of goldfish, or the best camera for taking pictures of birds, etc. it helps to flesh you out as a real person.
9: Conclusion
I hope you have found this tutorial helpful. Social engineering is an incredibly useful tool to have available. If you do it right, it will make everything else you do much easier and safer.
Just remember, preparation is the most important thing. This sort of operation will be absolutely dependent on it.
A fail attempt isn’t just a waste of time; it’s a notice that you are attempting something. Do not take chances! AND PRACTICE!
The best way to find information on a business’s security procedures is to ask! However, that information is obviously going to be closely guarded, so you have to have the right approach. Anybody with any type of relevant information is going to be guarded and suspicious with it.
The best method I have found is to stage an interview. You create a job opportunity that matches the type of information you are looking for. However, again, these people are paid to be suspicious, so you need to set it up properly if you want your fishing attempt to be successful.
Step 1: Creating the perfect job
The first step is to create the bait, the perfect job for somebody in the industry you need to learn about. This is going to vary greatly depending on the type of information you are looking for. You need to ask yourself about the types of employees that will have access to this information.
If you are looking for basic information on security procedures, you can go for general low level employees. This is as simple as searching Monster.com or CareerBuilder.com and finding a job that is similar to what you are looking for. I would recommend finding a couple. Pick phrases from each to create a job listing.
Again, to avoid raising suspicion, don’t make it obvious what you are trying to find out. I would recommend adding qualifications that are general and obvious. I always include bullet points such as “providing outstanding customer service,” “team driven performer,” “extremely detail oriented,” and other general corporate management speak. This is mainly filler.
Obviously, the most important thing is the requirement that they have worked in whatever area you are probing for information. Be Specific! Example: “Must have 1-2 years working in loss prevention for a major electronics store.” You want people that exactly match the information you need. It does no good to be vague here.
Post the job online, or in the paper, and wait for the replies. Due to the nature of the job market, you will get scores of people that respond even if they don’t have what you need. Just delete these resumes – or save them for practice later.
1a: The Executive
Often the information you might need is not readily available from low level employees, and requires a much more nuanced approach. For example, you might need high level information about how a company investigates fraud or internal accounting procedures. This information is very closely held, and the people that hold it are very suspicious types.
These people will always do their homework before talking to anybody, so it’s imperative you do yours!
The easiest way is to create the listing for an existing company. You can pull their information online, and point to their website. However, I would not recommend this. Too many things can go wrong. The company can find the job listing, the target might have contacts in the company, might call the number listed on the site instead of the number you gave them, etc.
I would recommend creating a new company. Pick a name that is fairly generic, but not overly so. A great way to do this is by referencing a geographic feature. EX: “Lakeland *Name of industry.” Those types of businesses are a dime a dozen, and won’t stand out.
At this level you will have to have a website. I would recommend looking at other companies in the industry, and find the one that has the least amount of information on the site. Mimic – but don’t copy – the site. You want it to look professional. I would strongly recommend hiring a web designer for this if you aren’t an expert in web design. ANYTHING that stands out can ruin the operation.
The might check to see how long the domain has been registered, so include “Welcome to our new home on the web” on the homepage, so there is an explanation there if they do check.
They will probably look for your address. I do a web search for industrial or business parks in the target area. Look for someplace with lots of corporate clients, and use that as the address. Don’t include a building or suite number.
The people can be difficult to reach with your job listing, so I would recommend looking for a headhunter. These people are extremely effective at pinpointing the exact person you are looking for. They also get paid a percentage of the salary if you make an offer, so they are essentially free.
---------- Сообщение добавлено в 01:26 AM ---------- Предыдущее сообщение размещено в 01:25 AM ----------
1b: Don’t be too good to be true
Don’t fall into the trap of making the job seem too good to be true. Include salary information that is actually in line with the position. Do research on this on career websites. A good way to make the position seem legitimate is to make the salary incredibly specific. EX: $14.26 an hour or $52,328 a year, etc.
There is a fine line to straddle here, as you need the position to be attractive enough that they certainly want it, but not unrealistically so.
Also remember the motivations of your target. If you paint a picture on how this job will help their professional development, they are more likely to bite.
Step 2: Create a plausible scenario
This is a very important step. A failed attempt to gain information can be disastrous; as they will know they have an impending attack, and tighten/change security procedures.
The trickiest part is that your target will really know what they are talking about, and some of the important you are looking for is considered common knowledge in the industry, and not knowing it is a red flag.
You need to come up with a plausible story in advance on why you do not know this information, and why you are asking for it.
2a: Diffusion of responsibility
I’ve found the best way to approach this is by setting up a scenario with shared responsibility.
In Corporate America, many organizations use what is called a “matrix organizational structure.” The defining characteristic here is that each person has two bosses – one in a functional team, and one that is role specific. For example, say you have a marketing team. The team will have a team leader that is responsible for the day to day operations. If you are a web designer on that team, you would have another boss that is responsible for overseeing the web operations for the company. You would report to him on all matters relating to the web.
When you are creating your scenario, use this to your advantage and position yourself as somebody with a role that is related to the position, but not an expert in the field.
For example: if you are looking for a “security manager,” you can position yourself as the head of physical operations. You would responsible for physically implementing the measures, installing cameras, etc., but you would be able to plausibly explain why you aren’t an expert in security procedures. Another good one is “VP for Strategy,” as nobody really knows what that means.
Another good example: if you are looking for an “accounting manager,” positioning yourself as the head of sales or marketing is good. You don’t have to have any experience in accounting, but it would be logical that they would still report to you in some areas, as you would be responsible for customer service and ensuring the clients are taken care of. Thus, the head of accounting would report to you in all service related matters.
You establish at the beginning of the interview your position relative to the one you are interviewing. Then if they ask you something you can’t answer, tell them that you are not the person that *if* they advance in the hiring process the next step would be to interview with the position that would be closest related to what they would actually be doing, and that they are the ones that will go over the day to day operations side of things.
If you want to explain why you are contacting them first – not really needed unless you are going after a really big fish – paint a scenario where you are looking for a new “accounting manager” because the last one drove away a big client. Your interest is making sure they have the customer service skills for example, before you move on the actually qualifications for the position.
---------- Сообщение добавлено в 01:35 AM ---------- Предыдущее сообщение размещено в 01:26 AM ----------
Step 3: Preparing for the interview
You need to create a script before you begin – DO NOT ATTEMPT TO WING IT!
You should plan for the interview lasting 45 minutes to an hour. Anything less than that will raise red flags, and that is appropriate time for a legitimate first interview of this type.
3a: Be in the right mindset
You need to be in the right mindset. Don’t make the position seem too easy, like they already have the job. You want them to think that it’s going to be a long, arduous process – because it normally is for real jobs.
This is the part where most people fall apart. The bottom line is that in the today’s employment crisis, companies have never had more applicants, and have never been able to be more selective and picky.
Make it clear this isn’t their only interview – that it’s a first interview, or even better, a screening interview to determine who you will interview for the position.
You will want to do this over the phone, so explain that there will be an in person interview at another date – or that you will fly them to your headquarters for it.
The most important thing here is that you don’t appear defensive – or worse apologetic – about it. Don’t overly explain, you want to mention it in a detached, offhand way.
This means you don’t want to say all of it in the beginning. A good way to convey the information is to start a question by mentioning it. EX: “Obviously if we invite you to a formal interview at our headquarters we’ll go over this in much more depth, but can you briefly tell me…” Another good one: “Obviously the *other manager* will ask you a lot more about this, but can you tell me…”
3b: Set the stage
People want to know what to expect, and if you don’t tell them, they will create their own expectations, or worse, ask you about them.
This goes back to the previous point, so remember your mindset. You are a successful executive, who has ruthlessly worked to get to where you are, and you have hundreds of people applying for this position, and you will decide whether the lowly mortal you are talking to is worthy. You are a puppet master, they are the puppet. If they want this job, they have to please you and do everything you say.
Since you are representing a corporate job, you should act like it. This means if you need to send an email, make sure it comes from a legitimate domain – not GMAIL! Include a signature. Corporate signatures are very elaborate, have addresses, websites, fax, and often multiple numbers, one for you directly – a prepaid cell – and one for the general corporate number – an answering service.
Don’t forget to include the standard legal disclaimer at the bottom: “This message is confidential. If you have received this message in error, immediately delete it from your email and contact the sender immediately.
Another popular corporate email element is the: “Please consider the environment and do not print this email unless it is absolutely needed.” Include a clipart of a recycling logo or a tree or something.
3c: Opening the Interview
Corporate hiring is a convoluted process where everything is run by lawyers. Its alien to people that don’t have experience with it, but is out of place to not have it for people that work in the corporate system.
I always start by going through some “boilerplate” legalese. Be off hand about it, after all it’s the millionth time you’ve gone through it. Start by “I’m sure you know this, but…”
I start by stating the company is EEOC (Equal Employment Opportunity Commission) compliant, and that they should not *disclose* - always use that word – any protected information. By law, companies are not allowed to consider many things when hiring. These include: Ethnicity, Age, Disabilities, Sexual Orientation, Family Status, or Religion. I go through the list and ask if they understand.
Next I tell them that I will pause during the interview while writing information. They should not take my silence to mean that I am necessarily looking for more information. It’s pretty obvious, but it’s a standard disclaimer made at the top of every interview.
Finally, I open by telling them that all applicants will be treated equally during the interview, and that means we are asking the same questions of everybody. It’s a somewhat standard disclaimer, but it’s important because you can also say that you have to provide the same information to everybody, so at this stage of the process you are limited in the information you can provide, and can only answer in general terms. This plants the seed for later if they ask you a question you don’t know the answer to. You can say that you can’t answer that because you have to keep the interviews consistent *at this stage.*
3d: The “About Us” section
This will be different depending on the type of information you are looking for, and the level of the person in the organization. If you are going for a low level employee, then you won’t need a convincing backstory. You can just tell them a little – no more than 3-4 sentences about your organization, and then go right into your questions – DO NOT GIVE THEM TIME TO ASK YOU ANYTHING HERE, UNLESS YOU HAVE A REALLY GOOD BACKSTORY!
For higher level positions, it would be common to ask what they know about your company. Obviously use discretion here, and make sure you have good backstory. If you have a good website they will probably use information on that.
However, be warned that high level people will do an unbelievable amount of research. They will search for information in business directories – if you can get yourself in one, you should, just list your company as privately held, and don’t provide any more data. They will look for information on revenue, etc. If you are going after a big fish and really need this, make sure its consistent and plausible. Look at what other companies are doing, etc.
Again, the goal here is to get through it as quickly as possible. If you don’t have good backstory, you can use the standby that you “of course” are going to discuss it in much more detail at a later stage.
3e: Diffuse Suspicion
If you start off asking questions about their security systems, they are doing to be on the defensive and suspicions will be raised. Never start off by asking what you really want to know. Instead start with generic interview questions. Make sure the questions are logical for somebody in your position.
For example: if you are positioning yourself as a marketing or sales guy, ask questions about how they view customer service, deal with difficult clients, etc.
A great question to start with is “Can you tell me a little about yourself?” Keep the questions open ended, the more they talk, the less questions you need to ask, and there are fewer opportunities for you to slip up.
I also use scenario questions here, where I’ll describe a situation, and ask how they will deal with it. This is important because later you will want to use scenario questions to find out how they will respond to whatever it is you are planning, and you want them used to it.
A generic one that works for almost all positions is asking about how they would deal with an employee that does his job well, but is always late. Whenever you ask them about it, they always have a legitimate sounding excuse. How would they deal with it? At what point would they begin an official disciplinary action?
You don’t need to get carried away here, just ask enough to avoid suspicion. You will also want to do something similar after you get the information you are looking for. Never begin or end the call by asking sensitive questions.
3f: Getting the information you want
This is obviously the most important part of the call. This is why you are doing what you are doing. It’s also where the wheels can come off your plan if you are not careful.
You want to avoid asking about their security directly. If you ask them point blank, they almost certainly won’t tell you, and their suspicions will be raised greatly. It will be almost impossible to succeed at that point.
Obviously the questions you ask will vary greatly depending on the organization, industry, and level of the person you are talking to. Still, there are some basic things you will want to do in every situation.
A great way to do this is to ask hypotheticals. If you are looking for a new security manager, ask them how they run a department. They will tell you in general terms, but it is almost always how their current organization does it.
Another great one: “What is one thing you would change in your current position if you were able.” They might answer this by talking about a general company related change – employee retention for example – but they often mention a security flaw that you can use later.
I’m a fan of: “Obviously, no organization can be 100% secure, as concessions have to be made in order to do business. How do you balance security concerns with general business operations?” What you are looking for here is how to exploit cracks in their system. For example, the sales team in an organization is usually very aggressive. If they had their way, they would sell to anybody. Order processing on the other hand would prefer to sell only to people they have extensive relationships with, so they don’t get caught holding a bill for something later. Each organization has to come to an equilibrium between the two. Knowing where that is can help you create an approach to use later on.
One that is almost always useful: “What do you do when you suspect fraudulent activity? What are your legal requirements, and how do you handle the situation?” Again, you are asking the question in general terms, but they normally answer it specifically. If they don’t, feel free to ask follow-ups but still keep it general. EX: “Can you tell me about a specific situation?” This is somewhat risky, but within the acceptable range.
Scenario questions are great here. Create a scenario that is exactly what you are planning to do, and ask how they respond. Make it detailed, but make sure you keep it general. You are asking what *they* would do, not what their organization *does.*
Another one: “What do you do if you suspect somebody in the organization is acting illegally or fraudulently? What do you look for in employees when investigating?” This will generally tell you who to approach and what the responsibilities are.
Once you have the information you want, remember to ask more filler questions.
3g: Ending the interview
You need to end the interview by giving them an idea what to expect in the future. Of course, nothing will happen, but you need to paint them a picture.
I tell them that I am finishing the first round of interviews this week, and if they are selected for a second interview, the other manager will contact them next week to set up a time. Ask if there are any special considerations, being out of town, etc.
You will also need to ask if they have any questions. Not doing so is a very big red flag. Obviously this part is tricky, and covered more in a later section. To limit the potential damage, start with the disclaimer that you “obviously I am limited in the amount of information I can give you since we need to make sure we give everybody the same information at this stage.”
4: Practice, Practice, Practice, and then Practice more
The key to a successful social engineering operation is preparation. When you get your target on the phone, your body will dump a gallon of adrenaline in your system. Be prepared!
Rehearse the script several times. You need to feel comfortable saying everything. If you are nervous, your target *will* pick up on it!
Feel free to add in some random events. EX: If your phone supports the feature, put them on hold for 3 minutes, say it’s a call you absolutely have to take, but it should only be a minute. Come back and say something like “Sorry, *sigh* we have a situation here.” That’s it, don’t elaborate, don’t explain, remember, your time is more important than hers!
Also remember to pause after they answer each question. You are taking notes! Even for the filler questions you don’t need, still pause! Go for 30-45 seconds after each question!
For higher level targets, call some of the crap resumes you will get. They don’t have any valuable information, but it’s important that you get experience talking to a real person.
4a: Things will go wrong, expect it!
The saying that no plan can survive the battlefield is apt for these situations. No matter how careful you plan, something will go wrong!
There is no way to know what will happen and no way to plan for every contingency. That is why it’s so important to practice. If you are trying to respond to the unexpected, you really have to have the rest of it down.
5: Putting all the pieces together
Now that you have your script, and you’ve practiced, its time to put your plan in motion.
5a: Be fluent in the language of your target!
You either need to be fluent in the language – as in little accent – or have a GREAT backstory. Obviously not doing so will be a major red flag.
If you are not fluent, there are still things you can do depending on the level of the target. For low level targets, place an ad online, saying you are a headhunter or employment agency. You need somebody to help screen potential applicants. You’ve prepared a script that they are going to use for each one, and record the answers.
This will only work for low level targets, as the higher ones would not submit to such a “screening” from a random low level worker!
For high targets, you can use headhunters. Give them a list of questions you want them to ask, and tell them they can only submit 3 candidates. This is a common instruction, as they have incentive to just flood you with candidates in the hopes you will hire one of theirs and get a commission.
VERY IMPORTANT: IF YOU HIRE ANYBODY TO DO THIS, ACTUALLY PAY THEM!! A call from a stiffed worker to your target after the interview will ruin everything!
5b: Schedule the interview
This is best done via email. Follow the above instructions, and make it look legitimate.
Again be aware of the level of the target. EX: if you are looking for low level targets i.e. loss prevention workers for a chain, then include something about making sure they are prepared when you call. This would be appropriate at this level, but insulting to a high level executive.
5c: Call on time
Make sure you call them when you say you will. A few minutes late is fine, or even desired, if “things got a little hectic.”
5d: Slow Down!
No matter how much you prepare, you will get a massive adrenalin surge, and you will start to talk very, very fast. Resist the urge to do this!
6: When things go wrong
You should expect to have things go wrong. You cannot prepare for every situation. That being said, there are a couple of common situations that you should attempt to plan for.
6a: Questions you can’t answer
Dealing with professionals in the industry, they will likely have questions you can’t answer, and many will likely be specific, so you can’t give general answers. One thing you can do to prepare is always have their resume in front of you. Know what’s in it. It’s sometimes easy to just change that information. EX: If they ask you a question about revenue, and list the revenue generated by their current department on the resume, use that and just change it a bit.
6b: If you can’t answer one question, answer a different one
It’s a political trick, but it really works. If they ask you how much revenue your company generates, respond by talking about how your strong internet marketing team is reaching new customers, and how it’s great by industry standards – and about this exciting new thing you are going to try next year – and how your sales are exploding.
Pretend to misunderstand what they ask. Most of the time, they won’t follow it up. If they do, then you can’t talk about *yet* as you have to be consistent in the interviews.
6c: They will try to impress you
Interview trainers constantly tell us that we need to have a question prepared in advance, something to show you’ve done your homework. These are the hardest. They are impossible to foresee, and usually really detailed since they are trying to show what they know.
The only good thing is that they typically don’t really listen to your response. They just wanted to ask the question to show how analytical they are.
Typical questions might be on how the economy is affecting your industry, who your biggest competitors are, what are the biggest challenges you face, opportunities for growth, etc.
These will be broad industry questions usually, so you can’t credibly claim you can’t discuss it at that point. To prepare for this do a little research on the industry, know who the competitors are so you can name drop. Keep it vague – talk about how you are in a perfect position to capture increase market share in the pending economic “uptick.”
This is also a great opportunity to answer a different question. If you are a marketing manager, then you can answer any question with a marketing related answer, same for web, etc. Remember, you got to where you are by being passionate about your area, so it’s natural for you to answer and question in those terms!
It’s also a great opportunity to…
6d: Have an anecdote prepared
I cannot overstate how useful it is to have an anecdote prepared. This makes you more plausible, and can be used to avoid answering questions.
If they ask a broad industry or company question, respond with a specific event.
EX: “Can you tell me how your company is responding to the economy?”
“Sure. It’s obviously a challenging time. We’ve had great success with internet marketing. We’ve been able to capitalize on…”
Take it from a general question to something specific. They won’t ask a follow up.
6e: I don’t do that!
You’ll get questions about your background, how long you have been in the field, etc. These are questions you really can’t avoid answering if you want to avert suspicion.
A great way to deflect the question is by making it clear that they have the completely wrong idea about what you do. “I’m not that type of _____! *laugh*”
EX: “As a security consultant, do you have a military background?”
“I’m not that type of security consultant! I’m not one of the guys you call if you think Al-Qaeda is going to attack your chemical plant, although I work with plenty of those guys. No, I’m the type of person you bring in if you think one of your employees is selling company information to a competitor.”
You’ve killed two birds with one stone. You’ve deflected the question, without having to explain how you got into the field without that type of background. Also, you’ve discouraged them from asking similar questions because they were so off base. In the above example, you can always use “Well, obviously, most of my work is confidential.”
6f: Know the local area!
This was a mistake I made too often when starting out. I didn’t know anything about the area I was supposedly from.
Always know the weather, look it up online. They ask about that *all the time.* Know where you live, find a listing for a home in the price range of the person you are representing. Know the name of the neighborhood. Also, know if they have any local sports teams – you don’t have to, and probably shouldn’t, pretend to be a fan, but at least know what they are.
ALWAYS KNOW THE TIME ZONE! If you are in a different time zone, get a clock on your computer, or set your watch for the time zone you are supposedly in. I guarantee that if you try to do it in your head when they surprise you with it, you will blank out and it’s a major red flag.
6g: Know nothing about the local area
Alternatively, you could choose to know nothing about the area you are supposedly hiring for, but its only applicable for certain types of positions.
EX: You are hiring a security manager for a large electronics store that is opening soon. They might ask you something about the store’s location, foot traffic, etc. They will likely be well versed in this information, so you can’t wing it.
In a situation like that, I might go with something like “Oh, I have no idea. To be honest with you, I’ve never set foot in *city name.* Obviously I’ve seen the location on a map, but I don’t know the city at all, so I can’t really give you a frame of reference. Obviously, as the director of marketing, I’m not involved in the day to day operations. I would of course be there for the store opening, but that’s probably the only time we would physically meet. We’d be communicating primarily through a weekly conference call. If you talk to the regional manager, he’d be the one to talk to you about that next week.”
Deflect and use the division of responsibility you set up earlier to explain why you can’t answer.
6h: They start to get suspicious
You will probably make a mistake at some point. Or they might get suspicious when you are asking sensitive questions.
The best way to tell is to listen for changes in their voice. If they want the job, they are very eager to please. You can hear it in their voice. They talk fast, and have lots of adrenaline in their system.
When they get suspicious, their voice will change. It will lose the eagerness, and they will talk slower, choosing their words more carefully.
To deal with this, you need to remember your mindset. You are a legitimate company, you are an important part of it, why would somebody not want to work here? If they aren’t interested, you have a hundred more that are.
If you think they are getting suspicious, don’t try to address the situation directly. Instead, question their motivation.
Try something like: “I might be reading too much into this, but I am sensing a little ambivalence about the position.” Don’t make it a question.
Make the assumption that they are not suspicious; they might not really want the job. If they don’t want to talk to you, this gives them an out. They can say they don’t think it’s right for them, not ready to make a change, etc. This should prevent them from realizing you are fishing.
If they aren’t ready to do that, then they will have to respond by selling themselves on the position. That it’d be a great opportunity, etc.
I would then toss a softball question in before returning to what I really wanted to get at.
6i: Are you on Facebook/LinkedIn?
This is becoming an increasingly popular question as social networking has become a staple of corporate communication strategy. If they are tech savvy, they probably already tried to look you up on these sites to find out who they are dealing with. A proactive way to deal with this would be creating a few accounts, filling in only basic information, and setting everything else to Private. They can’t find out anything, but this is pretty common.
If you are representing a large organization, this is a bigger problem. Even if your company does not have a presence on these sites, your employees would, and list you as their employer.
If you need a large number of employees, or if you are supposed to be a web based company, you need to represent it on these sites. The easiest way to accomplish this would be to hire an internet marketing company to set up a ton (approx. 200) of accounts. They will do this cheaply, and link them together.
If they ask for your personal information, tell them you do not give that out.
7: After the interview
If you are pursuing a high level target, it’s unlikely they will have an interview and never hear from you again.
Have an exit strategy.
7a: End the hiring process
If you are in the area you claim to be in, get a generic letter stating that you are unfortunately unable to offer them a position at this time. Make sure it looks nice, and print the logo on the letter AND THE ENVELOPE!
7b: Call them for a follow up
If that isn’t an option, you can call back and ask a follow up question about something on their resume. Something like: “I’m sorry I should have asked you this when we spoke previously, but I noticed you didn’t mention what type of computer system you use to do _____. Do you have any experience using *some random system.* Whatever their answer tell them thanks. You don’t need to respond again. It shows you were considering them, and have all the information you need. They will figure it out on their own that they didn’t get it, and you’ve planted the seed that they didn’t get it because they lacked whatever it is you asked them.
7c: If they call you after the interview
They might call you to “thank you” for the opportunity, or some such nonsense. If so, they are fishing for information on their chances. You can either thank them for their time, or tell them they didn’t get it.
If they ask for feedback, etc. tell them that corporate policy does not allow you to answer any questions. Tell them you are sorry.
7d: Invent a scenario
If they contact you, or you contact them, have a story ready.
EX: It could be that the position was cancelled due to a hiring freeze. Apparently the company has been taking massive losses on a side project, and they kept it secret until now. Don’t say it, but try to convey you are very worried.
A killing blow would be for you to ask about the company they work at now, and if they need whatever it is that you are. They will never call you again!
8: Miscellaneous
8a: Obviously
I’ve used the word “obviously” many times in this tutorial. It’s a great word, it conveys that you have a thorough knowledge of your industry, and this is all common knowledge. It shows you know your stuff without you actually needing to know any of it.
8b: It’s ok to be obnoxious
If you want to be obnoxious, and the type of boss nobody would want, feel free. It’s not something you need to do. But if you want to make it so they don’t want the position after they talk to you, that’s fine.
If you do this however, it’s important you don’t mention race, sex, or any other federally protected status. People can and will file a complaint on your “organization” if you do this.
Better would be insulting the customer, or calling your staff idiots or lazy. Mention you cheat on your wife. Its borderline sexual harassment, will paint you as an asshole, but shouldn’t cause them to actually file a complaint about it.
8c: Have a random hobby
Prepare some general random personal information. If you can work in offhand your love of goldfish, or the best camera for taking pictures of birds, etc. it helps to flesh you out as a real person.
9: Conclusion
I hope you have found this tutorial helpful. Social engineering is an incredibly useful tool to have available. If you do it right, it will make everything else you do much easier and safer.
Just remember, preparation is the most important thing. This sort of operation will be absolutely dependent on it.
A fail attempt isn’t just a waste of time; it’s a notice that you are attempting something. Do not take chances! AND PRACTICE!
