Elicitation: Weaponizing Social Engineering for Covert Access Operations | Dorota Kozlowska

### Overview Dorota Kozlowska, a penetration tester with Black Hills Information Security (BHIS) working in the Anti-SoC continuous penetration testing team and a Certified Covert Access Specialist, presents on using social engineering elicitation during covert access operations. The presentation explores how physical penetration testing integrates with social engineering to expose vulnerabilities in physical security controls (such as locks, barriers, cameras, and guards) and human procedures. Kozlowska emphasizes that elicitation leverages human psychology—including the desire to be helpful, ego, and the instinct to correct errors—to subtly extract sensitive data without raising suspicion.

### Key Topics - **Physical Penetration Testing Fundamentals:** Kozlowska underscores the necessity of having a documented scope and a "get out of jail free card" signed by leadership before entering a target facility. Working in pairs allows teams to stage distractions (e.g., dropping documents in a bank lobby to draw eyes away from turnstiles). Testers must discreetly document their findings through approved photo or video capture while respecting agreed-upon rules of engagement. - **Phases of Social Engineering:** Kozlowska outlines the attack lifecycle across reconnaissance, engagement, exploitation, and execution. Reconnaissance involves gathering intelligence on employee names, roles, shift habits, org charts, and floor plans. Engagement focuses on rapport-building and establishing plausible pretexts. Exploitation involves influencing targets to breach normal processes or reveal restricted data, leading to the execution phase where objectives (such as accessing a server room or placing a flag) are achieved. - **Psychological Foundations of Elicitation:** Elicitation differs from direct interrogation; it feels like casual conversation. Attackers exploit psychological principles such as reciprocity, social proof, perceived authority, sympathy for a confused individual, and foot-in-the-door consistency.

### Technical Details - **Elicitation and Framing Techniques:** Operators utilize subtle challenges, innocent inquiries, and false information testing (deliberately offering inaccurate claims so targets instinctively correct them to defend accuracy). Framing techniques shape how inquiries are perceived: - *Praise & Ego Framing:* Complimenting a target's expertise so they reveal proprietary system architectures. - *Challenge Framing:* Provoking detailed technical explanations by expressing doubt that a system works a certain way. - *Sympathy / Helpless Persona:* Posing as a confused new hire or contractor struggling with access. - *Presumed Familiarity & Third-Party Framing:* Dropping internal tool names, Active Directory groups, or colleague names to validate procedures without formal requests. - **Mirroring and Active Listening:** Replicating a target's tone, pacing, posture, and language creates rapport and encourages unguarded venting or disclosure of operational workarounds. - **Technical Access Mapping:** Kozlowska demonstrates how an attacker can incrementally map an enterprise access path without triggering helpdesk alerts—such as chatting with IT support to confirm VPN clients (e.g., AnyConnect vs. Fortinet), confirming Active Directory group naming conventions with HR, and checking MFA trust models (e.g., Duo vs. Okta) with developers.

### Takeaways - **Operational Tradecraft:** Operators should maintain confidence, stick strictly to timelines, avoid lingering unnecessarily, retain plausible backstories, and remove all physical equipment during exit. - **Defensive Strategies & Awareness:** Organizations must train employees that casual inquiries can be weaponized. Red flags include subtle testing of procedures, repeated rephrased questions, excessive flattery, and artificial urgency. Defensive responses include deflecting, refusing to over-explain or educate, answering with clarifying questions, generalizing responses, adhering strictly to workplace rules, and reporting suspicious encounters quietly. - **Ethics & Continuous Testing:** Elicitation must adhere to ethical boundaries and legal frameworks (such as the Computer Fraud and Abuse Act, GDPR, and wire fraud laws). Continuous red-team-inspired testing is vital as technologies and communication mediums evolve.