Perimeter
7/30/2010
07:08 PM
John H. Sawyer
John H. Sawyer
Commentary
Connect Directly
RSS
E-Mail
50%
50%

Real-World Attacks With Social Engineering Tookit

Social engineering has always been a penetration tester's (and hacker's) most effective tool. I would say it's their best weapon, but not everyone is good at the softer, human side of social engineering. However, when it comes to the technical side, the tools are getting better and better, including the latest version of the Social Engineering Toolkit released at BSides Las Vegas on Wednesday.

Social engineering has always been a penetration tester's (and hacker's) most effective tool. I would say it's their best weapon, but not everyone is good at the softer, human side of social engineering. However, when it comes to the technical side, the tools are getting better and better, including the latest version of the Social Engineering Toolkit released at BSides Las Vegas on Wednesday.According to Dave Kennedy (aka Rel1k), he created the Social Engineering Tookit (SET) for a couple of reasons: hackers are doing these same attacks, we need to promote user awareness, and security controls to prevent these attacks need to be tested. Essentially, it gives penetration testers a streamlined way to perform social engineering attacks using exploits available in the Metasploit Framework. Since penetration testers are hired to gain access into a network as a malicious hacker would, they should be using the same techniques to verify existing vulnerabilities such as poor user awareness and unpatched client applications.

Codenamed "Arnold Palmer," the new 0.6 release of SET includes a slew of new features and bug fixes. It provides three major attack vectors, including spear-phishing, Web attacks through site-cloning, and malicious USB/DVD/CDs, along with the brand new Arduino-based Teensy USB HID device.

The existing attack vectors are very good, but I'm most excited about the Teensy attack vector since I've been dabbling in hardware hacking more lately. The Teensy can act as a keyboard and mouse allowing an attacker to inject keystrokes into a system and deploy an attack payload (such as the Metasploit Framework's meterpreter) via PowerShell or WSCRIPT. The attack bypasses any autorun protections that may be implemented since it simulates a keyboard and not a USB storage device.

In addition to the Teensy-based attack, SET 0.6 includes TabNabbing, the option to use the Python HTTP server or Apache Web server, the Man-Left-in-the-Middle attack, over 45 bug fixes, Ettercap DNS poison attacks, and the latest Adobe, LNK, and Internet Explorer exploits. The Java Applet attack, available previously, has also been released as open source as of version 0.6, and it's been improved to evade antivirus through heavy obfuscation of the Java and payload.

SET is truly an incredible tool and Dave has done an amazing job at developing something that can really help penetration testers be more effective at testing areas -- namely humans -- that are often overlooked. As he stated during his presentation, "if you aren't doing social engineering as part of your regular penetration tests, you are seriously missing out." For more information about social engineering, check out the social-engineer.org site and listen to their excellent podcast.

John H. Sawyer is a senior security engineer on the IT Security Team at the University of Florida. The views and opinions expressed in this blog are his own and do not represent the views and opinions of the UF IT Security Team or the University of Florida. When John's not fighting flaming, malware-infested machines or performing autopsies on blitzed boxes, he can usually be found hanging with his family, bouncing a baby on one knee and balancing a laptop on the other. Special to Dark Reading.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0993
Published: 2014-09-15
Buffer overflow in the Vcl.Graphics.TPicture.Bitmap implementation in the Visual Component Library (VCL) in Embarcadero Delphi XE6 20.0.15596.9843 and C++ Builder XE6 20.0.15596.9843 allows remote attackers to execute arbitrary code via a crafted BMP file.

CVE-2014-2375
Published: 2014-09-15
Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to read or write to arbitrary files, and obtain sensitive information or cause a denial of service (disk consumption), via the CSV export feature.

CVE-2014-2376
Published: 2014-09-15
SQL injection vulnerability in Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

CVE-2014-2377
Published: 2014-09-15
Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to discover full pathnames via an application tag.

CVE-2014-3077
Published: 2014-09-15
IBM SONAS and System Storage Storwize V7000 Unified (aka V7000U) 1.3.x and 1.4.x before 1.4.3.4 store the chkauth password in the audit log, which allows local users to obtain sensitive information by reading this log file.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
CISO Insider: An Interview with James Christiansen, Vice President, Information Risk Management, Office of the CISO, Accuvant