Vulnerabilities / Threats

8/16/2013
09:38 PM
50%
50%

Tech Insight: DEF CON 21 Highlights Dangers Of Social Engineering

Popular contest and presentation show real risks associated with social engineering

We hear about the dangers of social engineering and see phishing e-mail messages come in an attempt to steal user credentials, but it isn't always clear just how effective social engineering can be. The recent DEF CON 21 conference in Las Vegas, however, offered up a chance to see the powerful effects of social engineering through contests and presentations highlighting the dangers.

The popular Social Engineering Capture the Flag (SECTF) competition returned for its fifth year and pitted some of the best social engineers against each other. The contest was to see who is best at scouring the Internet for details about a company and then milking that company's users for information over the phone.

The contestants are given time prior to the conference to research the companies that have been selected as targets. During the conference, each contestant is put in a soundproof room and given 20 minutes to call the company and trick employees into giving them as much information as possible.

SECTF participants are looking to gather the same types of information that an actual attacker would be interested in -- things like the operating systems in use, if tech support is handled in-house or by a third party, wireless network details, employee-specific information, and the names of vendors used for security guards, trash handling, and janitorial services.

According to the organizers, the goal of SECTF is to raise awareness of the threat that social engineering poses for companies and their customers. The contestants demonstrate attacks commonly used by malicious attackers. The difference is that strict rules are in place during the contest to prevent loss from being broken, personal information being obtained and exposed, and abuse of the target's employees.

One of the highest scoring activities that a contestant can perform is manipulating a target into visiting a specific website. While some security professionals may not see this as a big threat because of the security controls they have in place, the presentation by Dave Kennedy, TrustedSec founder and principal security consultant, and Nick Hitchcock, TrustedSec senior security consultant, will certainly make them think otherwise.

During Kennedy and Hitchcock's talk, "The Dirty South -- Getting Justified with Technology," the presenters focused on 12 steps that companies can use to develop a more secure environment without losing sight of business needs. With a focus on getting back to the basics of security, they outlined an iterative and reflective approach that starts with traditional defensive strategies and security controls, includes education and awareness, and provides a feedback loop to make sure successful processes continue as the process starts back at step 1.

To drive home their message, the presenters arranged for a live social-engineering demonstration against an actual client to demonstrate how even the latest and greatest security technologies are not enough to protect enterprise networks. Kennedy and Hitchcock enlisted well-known social engineer Kevin Mitnick to carry out the attack and trick a user into visiting a website that had been set up to exploit the user's Web browser.

Just before the attack, Kennedy called his client to confirm they still had permission to proceed and ask a few questions about the security products in place. The client confirmed that it had a next-generation firewall by one of the top providers, application whitelisting, egress filtering, and SMTP sandboxing technology. Then Mitnick went to work convincing one of the client's users over the phone that he needed to fill out a health benefits form online.

When the user opened the website in Internet Explorer and clicked "yes" on a pop-up, Mitnick said the user had accepted the new policy form and was done. At the same time, numerous remote Metasploit Meterpreter backdoor sessions showed up on the presenter's screens in front of the DEF CON audience, causing cheers and applause. Combined with Mitnick's social-engineering skills and new features in Kennedy's Social Engineering Toolkit (SET), the presenters had just bypassed many hundreds of thousands of dollars of security technologies in front of a live audience.

Even with all of those security solutions in place, their attack was successful and demonstrated how an actual malicious attacker could carry out the same attack. When asked in an interview with Dark Reading about the live demo, Kennedy said, "I wanted to show that we as an industry are trying to take shortcuts to fix problems. The latest security products aren't going to protect you against hackers -- vulnerability scans, yes, but not the hackers."

Those solutions and shortcuts end up leaving companies with a false sense of security. Kennedy told Dark Reading that his goal is to get the information out there through his presentation and tools like SET. "If the information isn't available, people can't use it to make systems more secure. SET has brought what we can do to the forefront through penetration testing and social engineering."

With their presentation and the SECTF, DEF CON 21 attendees certainly got a dose of awareness regarding the dangers of social engineering and the ease in which it can be used to help defeat "next-generation" security technologies. The question now is whether companies will use this knowledge or keep looking for shortcuts.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Microsoft President: Governments Must Cooperate on Cybersecurity
Kelly Sheridan, Staff Editor, Dark Reading,  11/8/2018
Why the CISSP Remains Relevant to Cybersecurity After 28 Years
Steven Paul Romero, SANS Instructor and Sr. SCADA Network Engineer, Chevron,  11/6/2018
5 Reasons Why Threat Intelligence Doesn't Work
Jonathan Zhang, CEO/Founder of WhoisXML API and TIP,  11/7/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Online Malware and Threats: A Profile of Today's Security Posture
Online Malware and Threats: A Profile of Today's Security Posture
This report offers insight on how security professionals plan to invest in cybersecurity, and how they are prioritizing their resources. Find out what your peers have planned today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-1786
PUBLISHED: 2018-11-12
IBM Spectrum Protect 7.1 and 8.1 dsmc and dsmcad processes incorrectly accumulate TCP/IP sockets in a CLOSE_WAIT state. This can cause TCP/IP resource leakage and may result in a denial of service. IBM X-Force ID: 148871.
CVE-2018-1798
PUBLISHED: 2018-11-12
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force...
CVE-2018-1884
PUBLISHED: 2018-11-12
IBM Case Manager 5.2.0.0, 5.2.0.4, 5.2.1.0, 5.2.1.7, 5.3.0.0, and 5.3.3.0 is vulnerabile to a "zip slip" vulnerability which could allow a remote attacker to execute code using directory traversal techniques. IBM X-Force ID: 151970.
CVE-2018-19203
PUBLISHED: 2018-11-12
PRTG Network Monitor before 18.2.41.1652 allows remote unauthenticated attackers to terminate the PRTG Core Server Service via a special HTTP request.
CVE-2018-19204
PUBLISHED: 2018-11-12
PRTG Network Monitor before 18.3.44.2054 allows a remote authenticated attacker (with read-write privileges) to execute arbitrary code and OS commands with system privileges. When creating an HTTP Advanced Sensor, the user's input in the POST parameter 'proxyport_' is mishandled. The attacker can cr...