Sherlock Holmes was the “OG” Social Engineer
This article draws parallels between the social engineering techniques of Sir Arthur Conan Doyle's Sherlock Holmes and modern-day cyberattacks. The author, a cybersecurity professor, argues that the core principles of deception – exploiting trust, creating urgency, and leveraging curiosity – remain constant, regardless of technological advancements. She highlights the similarities between Holmes’s methods and those used by both ethical and malicious hackers, emphasizing that the key distinction lies in intent and legitimacy.
This article explores the enduring relevance of social engineering techniques, drawing a direct line between the methods of Sir Arthur Conan Doyle’s Sherlock Holmes and contemporary cyberattacks. Cybersecurity expert Elizabeth Rasnick argues that the fundamental principles of deception – exploiting user trust, creating a sense of urgency, and leveraging human curiosity – have remained remarkably consistent throughout history. She contends that threat actors, both ethical and malicious, utilize the same playbook, mirroring Holmes’s approach in his detective stories.
Rasnick points to the Victorian-era detective as a prime example of a social engineer, emphasizing how he meticulously gathered intelligence through observation, disguise, and building relationships to uncover information. She notes that threat actors today employ similar tactics, including utilizing open-source intelligence (OSINT) – scanning social media for details about a target’s work – to understand their behavior and vulnerabilities.
“Sherlock Holmes: The Red-Headed League,” a story where an organization pretends to be real, is used as an example of how threat actors create fake job postings to lure victims into phishing scams. The article stresses that the core of social engineering is understanding human psychology – how people react to fear, urgency, and curiosity – and then exploiting those emotions to gain access to sensitive information or systems.
Rasnick compares Holmes to his fictional archnemesis, James Moriarty, illustrating the fine line between ethical hackers (who operate within legal and ethical boundaries, documenting their work) and cybercriminals. She emphasizes that the difference is not the techniques themselves, but the intent behind them and whether the actions are conducted with legitimate authorization. “Does it make it better when Holmes does it?” she asks, highlighting the ethical considerations involved in using these techniques.
Ultimately, the article suggests that a strong understanding of human behavior and a focus on building trust are crucial defenses against social engineering attacks, regardless of the tools used.