Social engineering case study: “Manipulation always works”

We are often asked for real-world examples from our day-to-day social engineering (SE) work, and that is exactly what I want to share today. This pentest was one of the first SE pentests we carried out as a larger team. To say it up front: this attack simulation very nearly failed.

Introduction

As SE pentesters we aim to make our attack simulations as realistic as possible, so that we do not get “burned”, in other words exposed. As a rule, clients commission us to put their security measures through a stress test and to gain genuine insight into their own resilience.

SE pentest: our approach

We choose the path of least resistance, just as real attackers would: a high probability of success and a low risk of being discovered. Once the engagement is confirmed, reconnaissance begins. For this we use open source intelligence (OSINT) as well as several days of observation of the target sites.

Then comes attack planning. We develop several attack scenarios (COA, course of action) that either build on one another or work independently.

The engagement

Five sites were to be tested in a single day. Security standards and staff awareness were high, as you would expect of a critical infrastructure operator.

The preparation

It quickly became clear that we would have to dig deep into our bag of tricks. We rented an ambulance and film props. Two weeks before the pentest we started approaching target individuals. With the cover story of being the company’s own photographer taking Christmas pictures, I got talking to security staff at several sites.

A “special” challenge

On the day of the pentest we quickly realised that something was wrong. The pentest had been announced in advance, and on the test day it was posted on the internal notice board. Now it was a matter of adapting to the situation as it was.

The final attack scenario

“The photographer” was actually our weakest scenario. With a forged ID and a camera I set off for the last site. In the reception area I used the security staff’s supposed head start in knowledge against them.

I distracted the security officer with a colleague who positioned himself visibly outside. While the security officer went outside, I pushed the props under the turnstile, climbed through after them and moved freely around the site.

Why did it work?

The security staff knew that pentesters were on the way, but not how. The mix of a desire to prove themselves, fear of “failing” and curiosity created stress. And stress clouds perception.

Conclusion

Even though this pentest was not realistic in the narrower sense, it shows how easy manipulation is, even with heightened attention. We never expose individuals in our reports. An SE pentest does not just reveal weaknesses; it creates the basis for lasting training.