Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats //

Insider Threats

4/7/2014
04:10 PM
Connect Directly
Google+
Twitter
RSS
E-Mail

Social Engineering Grows Up

Fifth annual DEF CON Social Engineering Capture the Flag Contest kicks off today with new "tag team" rules to reflect realities of the threat.

Comment  | 
Print  | 
Comments
Newest First  |  Oldest First  |  Threaded View
jaingverda
50%
50%
jaingverda,
User Rank: Moderator
4/8/2014 | 4:24:12 PM
Re: Broadening appeal
@Kelly Jackson Higgins

I understand what the CTF is about I'm talking about applying two factor authentication to call center industry. Much like how you can set up two factor auth for you google log in or reseting of your password. And how would that effect the ablity of the SE needing that second vitial piece of inteligence. Could they get around the need of the second token somehow or would it stop the SE cold in its tracks. I'm thinking basicly industry wide not just in relation to the compitition at Def Con, how can we improve security without increasing finanical overhead when it comes to SE attacks dramaticly.
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
4/8/2014 | 4:19:08 PM
Re: Broadening appeal
I'm not sure what you mean here, @jaingverda. The SE CTF uses open-source research reconn, then the cold calls to random employees at specific target corporations. The callers/contestants pose as customers, contractors, students, etc.
Thomas Claburn
50%
50%
Thomas Claburn,
User Rank: Ninja
4/8/2014 | 4:15:45 PM
Re: Broadening appeal
I think we've found the next popular reality show.
jaingverda
50%
50%
jaingverda,
User Rank: Moderator
4/8/2014 | 3:53:23 PM
Re: Broadening appeal
It is very intresting to watch. How much of a detriment do you think there is to SE hackers when a company enforces two factor authentication though. You know the first half say a manager's name or something but don't have the correct (yubikey) or something to authentcate yourself the rest of the way?
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
4/8/2014 | 2:19:31 PM
Re: Broadening appeal
Agreed, @GonzSTL. That's what makes the SE CTF so important--it really raises awareness of how easy social engineering is to perform, and how human nature, psychology, etc., all come into play. @LornaGarey, it's "entertaining" to watch these live exploits during the CTF, but it's also disconcerting because people naturally want to be helpful, and that's what the bad guys are counting on.
Lorna Garey
50%
50%
Lorna Garey,
User Rank: Ninja
4/8/2014 | 2:13:18 PM
Re: Broadening appeal
KJH, Can you imagine the uproar if these calls or vidoes went public? It would be epic.
GonzSTL
50%
50%
GonzSTL,
User Rank: Ninja
4/8/2014 | 9:25:46 AM
Re: Broadening appeal
Social engineering is a critical part of security awareness training. Bad guys can defeat millions of dollars worth of security infrastructure within minutes through the clever use of social engineering because that exploits the weakest link in any organization - people. Security assessments should have a social engineering component.
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
4/7/2014 | 5:12:29 PM
Re: Broadening appeal
I don't believe the videos will go public, but the real live competition is open to the public at DEF CON. The contestants sit in a soundproof booth, and attendees can sit in the same room and watch and listen. It's really interesting.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
4/7/2014 | 5:10:45 PM
Broadening appeal
So interesting that the social engineering mission is becoming more mainstream.  I wouldn't be surprised if this excercise is at some point adopted as a corporate security awareness excercise. In the meantime, will the public be able to see the finalist videos?
10 Ways to Keep a Rogue RasPi From Wrecking Your Network
Curtis Franklin Jr., Senior Editor at Dark Reading,  7/10/2019
The Security of Cloud Applications
Hillel Solow, CTO and Co-founder, Protego,  7/11/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of Ransomware
The State of Ransomware
Ransomware has become one of the most prevalent new cybersecurity threats faced by today's enterprises. This new report from Dark Reading includes feedback from IT and IT security professionals about their organization's ransomware experiences, defense plans, and malware challenges. Find out what they had to say!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-0234
PUBLISHED: 2019-07-15
A Reflected Cross-site Scripting (XSS) vulnerability exists in Apache Roller. Roller's Math Comment Authenticator did not property sanitize user input and could be exploited to perform Reflected Cross Site Scripting (XSS). The mitigation for this vulnerability is to upgrade to the latest version of ...
CVE-2018-7838
PUBLISHED: 2019-07-15
A CWE-119 Buffer Errors vulnerability exists in Modicon M580 CPU - BMEP582040, all versions before V2.90, and Modicon Ethernet Module BMENOC0301, all versions before V2.16, which could cause denial of service on the FTP service of the controller or the Ethernet BMENOC module when it receives a FTP C...
CVE-2019-6822
PUBLISHED: 2019-07-15
A Use After Free: CWE-416 vulnerability exists in Zelio Soft 2, V5.2 and earlier, which could cause remote code execution when opening a specially crafted Zelio Soft 2 project file.
CVE-2019-6823
PUBLISHED: 2019-07-15
A CWE-94: Code Injection vulnerability exists in ProClima (all versions prior to version 8.0.0) which could allow an unauthenticated, remote attacker to execute arbitrary code on the targeted system in all versions of ProClima prior to version 8.0.0.
CVE-2019-6824
PUBLISHED: 2019-07-15
A CWE-119: Buffer Errors vulnerability exists in ProClima (all versions prior to version 8.0.0) which allows an unauthenticated, remote attacker to execute arbitrary code on the targeted system in all versions of ProClima prior to version 8.0.0.