Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats //

Insider Threats

4/7/2014
04:10 PM
Connect Directly
Google+
Twitter
RSS
E-Mail

Social Engineering Grows Up

Fifth annual DEF CON Social Engineering Capture the Flag Contest kicks off today with new "tag team" rules to reflect realities of the threat.

Comment  | 
Print  | 
Comments
Newest First  |  Oldest First  |  Threaded View
jaingverda
50%
50%
jaingverda,
User Rank: Moderator
4/8/2014 | 4:24:12 PM
Re: Broadening appeal
@Kelly Jackson Higgins

I understand what the CTF is about I'm talking about applying two factor authentication to call center industry. Much like how you can set up two factor auth for you google log in or reseting of your password. And how would that effect the ablity of the SE needing that second vitial piece of inteligence. Could they get around the need of the second token somehow or would it stop the SE cold in its tracks. I'm thinking basicly industry wide not just in relation to the compitition at Def Con, how can we improve security without increasing finanical overhead when it comes to SE attacks dramaticly.
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
4/8/2014 | 4:19:08 PM
Re: Broadening appeal
I'm not sure what you mean here, @jaingverda. The SE CTF uses open-source research reconn, then the cold calls to random employees at specific target corporations. The callers/contestants pose as customers, contractors, students, etc.
Thomas Claburn
50%
50%
Thomas Claburn,
User Rank: Ninja
4/8/2014 | 4:15:45 PM
Re: Broadening appeal
I think we've found the next popular reality show.
jaingverda
50%
50%
jaingverda,
User Rank: Moderator
4/8/2014 | 3:53:23 PM
Re: Broadening appeal
It is very intresting to watch. How much of a detriment do you think there is to SE hackers when a company enforces two factor authentication though. You know the first half say a manager's name or something but don't have the correct (yubikey) or something to authentcate yourself the rest of the way?
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
4/8/2014 | 2:19:31 PM
Re: Broadening appeal
Agreed, @GonzSTL. That's what makes the SE CTF so important--it really raises awareness of how easy social engineering is to perform, and how human nature, psychology, etc., all come into play. @LornaGarey, it's "entertaining" to watch these live exploits during the CTF, but it's also disconcerting because people naturally want to be helpful, and that's what the bad guys are counting on.
Lorna Garey
50%
50%
Lorna Garey,
User Rank: Ninja
4/8/2014 | 2:13:18 PM
Re: Broadening appeal
KJH, Can you imagine the uproar if these calls or vidoes went public? It would be epic.
GonzSTL
50%
50%
GonzSTL,
User Rank: Ninja
4/8/2014 | 9:25:46 AM
Re: Broadening appeal
Social engineering is a critical part of security awareness training. Bad guys can defeat millions of dollars worth of security infrastructure within minutes through the clever use of social engineering because that exploits the weakest link in any organization - people. Security assessments should have a social engineering component.
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
4/7/2014 | 5:12:29 PM
Re: Broadening appeal
I don't believe the videos will go public, but the real live competition is open to the public at DEF CON. The contestants sit in a soundproof booth, and attendees can sit in the same room and watch and listen. It's really interesting.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
4/7/2014 | 5:10:45 PM
Broadening appeal
So interesting that the social engineering mission is becoming more mainstream.  I wouldn't be surprised if this excercise is at some point adopted as a corporate security awareness excercise. In the meantime, will the public be able to see the finalist videos?
COVID-19: Latest Security News & Commentary
Dark Reading Staff 6/5/2020
How AI and Automation Can Help Bridge the Cybersecurity Talent Gap
Peter Barker, Chief Product Officer at ForgeRock,  6/1/2020
Cybersecurity Spending Hits 'Temporary Pause' Amid Pandemic
Kelly Jackson Higgins, Executive Editor at Dark Reading,  6/2/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: What? IT said I needed virus protection!
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
The State of Ransomware
The State of Ransomware
Ransomware has become one of the most prevalent new cybersecurity threats faced by today's enterprises. This new report from Dark Reading includes feedback from IT and IT security professionals about their organization's ransomware experiences, defense plans, and malware challenges. Find out what they had to say!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-13864
PUBLISHED: 2020-06-05
The Elementor Page Builder plugin before 2.9.9 for WordPress suffers from a stored XSS vulnerability. An author user can create posts that result in a stored XSS by using a crafted payload in custom links.
CVE-2020-13865
PUBLISHED: 2020-06-05
The Elementor Page Builder plugin before 2.9.9 for WordPress suffers from multiple stored XSS vulnerabilities. An author user can create posts that result in stored XSS vulnerabilities, by using a crafted link in the custom URL or by applying custom attributes.
CVE-2020-11696
PUBLISHED: 2020-06-05
In Combodo iTop a menu shortcut name can be exploited with a stored XSS payload. This is fixed in all iTop packages (community, essential, professional) in version 2.7.0 and iTop essential and iTop professional in version 2.6.4.
CVE-2020-11697
PUBLISHED: 2020-06-05
In Combodo iTop, dashboard ids can be exploited with a reflective XSS payload. This is fixed in all iTop packages (community, essential, professional) for version 2.7.0 and in iTop essential and iTop professional packages for version 2.6.4.
CVE-2020-13646
PUBLISHED: 2020-06-05
In the cheetah free wifi 5.1 driver file liebaonat.sys, local users are allowed to cause a denial of service (BSOD) or other unknown impact due to failure to verify the value of a specific IOCTL.