DEF CON 27 Social Engineering Village Notes

Introduction: Breaking Into the Most Secure Facilities

Chris Pritchard shares his experience conducting security tests on some of the most secure facilities in the industry, including critical national infrastructure (CNI), airports, and casinos. His approach focuses on practical, accessible techniques rather than complex psychological theories.

Core Philosophy: "This is for people who want to get into social engineering but think that they must know everything about body language, facial expressions... you don't. These tips have got me into some places that you really should not be in."

Essential Terminology:

SE: Social Engineering
CNI: Critical National Infrastructure (airports, nuclear plants, water treatment)
OSINT: Open Source Intelligence (Google, Street View, social media)
Pretext: "The lie - the story you're going to tell somebody about why you were there"
NDA: Non-Disclosure Agreements (limits specific operational details)

"I've been conducting security tests and audits of ICS and rail, air, maritime and utility sectors as well as SE and physical work at nuclear sites... successfully gaining access into CNI, airports, and casinos."

Phase 1: Reconnaissance - Doing Your Homework

OSINT Collection

Use Google, Street View, company websites, and social media to understand company culture, dress code, and operational patterns. This builds the foundation for believable pretexts.

Physical Site Survey

Visit the target location and walk around it. Look for weaknesses while being aware that there will be witnesses. Common areas to assess include back entrances, smoking areas, and shared offices.

Observation Techniques

Spend hours in communal reception areas with a laptop, observing staff behavior, dress codes, busy times, and security procedures.

Key Reconnaissance Targets:

Back Entrances

"Most security is built around people coming in the front entrance - it's not built around people coming in the back entrance." Often less monitored with weaker physical controls.

Smoking Areas

"I bought a vape machine just so I can go and stand in a smoking shed and build rapport with people... then walk back into the building with them because you're part of them." Natural social entry points.

Shared Offices

In high-rise buildings, identify the specific floor and office. Use communal reception areas for extended observation without raising suspicion.

ID Badge Systems

Note badge colors, lanyard types, metal attachments, and wearing styles. Build a collection of authentic-looking accessories.

Collection Development: "Eventually you end up with a collection... this blue lanyard with a blank ID badge but with some metal jangly bits - that's what got me into an airport because that's what they were wearing."

Phase 2: Pretext Development - Building Your Story

Pretext Construction Principles:

Leverage Your Knowledge

"Fit that pretext around what you know... I often pretend I'm an IT network engineer because I know that stuff. If people challenge me, I know how to talk IT network stuff." Use familiar domains to avoid cognitive load.

Partial Truth Strategy

"If you surround a story in part truth, it becomes believable - not just to you but to the person you're telling it to." Blend factual elements with the fabricated narrative.

Appropriate Costuming

"Get your outfit... if you're going to pretend to be an alarm engineer, dress like an alarm engineer." Match the observed dress code from reconnaissance.

Strategic Props

"Bring some props because again props help you reinforce that idea you should be there." Laptops for IT engineers, toolboxes for maintenance staff.

Knowledge-Based Pretexting: "What you want is if you were challenged, you want the information to come from your conscious - you don't want to have to think about it from your subconscious because you will end up going 'uh...'"

Physical Security Weaknesses: Gates & Access Control

Gate Exploitation Techniques:

Physical Barrier Weaknesses

Look for poorly designed barriers with gaps, low heights, or weak construction. Many gates are "pathetic" and can be stepped over, under, or around.

Security Office Blind Spots

Identify security office positioning - they often focus on front entrances while side and rear approaches remain unmonitored.

The Longman Technique

"Put a laptop bag directly behind someone and trick the system into thinking there is someone still there." Blocks gate sensors to enable tailgating without detection.

Timing Strategies

Tailgate during busy periods for social entry. Use quiet times for physical bypass attempts at secondary entrances.

"Don't see gates as a hard and fast barrier - there are ways around them. They are a weakness in some cases... The number of times I've done that [Longman technique] and been successful is unbelievable."

Phase 3: Internal Operations - Once You're Inside

Internal Movement Strategies:

Adrenaline Management

"Keep calm because you have this massive adrenaline buzz... if you have that adrenaline buzz you kind of give yourself away." Recognize and control physiological responses.

Tactical Hiding Locations

"Hiding in a toilet is brilliant... a colleague has actually printed out a laminated 'out of order' sign." Use restrooms for regrouping and adrenaline recovery.

Exit Strategy Planning

Identify push-button vs swipe-card controlled exits. Plan escape routes and alternative exit methods before beginning operations.

Target-Focused Movement

"Think about that target and how you're gonna get from where you are now... to where that thing potentially is." Maintain objective focus amid environmental complexity.

Social Interaction Techniques:

Direct Request Method

"Don't be afraid to ask for help... 'Hi I'm from the other office and my badge doesn't work on this particular door, would you mind helping me in?'" Simple, direct requests often succeed.

Polite Conversation Engagement

"Engage in polite conversation... don't make them your best friend." Normal workplace interactions build authenticity without over-engagement.

Authority Association

Identify and interact with powerful individuals. "Talking to somebody in power like that builds acceptance... everybody around thought that I should be there because I was talking to this lady of power."

Airport Example: "I got into the office and saw a lady of power... I purposely walked around lost and asked for help finding a desk number. She got up and helped me, which made everyone around think I should be there because I was talking to someone important."

Psychological Principles & Mindset Management

Key Psychological Concepts:

Don't Negate the Frame

"If I say 'don't think about pink elephants' - everyone starts thinking about pink elephants... If I said 'don't worry I'm not here to hack the network' - what's the first thing that person is going to be thinking?" Frame statements positively.

Inner Voice Management

"We all have this inner voice building all these bad and negative things... don't listen to it." Recognize fear-based thinking and maintain operational focus.

Ethical Framing

"Tell yourself you're acting and it makes it okay-ish." Use professional mindset techniques to manage personal ethics during authorized testing.

Positive Framing Technique

Instead of "I'm not here to hack," use "I'm here to make your internet faster." Positive framing creates cooperation rather than suspicion.

Chris Hadnagy Principle: "Always leave people better feeling for having met you. That's really really useful because it builds acceptance and makes you seem like you should be there."

Operational Realities & Self-Care

Practical Considerations:

Physical Exhaustion

"SE is exhausting... the adrenaline ups and downs and crashes, pretending to be somebody else for an entire day is absolutely exhausting." Plan for recovery time after operations.

Get-out-of-Jail Planning

Consider tactical placement of authorization letters. "If I get stopped by police with guns and I have a letter in my jacket pocket... that's probably not a good place to put it." Think through emergency scenarios.

Failure Acceptance

"You're gonna fail at some point - don't worry, treat it as practice." Build resilience through iterative learning and experience.

Key Takeaways for Red Teams

Essential Operational Principles:

Thorough reconnaissance is non-negotiable - OSINT and physical observation provide critical intelligence
Pretext from personal knowledge domains - Use familiar topics to reduce cognitive load under pressure
Physical security often has obvious weaknesses - Back entrances, poor gate design, and blind spots are common
Manage adrenaline and emotional responses - Use hiding spots and breathing techniques to maintain composure
Simple social approaches often work best - Direct requests and polite conversation beat complex manipulations
Positive framing over negative statements - "I'm here to help" works better than "I'm not here to harm"
Plan for exhaustion and recovery - SE operations are mentally and physically draining
Practice and accept failure - Build skills through experience and learn from mistakes

Professional Development: "Practice - get your company to get you involved in these kind of tests. You're gonna fail at some point - don't worry, treat it as practice. That's how you build real capability in social engineering operations."

Defensive Awareness Points:

Monitor back entrances and secondary access points with equal vigilance
Train staff to verify identities beyond superficial appearances and props
Implement challenge-response protocols for unusual requests
Be aware of social engineering during high-traffic periods
Recognize that simple, direct requests can be social engineering attempts
Maintain awareness of psychological principles like "don't negate the frame"

"These tips have got me into some places that you really should not be in... with permission of course. The basics work - you don't need to be a psychological expert to be effective in social engineering."