Social Engineering: Frames and Frame Control
4 likes1,744 views
The document discusses framing and frame control as fundamental techniques in social engineering. It defines framing as giving meaning to information by highlighting certain aspects and contexts over others. Framing influences emotions and the interpretation of messages. The document outlines sources of frames, linguistic and nonverbal tools for communicating frames, and patterns for reframing topics or aligning different frames. The goal of social engineering through framing is to increase the likelihood that a target will comply with the engineer's goals by controlling the cognitive context of an interaction.
Social Engineering: Frames and Frame Control
- 1. Social Engineering: Frames, Framing, and Frame Control Mike Murr [email protected] http://www.socialexploits.com http://www.twitter.com/SocialExploits
- 2. What This Talk is About • Framing – Constructs used to give meaning to information – Defining the current situation (“here and now”) – Cognitive context • Fundamental to social engineering – Control the frame, control the meaning of an interaction – Messages are dependent on meaning • And consequently emotions • A hacker stole your PII, We lost your PII, Your PII was lost Social Engineering: Framing and Frame Control – © Social Exploits 2010 2
- 3. Social Engineering • Social engineering is persuasion – Goal is to affect behavior – Increase likelihood of compliance – More than pretending to be help desk – Not reconnaissance • This is not mind control – Nothing is 100% effective, always have free will – People can accept or reject frames – Still highly effective though • Ethics (is a relative term) – These are tools – How you use the tools is your decision – Reflection of character – Personal responsibility Social Engineering: Framing and Frame Control – © Social Exploits 2010 3
- 4. Frames • Frames are constructs used to give meaning – Personal interpretation – Highlight certain aspects, ignore others – Each person has their own • Frame constructs (not exhaustive) – Beliefs • “Design” of the frame • Cultural, Biological, Life Experience – Mental models of reality • Help organize thoughts, set expectations • Defines boundaries (what is emphasized and ignored) • Form the “shape” of the frame • A representation / implementation of beliefs Social Engineering: Framing and Frame Control – © Social Exploits 2010 4
- 5. Framing • Framing (to frame, set a frame, etc.) – Asserting a frame – Persuade others to accept our frame over theirs • Metaframe – Focused more on underlying aspects of situation (or beliefs) – Also known as master frames • Reframe – Assert a new frame over an existing frame • People often play frame games – Get others to accept / understand a frame – Can relate to power or influence (controlling meaning) – Natural part of interpersonal communication Social Engineering: Framing and Frame Control – © Social Exploits 2010 5
- 6. Communicating a Frame • 3 major components – Linguistic, paralinguistic, nonverbals • Nonverbals (and paralinguistic) are key – Play a majority role of a message’s influence • Often trusted more than verbal • More difficult to fake – Various tactics to hold attention • What we focus on sets the frame • Strong facial expressions • Varied tone / tempo • Hand gestures / movement (esp. large ones) Social Engineering: Framing and Frame Control – © Social Exploits 2010 6
- 7. Sources for Frames • Useful for identifying elements of influential frames • Cultural – Collectivist vs. individualist – Familiar ideas and concepts • Biological – Primal and evolutionary motivations – Strong emphasis around survival and replication • Mental models – Pay attention to what people say (and how they say it) – Note attributes / properties / characteristics Social Engineering: Framing and Frame Control – © Social Exploits 2010 7
- 8. Linguistic Tools (1) Social Engineering: Framing and Frame Control – © Social Exploits 2010 8 Relating Frames Metaphors • Frames resemble each other (not literally) • A firewall is a security guard at the front door Analogies • Useful for emphasizing similarities • Frames elements are similar • Can be used to suggest agreements in areas not explicitly stated • An IDS is like a “computer burglar alarm” Contrast • Useful for emphasizing differences • Frames do not agree • Can be used as motivation / rationale for new behavior • Unlike an IDS which can only detect, an IPS can block traffic
- 9. Linguistic Tools (2) Social Engineering: Framing and Frame Control – © Social Exploits 2010 9 Framing Content Feeling • Describes frames in terms of emotions • I hate a poorly tuned IDS Stories • Uses a narrative to set the frame • Often has a theme or metaphor basis • Tell a story about how an IDS prevent an incident and saved $$$ Spin • Describes a frame in terms of positive or negative • Similar to emotional valence • An IPS is a great way to detect and respond to incidents Jargon • Describes a frame using familiar terminology • Using terms such as Asset Value, ALE, SLE, ROI, etc.
- 10. Linguistic Tools (3) Social Engineering: Framing and Frame Control – © Social Exploits 2010 10 Framing Structure Argument • Frame in terms of rationale • Supported by evidence • Our anti-virus costs the least, offers the most features Categorizing • Describe frame in terms of included or excluded categories • This isn’t your parent’s anti-virus, it’s enterprise grade Repetition • Emphasize aspects of frame by repeating specific elements • Protect, Protect, Protect, that’s what our anti-virus does for your data Lists • Organize content into easy to remember chunks • Often three elements • We can sum up our anti-virus in three words: Safe, Fast, Reliable
- 11. Useful Frames: Interpersonal Social Engineering: Framing and Frame Control – © Social Exploits 2010 11 Being helpful • You are helping them • Offer help • They are helpful people • Ask them to help you out Avoiding blame • Provides emotional justification for behavior • Can make accepting related frames easier Team members • Working towards a common goal • Can solidify using “us vs. them”
- 12. Useful Frames: “Cialdini 6” Social Engineering: Framing and Frame Control – © Social Exploits 2010 12 •Tend to be influenced by authority positions •Vendor XYZ is the international leader in host-based IDS Authority •We tend to be influenced by those we like •Sales person identifies similar hobbies / interests Liking •Looking to others to determine correct behavior •Government agencies worldwide use our software Social Proof •Value is tied to (lack of) availability •Only available to select enterprise customers Scarcity •Obligation to return what others provide (favors) •Vendor buys lunch Reciprocity •Pressure to remain consistent with prior commitments •You’ve already stated information protection is a top concern Commitment and Consistency
- 13. Useful Frames: General Social Engineering: Framing and Frame Control – © Social Exploits 2010 13 Simplifying • Reduce complexity • Easier to understand Loss Aversion • Loss is a stronger motivator than potential to gain • Depends on relative value Credibility • Increases believability • Emphasis on truth and what is real Certainty • People crave certainty • Provides stability, clarity • Increases trust • Facilitates rapport • Reduces unknown
- 14. Frame Warfare (1) Social Engineering: Framing and Frame Control – © Social Exploits 2010 14 • Understand a person’s interpretation • Doesn’t guarantee acceptance of a frame Acknowledging a frame • Hold an interpretation as true • Leads to persuasion • Implies understanding a frame Accepting a frame • Refuse to accept an interpretation as true • May or may not understand a frame Rejecting (denying) a frame
- 15. Frame Warfare (2) Social Engineering: Framing and Frame Control – © Social Exploits 2010 15 • Merge interpretations together • Accepting one can lead to accepting the other • This is an art Combining frames • Link interpretations together • Frames agree and are related • Traditionally associated w/politics • Useful for transitioning frames • Useful for behavior motivation Aligning frames
- 16. Frame Alignment Patterns Social Engineering: Framing and Frame Control – © Social Exploits 2010 16 Bridging •Frames are similar in basis, different in specifics •Data theft is on the rise, maintain personal freedom, buy our id. product Amplification •Increase focus or emphasis on what is important •Simultaneously decreases emphasis on other points •Provide a safe learning environment for your family, buy our firewall Extension •Increase the “boundaries” of the frame •This anti-virus can help protect your id. by stopping malware Transformation •Use existing elements with a new frame •Change frame by replacing meaning of elements •This “little malware incident” demonstrates people are the cause of problems •They can’t be trusted •Our IPS fixes human problems
- 17. Reframing Patterns (1) Change intent behind behavior • Remove a firewall rule to facilitate a business process Redefine by using similar words • Different meaning / implication • Data theft vs. data loss Change specificity (chunk size) • Increase • Our detection mechanisms alerted us in real time • Decrease • On the whole, this is part of the cost of running a business Social Engineering: Framing and Frame Control – © Social Exploits 2010 17
- 18. Reframing Patterns (2) Change context • Changing scope / size • Only lost information on 1% of our customers • Changing environment • Data was copied from one machine to another • Change role / perspective • We are helping protect our customers by working with law enforcement to help locate, arrest, and convict the suspect Alternating Frames • Switch between frames • Meet unrelated / opposite goals • Blame someone else, and accept responsibility Social Engineering: Framing and Frame Control – © Social Exploits 2010 18
- 19. Building Your Framing Skills Understanding •Reading •Thinking •General learning Observation •Observe and analyze your and others’ frames Priming • Mental preparation • Conscious thought influences unconscious response Infield Work • Assert frames • Assess reactions and changes Reflection • Keep a journal • Look for patterns Social Engineering: Framing and Frame Control – © Social Exploits 2010 19
- 20. Parting Thoughts • Useful beyond just social engineering – Interpersonal communication – Vital component of leadership • “Through framing, we create the realities to which we must then respond” – Fairhurst 2010 Social Engineering: Framing and Frame Control – © Social Exploits 2010 20
- 21. Books (1) • The Power of Framing (Fairhurst) • Introducing NLP (O’Connor) • Sleight of Mouth (Dilts) • Mind-Lines (Hall) • Influence: Science and Practice (Cialdini) Social Engineering: Framing and Frame Control – © Social Exploits 2010 21
- 22. Books (2) Social Engineering: Framing and Frame Control – © Social Exploits 2010 22
- 23. Questions? • Feel free to email me at [email protected] • Blog: www.socialexploits.com • Twitter: twitter.com/SocialExploits • Upcoming conferences – Next conference: SANS London 2010 Social Engineering: Framing and Frame Control – © Social Exploits 2010 23