Perimeter
7/30/2010
07:08 PM
John H. Sawyer
John H. Sawyer
Commentary
Connect Directly
RSS
E-Mail
50%
50%

Real-World Attacks With Social Engineering Tookit

Social engineering has always been a penetration tester's (and hacker's) most effective tool. I would say it's their best weapon, but not everyone is good at the softer, human side of social engineering. However, when it comes to the technical side, the tools are getting better and better, including the latest version of the Social Engineering Toolkit released at BSides Las Vegas on Wednesday.

Social engineering has always been a penetration tester's (and hacker's) most effective tool. I would say it's their best weapon, but not everyone is good at the softer, human side of social engineering. However, when it comes to the technical side, the tools are getting better and better, including the latest version of the Social Engineering Toolkit released at BSides Las Vegas on Wednesday.According to Dave Kennedy (aka Rel1k), he created the Social Engineering Tookit (SET) for a couple of reasons: hackers are doing these same attacks, we need to promote user awareness, and security controls to prevent these attacks need to be tested. Essentially, it gives penetration testers a streamlined way to perform social engineering attacks using exploits available in the Metasploit Framework. Since penetration testers are hired to gain access into a network as a malicious hacker would, they should be using the same techniques to verify existing vulnerabilities such as poor user awareness and unpatched client applications.

Codenamed "Arnold Palmer," the new 0.6 release of SET includes a slew of new features and bug fixes. It provides three major attack vectors, including spear-phishing, Web attacks through site-cloning, and malicious USB/DVD/CDs, along with the brand new Arduino-based Teensy USB HID device.

The existing attack vectors are very good, but I'm most excited about the Teensy attack vector since I've been dabbling in hardware hacking more lately. The Teensy can act as a keyboard and mouse allowing an attacker to inject keystrokes into a system and deploy an attack payload (such as the Metasploit Framework's meterpreter) via PowerShell or WSCRIPT. The attack bypasses any autorun protections that may be implemented since it simulates a keyboard and not a USB storage device.

In addition to the Teensy-based attack, SET 0.6 includes TabNabbing, the option to use the Python HTTP server or Apache Web server, the Man-Left-in-the-Middle attack, over 45 bug fixes, Ettercap DNS poison attacks, and the latest Adobe, LNK, and Internet Explorer exploits. The Java Applet attack, available previously, has also been released as open source as of version 0.6, and it's been improved to evade antivirus through heavy obfuscation of the Java and payload.

SET is truly an incredible tool and Dave has done an amazing job at developing something that can really help penetration testers be more effective at testing areas -- namely humans -- that are often overlooked. As he stated during his presentation, "if you aren't doing social engineering as part of your regular penetration tests, you are seriously missing out." For more information about social engineering, check out the social-engineer.org site and listen to their excellent podcast.

John H. Sawyer is a senior security engineer on the IT Security Team at the University of Florida. The views and opinions expressed in this blog are his own and do not represent the views and opinions of the UF IT Security Team or the University of Florida. When John's not fighting flaming, malware-infested machines or performing autopsies on blitzed boxes, he can usually be found hanging with his family, bouncing a baby on one knee and balancing a laptop on the other. Special to Dark Reading.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0972
Published: 2014-08-01
The kgsl graphics driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not properly prevent write access to IOMMU context registers, which allows local users to select a custom page table, and consequently write ...

CVE-2014-2627
Published: 2014-08-01
Unspecified vulnerability in HP NonStop NetBatch G06.14 through G06.32.01, H06 through H06.28, and J06 through J06.17.01 allows remote authenticated users to gain privileges for NetBatch job execution via unknown vectors.

CVE-2014-3009
Published: 2014-08-01
The GDS component in IBM InfoSphere Master Data Management - Collaborative Edition 10.0 through 11.0 and InfoSphere Master Data Management Server for Product Information Management 9.0 and 9.1 does not properly handle FRAME elements, which makes it easier for remote authenticated users to conduct ph...

CVE-2014-3302
Published: 2014-08-01
user.php in Cisco WebEx Meetings Server 1.5(.1.131) and earlier does not properly implement the token timer for authenticated encryption, which allows remote attackers to obtain sensitive information via a crafted URL, aka Bug ID CSCuj81708.

CVE-2014-3534
Published: 2014-08-01
arch/s390/kernel/ptrace.c in the Linux kernel before 3.15.8 on the s390 platform does not properly restrict address-space control operations in PTRACE_POKEUSR_AREA requests, which allows local users to obtain read and write access to kernel memory locations, and consequently gain privileges, via a c...

Best of the Web
Dark Reading Radio