Vulnerabilities / Threats

8/16/2013
09:38 PM
50%
50%

Tech Insight: DEF CON 21 Highlights Dangers Of Social Engineering

Popular contest and presentation show real risks associated with social engineering

We hear about the dangers of social engineering and see phishing e-mail messages come in an attempt to steal user credentials, but it isn't always clear just how effective social engineering can be. The recent DEF CON 21 conference in Las Vegas, however, offered up a chance to see the powerful effects of social engineering through contests and presentations highlighting the dangers.

The popular Social Engineering Capture the Flag (SECTF) competition returned for its fifth year and pitted some of the best social engineers against each other. The contest was to see who is best at scouring the Internet for details about a company and then milking that company's users for information over the phone.

The contestants are given time prior to the conference to research the companies that have been selected as targets. During the conference, each contestant is put in a soundproof room and given 20 minutes to call the company and trick employees into giving them as much information as possible.

SECTF participants are looking to gather the same types of information that an actual attacker would be interested in -- things like the operating systems in use, if tech support is handled in-house or by a third party, wireless network details, employee-specific information, and the names of vendors used for security guards, trash handling, and janitorial services.

According to the organizers, the goal of SECTF is to raise awareness of the threat that social engineering poses for companies and their customers. The contestants demonstrate attacks commonly used by malicious attackers. The difference is that strict rules are in place during the contest to prevent loss from being broken, personal information being obtained and exposed, and abuse of the target's employees.

One of the highest scoring activities that a contestant can perform is manipulating a target into visiting a specific website. While some security professionals may not see this as a big threat because of the security controls they have in place, the presentation by Dave Kennedy, TrustedSec founder and principal security consultant, and Nick Hitchcock, TrustedSec senior security consultant, will certainly make them think otherwise.

During Kennedy and Hitchcock's talk, "The Dirty South -- Getting Justified with Technology," the presenters focused on 12 steps that companies can use to develop a more secure environment without losing sight of business needs. With a focus on getting back to the basics of security, they outlined an iterative and reflective approach that starts with traditional defensive strategies and security controls, includes education and awareness, and provides a feedback loop to make sure successful processes continue as the process starts back at step 1.

To drive home their message, the presenters arranged for a live social-engineering demonstration against an actual client to demonstrate how even the latest and greatest security technologies are not enough to protect enterprise networks. Kennedy and Hitchcock enlisted well-known social engineer Kevin Mitnick to carry out the attack and trick a user into visiting a website that had been set up to exploit the user's Web browser.

Just before the attack, Kennedy called his client to confirm they still had permission to proceed and ask a few questions about the security products in place. The client confirmed that it had a next-generation firewall by one of the top providers, application whitelisting, egress filtering, and SMTP sandboxing technology. Then Mitnick went to work convincing one of the client's users over the phone that he needed to fill out a health benefits form online.

When the user opened the website in Internet Explorer and clicked "yes" on a pop-up, Mitnick said the user had accepted the new policy form and was done. At the same time, numerous remote Metasploit Meterpreter backdoor sessions showed up on the presenter's screens in front of the DEF CON audience, causing cheers and applause. Combined with Mitnick's social-engineering skills and new features in Kennedy's Social Engineering Toolkit (SET), the presenters had just bypassed many hundreds of thousands of dollars of security technologies in front of a live audience.

Even with all of those security solutions in place, their attack was successful and demonstrated how an actual malicious attacker could carry out the same attack. When asked in an interview with Dark Reading about the live demo, Kennedy said, "I wanted to show that we as an industry are trying to take shortcuts to fix problems. The latest security products aren't going to protect you against hackers -- vulnerability scans, yes, but not the hackers."

Those solutions and shortcuts end up leaving companies with a false sense of security. Kennedy told Dark Reading that his goal is to get the information out there through his presentation and tools like SET. "If the information isn't available, people can't use it to make systems more secure. SET has brought what we can do to the forefront through penetration testing and social engineering."

With their presentation and the SECTF, DEF CON 21 attendees certainly got a dose of awareness regarding the dangers of social engineering and the ease in which it can be used to help defeat "next-generation" security technologies. The question now is whether companies will use this knowledge or keep looking for shortcuts.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
WebAuthn, FIDO2 Infuse Browsers, Platforms with Strong Authentication
John Fontana, Standards & Identity Analyst, Yubico,  9/19/2018
Turn the NIST Cybersecurity Framework into Reality: 5 Steps
Mukul Kumar & Anupam Sahai, CISO & VP of Cyber Practice and VP Product Management, Cavirin Systems,  9/20/2018
NSS Labs Files Antitrust Suit Against Symantec, CrowdStrike, ESET, AMTSO
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/19/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-17317
PUBLISHED: 2018-09-21
FruityWifi (aka PatatasFritas/PatataWifi) 2.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the io_mode, ap_mode, io_action, io_in_iface, io_in_set, io_in_ip, io_in_mask, io_in_gw, io_out_iface, io_out_set, io_out_mask, io_out_gw, iface, or domain parameter to /ww...
CVE-2018-17320
PUBLISHED: 2018-09-21
An issue was discovered in UCMS 1.4.6. aaddpost.php has stored XSS via the sadmin/aindex.php minfo parameter in a sadmin_aaddpost action.
CVE-2018-17141
PUBLISHED: 2018-09-21
HylaFAX 6.0.6 and HylaFAX+ 5.6.0 allow remote attackers to execute arbitrary code via a dial-in session that provides a FAX page with the JPEG bit enabled, which is mishandled in FaxModem::writeECMData() in the faxd/CopyQuality.c++ file.
CVE-2018-17173
PUBLISHED: 2018-09-21
LG SuperSign CMS allows remote attackers to execute arbitrary code via the sourceUri parameter to qsr_server/device/getThumbnail.
CVE-2018-17174
PUBLISHED: 2018-09-21
A stack-based buffer overflow was discovered in the xtimor NMEA library (aka nmealib) 0.5.3. nmea_parse() in parser.c allows an attacker to trigger denial of service (even arbitrary code execution in a certain context) in a product using this library via malformed data.