Principles and Planning

Principles and planning are two of the most crucial aspects of using pretexting as a social engineering tactic. Your level of success depends upon it.

Basic Principles

When using pretexting here are a few principles to follow:

The amount of research you do increases your chance of success
If your pretext involves activities or interests you have you increase success
Plan carefully
Practicing dialects or expressions that will be familiar to your target is essential
Just because the pretext is over the phone does not minimize the research effort
The simpler the pretext the better chance of success
Your pretext should appear spontaneous
Your pretext should seem accurate or have aspects that are not susceptible to verification
You must know the intelligence and type of person you will be contacting
Provide logical conclusion or follow through for the target
Be aware of the local laws

Planning and Using Pretexts

Pretexting is a quick way to obtain information. In fact, federal and local law enforcement, private detectives, reporters, interrogators and many other types of people all use pretexting.

While selecting your pretext it is imperative to consider a few key elements:

Problem. What problem am I trying to solve?
Questions. What questions am I trying to answer?
Information. What information do I seek?
Who. The nature of the person I will be contacting.

A social engineer should only consider using a dialect if they have considerable practice in speaking and acting with that dialect. In addition to having the correct accent, it’s important to be aware of phrases, terms, idioms that are in use in the area you will be pretexting in. When planning for a pretext it is wise to consider not just planning how you will act, what you will say, etc… but planning for what the target will say, how they MAY react. One of our goals in pretexting is to bring the target to logical conclusion, to do that we must anticipate their attitudes and statements as well as be spontaneous enough to lead them down the path we want.

Character Creation

When you’re developing a pretext you are essentially creating a character. The complexity of that character is determined by the planned depth of interaction with people at the target site. A pretext can be as simple as just being friendly to someone during a conversation or as complicated as a full blown fake identity complete with ID’s, public records, and all the trappings of a normal person’s life (social networking pages, blog postings, and other things searchable via the Internet). The process of character development is well documented and practiced by the acting community and many of their techniques could translate easily into developing pretexts.

The following links provide some helpful insight about character development:

Trust Relationships

Some pretexts may not need such thorough attention to detail if they can exploit a trust relationship instead. Mati Aharoni tells a great story of how he was able to convince an employee of a target company to visit his “stamp collection” website under the pretext of having some rare stamps for sale. He had already cultivated a casual relationship with the employee based on information he’d found online about this person’s interest in stamp collecting. The site was fake and hosted malicious content but the person believed they could trust Mati’s information and didn’t require a finely crafted forgery of a “real” stamp collecting site to believe what he was looking at. Read more about it in the book Social Engineering: The Art of Human Hacking.

Another important aspect of pretext development is what information to use and where to find it. Information gathering and target research is key to obtaining relevant information that can be used for the pretext as well as other aspects of social engineering. Elicitation, Google mining, dumpster diving, and now social network mining (aka Maltego) are all valid techniques for information gathering and currently in use during social engineering attacks.

Conclusion

When you’re communicating with someone it’s more than just the words you’re speaking. It’s also the way you act, your tone of voice, mood, body language, even the way you dress. A pretext may be composed from information that fits the target environment but successfully implementing it relies on your ability to fully understand and control how you’re communicating that information. With all this being said, planning for your pretext can not be stated enough. It is essential to properly plan or the social engineer will fail.

Image
https://www.sbs.com.au/guide/article/2017/06/13/welcome-tatiana-maslanys-acting-master-class