Notes on Human Hacking
Human Hacking: Win friends, influence people, and leave them better off for having met you by Christopher Hadnagy, Seth Schulman
Original notes here.
Read until the end to get a bonus. Enjoy reading.
The authors practice human hacking, tasked with breaching supposedly impregnable facilities and networks before the bad guys do, so that their security can be tested and strengthened. The author wrote the first book devoted to this subject, Social Engineering: The Art of Human Hacking, which sold more than 100,000 copies.
This book explores a kind of psychological martial art that can get people to do almost anything we want them to do, while making them feel good about it.
Example: The author’s wife chats with a flight attendant for a while, saying that she would love to buy the same scarf as hers, and complimenting how perfectly her makeup matches the scarf. The flight attendant is delighted; sensing an opportunity, the author asks about the price of an upgrade, and she moves their family straight to first class.
The author describes the other person as having been “sweet-talked”: a mini-storm of happiness and pleasure erupts inside her, and at that moment, almost any request that is not blatantly strange is likely to be granted.
When you first approach someone, there are four major questions in their mind: Who are you; what do you want; how long will this conversation take; are you a threat?
The basic principle is to understand people, use empathy well, influence them, and thereby get what you want.
Hack Yourself First
Know yourself and know your opponent, and you will be victorious in every battle. Understanding each other’s communication style is therefore crucial.
In 2018, scammers persuaded the treasurer of the City of Ottawa to wire $100,000 to a fake municipal supplier. The scammer impersonated her boss in an email, telling her to handle it personally and not discuss it with colleagues. The message was tailored to the treasurer’s communication style, which is why the scam worked repeatedly.
Using the classic psychological profiling tool DISC, you can identify your own communication style. There are four types: Dominance, Influence, Steadiness, and Conscientiousness.
The author gives multiple examples of how learning to recognize communication styles has changed people’s lives and improved their relationships.
Character Setup
To accomplish a task, you need to become the person you need to be.
Example: To get a job despite having zero experience, the author adopts the persona of a confident but not arrogant job applicant. He shakes the interviewer’s hand and says that he is his new chef. When asked about his résumé and credentials, he replies, “I don’t need them. My food is my résumé.”
Example: To break into a heavily secured warehouse, the author poses as a representative of a trash compactor company. When the guard asks why he is there, he says that there is a compactor with a motor inside and he needs to obtain its serial number before he can tell them whether they want it picked up. If the guard has any concerns, he can look up the serial number for him; otherwise, he will only need five minutes to go inside and check it himself. At the next checkpoint, he cannot produce identification, so he deliberately looks flustered and asks whether he can use a company ID badge instead, which he is allowed to do.
The author gives numerous examples of crimes that succeeded through the use of fabricated personas, including those of the legendary con man Victor Lustig.
In everyday life, pretexting is not the same as lying: achieving your goal requires embracing multiple roles, including the strict and disciplined father, the compassionate partner, and the concerned best friend.
Before using a persona, prepare by determining the problem you need to solve, the outcome you want, what emotions you expect to evoke during the conversation, and defining the pretext and persona, including where, when, and how it will be presented.
Too much of anything is bad. The story does not need to be too perfect or contain too many unnecessary details.
Example: You suspect your teenage daughter has broken her promise and is still seeing a bad boy. If you make her angry, frightened, or ashamed, she will not tell the truth. Instead, you need to play the role of a loving father and speak to her gently and empathetically.
A persona must remain flexible. If you discover that your daughter is preparing to run away with the boy, you may need to switch immediately to the role of a strict father.
In many other situations, however, maintaining the persona is more important. Example: Before the author was about to punish his daughter physically, she asked him to hold her for one minute and tell him how sorry she was. The author asked, “Do you think I’m going to let you off just because you do this?” She said no, because she knew he always meant what he said, and she genuinely felt sorry. After one minute, she said she was ready. In the end, the author abandoned the punishment and never physically punished her again.
Leverage Your Strengths
The author tried several ways to sneak into an office building but failed. Then he saw a group of employees smoking outside. He pretended to be someone who had just quit smoking and could not resist coming over to smell the smoke, chatted with them for a few minutes, and then simply followed them into the building without anyone stopping him.
The example shows how much more successful you become when you have something in common with someone. Oxytocin immediately creates a sense of trust and connection.
Example: A 25-year-old federal agent had to take over from a 60-year-old agent a source in his eighties who spoke Russian. Knowing that putting on airs would get him nowhere, he lowered himself accordingly, making it clear that he respected the older man and succeeded.
Six steps: identify the target, quickly profile them (tastes, socioeconomic background, beliefs, race, gender), create a route to common ground, choose, execute, evaluate.
Eight techniques: set a time limit (“Give me two minutes…”); adjust your speaking speed; ask for empathy and assistance (“Could you help me out?”); hide the self (conceal your need for control and do not try to change the other person’s mind); compliment the other person; self-disclose; give first (the author’s companion let a tired flight attendant rest for a while and was eventually given a free upgrade when he asked); manage expectations and do not rush ahead.
Use props effectively: students who were told the same jacket was one a professor wore in the lab performed better than those who were not given that information.
Using these strategies, even someone as experienced as the author can be hacked: a fellow hacker sent him the whisky he had mentioned on a podcast as his favorite. The author invited him to dinner, and when the man asked for five additional seats, that request was granted as well.
Those Who Win Hearts Gain Allies
Example: The author wanted to get into a manager’s office and heard the manager arguing on the phone. He entered the reception area and saw the receptionist playing a game, so he kindly warned her that the manager was in a terrible mood. Sure enough, the manager angrily called her over. When she returned, the author told her that she had originally been going to help him open the door because he was about to be late for a meeting with Human Resources. She gave him a look that said, “I know that’s not true,” but opened the door for him anyway. She later recalled that she had already been scolded three times while playing the game, and the author had saved her from being scolded a fourth time, which made her especially grateful and willing to break an important security protocol.
The example shows that even without a persona, you can influence people through the principle of reciprocity. Sometimes your goal can simply be to provide one of those little moments of happiness that everyone likes, so that the other person likes you.
According to Influence, besides “reciprocity,” there are the following:
“Concessions”: Example: A fundraising woman began by saying that most of the author’s neighbors had donated $200. The author finally gave $40, yet still felt that he had gotten a bargain. His son always refused breakfast, so one day the author told him he could choose among eggs, cereal, or oatmeal. He made a choice and still felt that he was in control.
“Scarcity”: Offer only a few possible meeting times so that people feel you are extremely busy.
“Consistency”: Starbucks’ customer loyalty rewards program; praise your child’s artwork and put it on the wall; ask your partner to tell you how they spend each day, actively listen, and reward them, thereby building a habit.
“Social Proof”: A mobile game company used shills to persuade trial users to willingly hand over personal information. When the author broke into another building, simply mentioning another guard’s name got him through.
“Authority”: The Milgram obedience experiment demonstrated that if the person giving the orders possessed authority, people could be induced to do unethical things. Between January and May 2019, the Federal Trade Commission received 65,000 reports of scammers impersonating Social Security Administration representatives. At a live performance, the lead singer asked everyone to help students complete a questionnaire requiring personal information, and dozens of people in the audience followed along.
“Liking”: Sometimes, however, failure may not be your fault.
Exercise: Get an important person to eat something they believe they would never eat in their life, while also making them feel that their life has become better because they know you.
Do not overuse these techniques, or the other person may sense that something is off. Once, the author pretended to be a pest-control worker entering a building. The employee initially let him in and turned away, but he kept talking at length about how spiders would soon swarm out, immediately making the employee suspicious.
Even perfect execution is no guarantee of success. The author’s team once encountered a security guard who still refused them after they had worn the proper clothing (consistency), told him they had already visited several other buildings and been allowed in (social proof), and even successfully impersonated the security supervisor on the phone telling him that they could enter (authority). The guard examined their cards carefully and finally refused them.
The Lasso of Truth
Wonder Woman throws out the Lasso of Truth to bind villains and make them tell the truth. Master the art of elicitation, and it is as if you had such a lasso.
Example: The author was assigned to find out about recently installed RFID security technology at a cocktail party held by a target company. He told an employee that his own company had recently installed something similar, involving a bunch of strange cards, and that he would rather use a key. His new drinking companion immediately volunteered the company’s secrets, including where the system had been installed and its main vulnerabilities, laying everything out in full.
Example: Teaching people around you to reveal their bank-card PINs. At a restaurant, the author discussed the news with a friend and said that 68% of people use their birthdays as their bank-card PINs. The two of them then volunteered their PINs one after another, and diners around them began striking up conversations and volunteering their own PINs.
Example: Getting a beautiful woman to reveal a pile of personal information: “Excuse me, could I ask you a question for one minute?” “I’m here on a business trip, and next week is my wedding anniversary. My wife loves cowboy boots, but I know absolutely nothing about them. You look great in yours—could you tell me where you bought them? If it’s nearby, I’ll go get her a pair.” The woman’s eyes lit up as she said that she actually worked at that store. She then asked where he was from and told him to mention that Samantha had sent him when he spoke to the staff. The author gave his own name and said he wanted to tell his wife who had helped him so much, asked for her last name, and succeeded. The woman even let him take a photo of the boots to send to his wife.
Example: Getting someone to reveal how many children they want: “Growing up, I had a neighbor who had four children. I don’t know how they managed it, but personally I think that’s too many.”
Even when you can ask directly, it is still wise to use the Lasso of Truth. For example, if you want to sell software to a company with more than 2,000 employees, rather than asking a direct question and making the conversation uninteresting, casually ask the person about the type of company they work for.
Seven steps: determine the information you need, observe the target, structure an inviting question and an exit strategy, ask more questions to move the conversation forward, listen carefully, remember the details (many trainees successfully extract intelligence but cannot remember it), and end the conversation in a friendly and natural way.
Practice in everyday life: find out the full name of a regular at a café; what your child was doing while studying at home; how your partner views the future of the relationship; how your boss evaluates your performance; whether your best customer plans to increase or reduce spending next year; what happened at your child’s party.
Five additional techniques for attracting attention and getting people to reveal information:
One, use a “Presumptive Statement” (stating a false fact to elicit a correction): “You’re eating strawberries, so that must mean your birthday is in February.” “No, July.” “July 4th?” “No, the 21st.”
Two, use “Bracketing” (providing a high and low range): To extract an exact figure, offer a range first. A skilled car buyer might ask the salesperson, “If I wanted to buy the car and get a discount, could my purchase price be $5,000 to $10,000 below the sticker price?”
Three, help the other person fill in the blanks: To get into a building, the author set a colleague’s contact name in his phone to that of the company’s notoriously infamous vice president. When stopped by security, he simply showed the guard an urgent message from that colleague.
Four, pretend to be skeptical: “You write books? Really?”
Five, state a fact: Just as with extracting diners’ bank-card PINs in a restaurant.
Exercise: Get strangers to tell you a secret they have never told anyone else. During a training course, a young man and a young woman made their way around the casino tables in a hotel, befriending a couple in their sixties and chatting with them about life, family, and personal details. After 20 minutes, the male trainee said, “I’ve been wandering around here all night trying to make friends with strangers. I’ve found that the best way is just to throw out a really deep question, something like, ‘Can you tell me a secret you’ve never told anyone else?’ So I’d like to know what you’d say.” The elderly couple looked at each other with tears in their eyes and said that their son had become severely depressed and died by suicide a year earlier. Two weeks ago, they had made a pact: the husband would kill his wife and then shoot himself, but he could not go through with it. They decided instead to devote the rest of their lives to helping young people struggling with depression, and this was their last big night out in Las Vegas.
Avoid Manipulation
You need to understand how manipulators operate before you can protect yourself from them.
Example: An insurance salesman who trained the author taught him to shamelessly lie to farmers so they would buy more insurance than they actually needed, saying that one farmer had been underinsured by more than $1 million and, after an accident, his whole family was left without support; his children had to drop out of school, with some doing hard labor and others becoming addicted to drugs.
In everyday life, ordinary people also use a little manipulation, such as implying how bad the consequences will be if you do not do what they want and how wonderful things will be if you do. But unless someone’s life is in immediate danger, sincerely exercising influence rather than imposing your will can improve relationships and is often more effective.
Manipulation creates pressure, anxiety, or discomfort, causing people to make decisions against their own best interests. The author calls this the susceptibility principle. Examples include villa rental ads that seem too good to be true and charity advertisements that play heavily on pity. By contrast, showing creativity and humor means using influence rather than manipulating emotions, and can spark much more genuine sympathy.
The four main pathways of the susceptibility principle are:
Environmental control: In Ellen Langer’s experiment, a group of men in their seventies were placed in a converted monastery. Their clothing, entertainment, furniture, and lifestyle were restored to those of more than 20 years earlier, and they were treated as though they were young men. After five days, their physical condition had improved significantly; even their posture and eyesight appeared to have reversed with age. The design of a casino environment is another form of psychological manipulation.
Forced reevaluation: Research shows that uncertainty produces a comparable level of stress. A company merely floating the possibility of layoffs can make employees work twice as hard; a criminal may claim to have kidnapped your daughter, making your future uncertain enough that you are willing to pay to make the threat disappear.
Powerlessness: Taking away someone’s sense of control creates unbearable fear and distress, leading to rash decisions. Research shows that both animals and humans can experience learned helplessness.
Punishment: There are many forms: locking the computer unless money is paid, threatening to release nude photos, or even making someone feel guilty. The author’s teammate once called a bank while pretending to speak on behalf of his “boss in labor.” The boss was supposedly in the delivery room and had said that if he did not get the information, there would be no pay. The assistant begged the customer-service representative, who eventually gave in.
To obtain employee information from a client company, the author and a colleague posed as HR employees in the staff cafeteria. The author shouted at his colleague that if the forms were not completed, he would not have a job tomorrow, attracting attention. The colleague even defended him, and eventually someone stepped in and got everyone in the cafeteria to fill out forms for employee health insurance. But the tactic was so dark that the company never worked with him again, forcing him to reflect on the boundary between manipulation and influence.
Body Language
The author once claimed that he had nearly been in a car accident and spilled coffee on his résumé. Wearing his emotions plainly on his face, he begged the receptionist to let him open his USB drive and reprint his résumé, thereby getting her to violate the company’s security rule forbidding external USB drives and successfully gaining access to her computer.
Worth reading include Paul Ekman, Telling Lies; Ekman and Wallace Friesen, Unmasking the Face; Matsumoto et al., Nonverbal Communication: Science and Applications (2013); Navarro, What Every BODY Is Saying: An Ex-FBI Agent’s Guide to Speed-Reading People; Navarro, The Dictionary of Body Language: A Field Guide to Human Behavior; Goleman, Emotional Intelligence; Paul Zak, The Moral Molecule: The Source of Love and Prosperity; Cuddy, Presence: Bringing Your Boldest Self to Your Biggest Challenges.
An example of reading body language: the other person’s upper body leans back, their weight rests on their buttocks, and their lower abdomen points toward you. This is ventral fronting, indicating positive feelings, comfort, and ease, much like a dog exposing its belly.
Experts can identify tiny gestures and facial expressions, but even large, obvious expressions can be extremely difficult to interpret.
Facial expressions can trigger emotions. Research found that people who squint in the sun are more likely to become angry, because people tend to squint when they are angry.
The seven basic emotions are like the three primary colors in painting, as follows:
Anger: Facial muscles tighten, the brows furrow, the lips pull tight, the eyes glare at the target, and the body tenses as well. Human hackers generally avoid provoking it. When dealing with an angry person, it is better to express concern.
Fear: The body freezes, the eyebrows rise, the eyes widen, the mouth hangs open, the lips stretch toward the ears, and people often breathe loudly or take deep breaths; the muscles of the face and neck and the hands tighten. In most situations, it is better for a human hacker not to communicate fear. But if you are genuinely afraid, there is no need to hide it; research shows that people around you can tell anyway.
Surprise: Raised eyebrows and widened eyes make it look similar to fear, but the lips do not stretch toward the ears. Instead, the mouth forms an O, and the jaw appears to drop. Someone who is delighted may burst out laughing, and triggering this emotion can benefit a human hacker.
Disgust: The muscles on both sides of the nose contract; in extreme cases, the brows angle upward and the upper lip curls, originating from the body’s attempt to block the smell that might make it vomit. Deliberately triggering disgust generally only backfires.
Contempt: It contains moral judgment and a sense of superiority, and is the single most important predictor of divorce. One side of the facial muscles contracts, the chin lifts, as though looking at someone through the nostrils; the posture is elevated and domineering. Triggering it produces nothing good.
Sadness: The eyelids droop, the corners of the mouth turn downward, the brow furrows, the shoulders slump, the head lowers, and the posture becomes weak, quiet, and subdued. Triggering it can increase your own advantage and evoke empathy, but extreme displays can make people uncomfortable.
Joy: The corners of the mouth rise into a smile, the cheeks lift toward the temples, wrinkles appear around the eyes, the person stands upright, raises the chin, pushes the chest forward, and the pace, speed, volume, and pitch of speech all increase. People who feel happy are more confident and more empathetic. Get the other person to recall a happy moment. Memories can trigger the emotion.
Practice reading body language: look for people who adopt the belly-exposing posture, observe the expressions of people while they are talking and identify their emotions, and practice sending the seven basic emotional signals 山
Do not always make assumptions; ask. One trainee kept making faces, and the author assumed he was angry. It turned out that he had injured his back and was in considerable pain.
Pay attention to the target’s baseline and to changes that deviate from it.
Being good at understanding people can change lives: the author’s eight-year-old daughter read Paul Ekman’s Emotions Revealed and taught herself the techniques in the book. While riding in a car traveling 65 kilometers per hour, she noticed a woman who was utterly heartbroken and went over to comfort her.
Let the Truth Show
Five major mistakes:
Too direct (“I brought you here because this is your favorite restaurant.”)
Too obvious (“See? I’m an employee. It says so clearly on this ID.”)
Too perfect (Giving too many details about your own persona; imperfection is what gives a story its authenticity.)
Destroying your own persona (Your speech immediately gives away who you really are; you need to be aware of the stereotypes that exist in society.)
Provocative questions (If you want your neighbor to stop letting their dog bark early in the morning, it is better to play the role of a kind neighbor sincerely asking for help.)
Take a step back. Clarifying the objective is extremely important. Do not assume that success once means success will always follow. The author used LinkedIn connection requests to hack into 79% of the employees at one company, but when he used the same tactic at another company, the success rate was only 7%, because the employees there regarded LinkedIn as a website for old people.
The same applies to intimate relationships. Play the role of a caring and considerate partner, let the exhausted other person catch their breath, and then gently guide them into agreeing to clean the bathroom.
One of the author’s trainees found that there were no beds available after transferring his father to another hospital. When negotiating with the doctor, he avoided all five major mistakes and communicated with the doctor by demonstrating the qualities of a professional. He was exceptionally granted permission to receive treatment on the spot.
Planning Framework
The author’s hacking operations require meticulous preparation. Even in everyday conversations, careful design can dramatically increase the chances of success.
One of the author’s employees had recently been performing far below his usual level. The author first identified him as having an Influence communication style, refined the conversation strategy, and framed the discussion as an opportunity to “help me understand how we can improve.” During a review of specific cases, the employee eventually admitted that things were not going well, acknowledged that he needed to change, and offered suggestions.
The conversation strategy consists of the following ten steps
One, map the scope of the conversation: make an overall assessment, conduct a DISC analysis, and understand the other person’s background and personality.
Two, set the goal: understand what you need and what you are willing to pay for it; the objective should be practical and specific.
Three, establish the persona: make it goal-oriented and set an appropriate, credible persona.
Four, imagine the fusion scenario: think about how you will activate the persona and carefully choose the time and place.
Five, apply influence: choose and use the appropriate principle of influence.
Six, eliminate manipulation: is the other person compromising because of fear or guilt?
Seven, enhance body language: used correctly, it can help build rapport quickly.
Eight, check for sincerity: given your own personality, beliefs, and relationship with the other person, can all of the above genuinely come from the heart?
Nine, prepare for contingencies: do not make the plan too simple; consider as many possibilities as you can.
Ten, secure the gains: depending on the situation, you may need to put the outcome in writing.
If all of the above takes more than 15 to 20 minutes, involves repeated revisions over several days, or is planned weeks in advance, you are only just getting started. There is a risk of becoming overly dependent on planning and becoming too contrived.
Sometimes you still need to improvise. Once, the target building unexpectedly had a large number of armed guards, so the author decided on the spot to hire a local person to keep the guards occupied, allowing his team to come and go freely. On another occasion, an assistant refused to let him enter no matter what he said, so he improvised by asking her to sign a written confirmation that she was refusing him entry—and she ended up letting him through.
The key to staying flexible is to keep close watch on your own emotions: try taking a deep breath.
If you need to start over, quickly check whether the relationship is still intact or whether cracks have already appeared. If it is still intact, ask whether you can switch to another persona.
After every failure, the team reviews the plan: Was anyone emotional? Did anyone lose control? Did anyone become sarcastic or cutting? Did the other person fail to understand? Were other people’s needs insufficiently considered? Could the conversation have been handled better? What did you do that made the other person’s life better because they met you? Successes should be reviewed in the same way.
No matter how thorough the plan, becoming better at understanding people and improving your ability to empathize is the true essence of the hacker superpower this book seeks to present.
Besides Influence, Paul Ekman’s books, and Joe Navarro’s What Every BODY is Saying, the author lists the following further reading: Amy Cuddy, Presence; Langer, On Becoming an Artist: Reinventing Yourself Through Mindful Creativity; Zak, The Moral Molecule: The New Science of What Makes Us Good or Evil; Dreeke, It’s Not All About Me: The Top 10 Techniques for Building Quick Rapport with Anyone
Finished reading on Nov 2, 2024
Thank you for reading until the end. This is a bonus infographic just for you.
