Perimeter
7/30/2010
07:08 PM
John H. Sawyer
John H. Sawyer
Commentary
50%
50%

Real-World Attacks With Social Engineering Tookit

Social engineering has always been a penetration tester's (and hacker's) most effective tool. I would say it's their best weapon, but not everyone is good at the softer, human side of social engineering. However, when it comes to the technical side, the tools are getting better and better, including the latest version of the Social Engineering Toolkit released at BSides Las Vegas on Wednesday.

Social engineering has always been a penetration tester's (and hacker's) most effective tool. I would say it's their best weapon, but not everyone is good at the softer, human side of social engineering. However, when it comes to the technical side, the tools are getting better and better, including the latest version of the Social Engineering Toolkit released at BSides Las Vegas on Wednesday.According to Dave Kennedy (aka Rel1k), he created the Social Engineering Tookit (SET) for a couple of reasons: hackers are doing these same attacks, we need to promote user awareness, and security controls to prevent these attacks need to be tested. Essentially, it gives penetration testers a streamlined way to perform social engineering attacks using exploits available in the Metasploit Framework. Since penetration testers are hired to gain access into a network as a malicious hacker would, they should be using the same techniques to verify existing vulnerabilities such as poor user awareness and unpatched client applications.

Codenamed "Arnold Palmer," the new 0.6 release of SET includes a slew of new features and bug fixes. It provides three major attack vectors, including spear-phishing, Web attacks through site-cloning, and malicious USB/DVD/CDs, along with the brand new Arduino-based Teensy USB HID device.

The existing attack vectors are very good, but I'm most excited about the Teensy attack vector since I've been dabbling in hardware hacking more lately. The Teensy can act as a keyboard and mouse allowing an attacker to inject keystrokes into a system and deploy an attack payload (such as the Metasploit Framework's meterpreter) via PowerShell or WSCRIPT. The attack bypasses any autorun protections that may be implemented since it simulates a keyboard and not a USB storage device.

In addition to the Teensy-based attack, SET 0.6 includes TabNabbing, the option to use the Python HTTP server or Apache Web server, the Man-Left-in-the-Middle attack, over 45 bug fixes, Ettercap DNS poison attacks, and the latest Adobe, LNK, and Internet Explorer exploits. The Java Applet attack, available previously, has also been released as open source as of version 0.6, and it's been improved to evade antivirus through heavy obfuscation of the Java and payload.

SET is truly an incredible tool and Dave has done an amazing job at developing something that can really help penetration testers be more effective at testing areas -- namely humans -- that are often overlooked. As he stated during his presentation, "if you aren't doing social engineering as part of your regular penetration tests, you are seriously missing out." For more information about social engineering, check out the social-engineer.org site and listen to their excellent podcast.

John H. Sawyer is a senior security engineer on the IT Security Team at the University of Florida. The views and opinions expressed in this blog are his own and do not represent the views and opinions of the UF IT Security Team or the University of Florida. When John's not fighting flaming, malware-infested machines or performing autopsies on blitzed boxes, he can usually be found hanging with his family, bouncing a baby on one knee and balancing a laptop on the other. Special to Dark Reading.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-1421
Published: 2014-11-25
mountall 1.54, as used in Ubuntu 14.10, does not properly handle the umask when using the mount utility, which allows local users to bypass intended access restrictions via unspecified vectors.

CVE-2014-3605
Published: 2014-11-25
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-6407. Reason: This candidate is a reservation duplicate of CVE-2014-6407. Notes: All CVE users should reference CVE-2014-6407 instead of this candidate. All references and descriptions in this candidate have been removed to pre...

CVE-2014-7839
Published: 2014-11-25
DocumentProvider in RESTEasy 2.3.7 and 3.0.9 does not configure the (1) external-general-entities or (2) external-parameter-entities features, which allows remote attackers to conduct XML external entity (XXE) attacks via unspecified vectors.

CVE-2014-8001
Published: 2014-11-25
Buffer overflow in decode.cpp in Cisco OpenH264 1.2.0 and earlier allows remote attackers to execute arbitrary code via an encoded media file.

CVE-2014-8002
Published: 2014-11-25
Use-after-free vulnerability in decode_slice.cpp in Cisco OpenH264 1.2.0 and earlier allows remote attackers to execute arbitrary code via an encoded media file.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?