The World's Greatest Detective Was Also the World's Greatest Con Artist
A cybersecurity professor dressed as Sherlock Holmes walked a DEF CON audience through why the tricks criminals use to manipulate people today are identical to what a Victorian fictional detective pulled off in the 1890s.
Key points
- Elizabeth Rasnick, an assistant professor at the University of West Florida's Center for Cybersecurity and Artificial Intelligence, presented at DEF CON 34 in Las Vegas.
- She argued that trust, not technology, is the core "attack surface" that criminals exploit in social engineering schemes.
- Social engineering, which means manipulating people rather than machines to hand over information or access, predates the internet by centuries.
- Rasnick compared ethical hackers to Sherlock Holmes and criminal hackers to his archnemesis Moriarty: the techniques are identical, and only intent separates them.
- Artificial intelligence now lets criminals send more convincing fake messages at greater scale, but the underlying psychology hasn't changed.
Elizabeth Rasnick walked onto the DEF CON stage wearing a green deerstalker cap and a blue-and-green plaid shawl, pipe in hand. She looked, deliberately, like Sherlock Holmes.
The disguise was the argument.
Rasnick, an assistant professor at the University of West Florida's Center for Cybersecurity and Artificial Intelligence, used the costume to open a session on social engineering, the practice of manipulating people through deception rather than hacking machines directly. Her central claim: Holmes was doing it in Arthur Conan Doyle's stories long before anyone had a computer.
What is social engineering, and why does it keep working?
Social engineering works because human psychology is predictable. Criminals study a target, build a believable cover story, create pressure or opportunity, and watch how people react.
"Predictable behavior is what makes social engineering possible," Rasnick told the audience. Trust, she said, is the real attack surface, meaning trust is the vulnerability criminals actually exploit, not a software flaw or a weak password.
The tactics she listed map almost perfectly onto Holmes's own methods: know your target, become believable, create a reason to act, exploit emotion, observe reactions, adapt when something doesn't work.
In "The Red-Headed League," a fake organisation lures a man away from his shop so criminals can tunnel beneath it. Rasnick compared that directly to fake job-posting scams today, where criminals post convincing-looking vacancies, wait for applicants to reply, and send phishing links, fake web pages designed to steal login details or install harmful software.
Holmes, in the original tales, once got engaged to a housemaid while undercover to gather information. Criminals today use deepfake videos and mass-personalised emails to accomplish the same thing at scale. We reported on 16 July how AI can assemble a detailed profile of a target executive in minutes, and Rasnick's framework explains exactly why that matters: better reconnaissance means more believable manipulation.
Does AI change anything?
It changes the speed and the volume. Artificial intelligence lets criminals write phishing emails that sound personal and polished, stripping out the spelling mistakes that used to give scams away. Thousands of tailored messages can go out in the time it once took to write one.
The underlying logic hasn't shifted. Fear and curiosity still drive people to click. A message projecting sudden urgency works today for the same reason Holmes's urgency tactics worked in the 1890s.
Is there a difference between a criminal hacker and an ethical one?
Yes, and Rasnick was precise about it. Ethical hackers, sometimes called penetration testers, are hired by organisations to find weaknesses before criminals do. They sign contracts beforehand and deliver written reports at the end.
"The difference is paperwork," Rasnick said.
To make the point, she opened with a quiz: audiences had to identify which actions belonged to Holmes or to Moriarty. Everyone guessed wrong. Holmes did the reconnaissance and the manipulation and the impersonation. His fictional villain was comparatively innocent.
"Does it make it better when Holmes does it?" she asked. "The difference is intent and whether you have legitimacy."
That line sits at the heart of a question our story on Tal Kollander explored in July: how thin the line really is between the offensive and defensive sides of hacking.
What should ordinary people watch for?
Any message that makes you feel urgent or curious deserves a pause. Criminals design those feelings on purpose. Before clicking a link or handing over information, check whether the request arrived through a channel you initiated. If you're unsure, call the organisation directly using a number you find yourself.
Common questions
Why can't spam filters and security software just stop social engineering?
Software catches technical attacks well, but social engineering targets the person, not the machine. A convincing phone call or a well-written fake email reaches a human being before any filter can judge it.
What makes someone easier to manipulate?
Rasnick's framework points to two things: being time-pressured and being curious. Criminals create both on purpose. Slowing down, even for thirty seconds, interrupts the psychological mechanism they're counting on.
