Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Home Depot, Other Retailers Get Social Engineered
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
Sara Peters
Sara Peters,
User Rank: Author
9/5/2014 | 11:47:32 AM
first line of defense...
At RSA I spoke to some people at Akamai who do security awareness for their insiders, and they did something that I found kind of awesome and hilarious. They gave out an award for whoever was doing the best job at securing the organization -- which was often all about preventing social engineering. Whoever won that month had the honor of having a stuffed penguin on their desk until someone else was awarded it. 

And the person who kept winning it was not somebody in IT or some executive. 
Marilyn Cohodas
Marilyn Cohodas,
User Rank: Strategist
9/4/2014 | 4:06:03 PM
fascinating thread
Wow! This a great thread. Thanks @SteveMorlan for sharing your experience on the winning team at Social Engineering Capture the Flag (SECTF) competition at DEF CON. Love the details. It really brings the competition to life..
Kelly Jackson Higgins
Kelly Jackson Higgins,
User Rank: Strategist
9/4/2014 | 3:55:53 PM
Re: Ease of Access
It's great that you can take back to your company the firsthand experience of what can happen to employees in social engineering situations.
SteveMorlan
SteveMorlan,
User Rank: Apprentice
9/4/2014 | 3:54:28 PM
Re: Ease of Access
Unfortunately, we likely won't. Chris has not released how the competition will be run next year. Moreover, this year teams were assigned randomly so that experienced individuals were placed with new individuals. 

If I am allowed, I would love to participate again. I found the entire experience rewarding and enjoyable. Moreover, it gives me examples of attacks that could be leveraged against the company I currently work for; allowing us to make changes to our training to incorporate new concerns. 
Kelly Jackson Higgins
Kelly Jackson Higgins,
User Rank: Strategist
9/4/2014 | 3:43:48 PM
Re: Ease of Access
Really, really interesting. It sounds like you two were a good balance of personalities and perspectives.

So--are you thinking you'll form a team for next year?
Kelly Jackson Higgins
Kelly Jackson Higgins,
User Rank: Strategist
9/4/2014 | 3:43:48 PM
Re: Ease of Access
Really, really interesting. It sounds like you two were a good balance of personalities and perspectives.

So--are you thinking you'll form a team for next year?
SteveMorlan
SteveMorlan,
User Rank: Apprentice
9/4/2014 | 3:36:11 PM
Re: Ease of Access
Haha. So, it was very surprising. I have never competed before or used Social Engineering in any professional environment. I had roughly one hour to prepare for the contest before joining Stephanie in the booth, so I didn't. She wrote a script ahead of time, which I glanced at, but none of it flowed nicely with my personality. Consequently, I chose to wing it. She also provided me with a list of flags, which is what I went off of. 

In the booth she initiated the call by grabbing non-tehnical information and then transferring to me, a member of the security team, which was brilliant on her part because it played to stereotypical gender roles. My experience with tech support, sales, and system administration took over from there. 

I was very nervous before sitting down in the booth, but the laughter and cheers from the crowd made it much easier. 
Kelly Jackson Higgins
Kelly Jackson Higgins,
User Rank: Strategist
9/4/2014 | 3:25:47 PM
Re: Ease of Access
Thank you for sharing this insight, Steve. So you were the substitute team member/volunteer for the audience when the other Schmooze Operator member got sick? How hard was that--jumping in?
SteveMorlan
SteveMorlan,
User Rank: Apprentice
9/4/2014 | 3:18:00 PM
Re: Ease of Access
Kelly,

From what I viewed and experienced, antivirus was one of the hardest to acquire, simply because the information was hidden from the employee, not because the employee was not willing. I watched multiple teams acquire phone system info, os version and service pack, computer make and model, vendor information, etc. Once the employee starts giving information, your trust with them builds and they happily hand over information. 

One of the most entertaining flags was asking the individual to navigate to a website. All the teams used the seorg.org address. In many cases, the individual actually went to the site more than once on the same call. What is so funny about this, is that the site says "What is Social Engineering?" in bold font on the top of the page. 

Most importantly, it is not the employees' fault. The majority of these individuals have simply not been trained to handle social engineering. The folks that run the contest do an excellent job of reporting their findings and protecting the individuals involved. I hope that more companies implement training for these types of attacks. 
Kelly Jackson Higgins
Kelly Jackson Higgins,
User Rank: Strategist
9/4/2014 | 2:58:54 PM
Re: Ease of Access
Hi Steve--thanks for your note. I'm curious -- from your perspective, which flags were the most difficult to capture? 
Page 1 / 2   >   >>


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The Promise and Reality of Cloud Security
Cloud security has been part of the cybersecurity conversation for years but has been on the sidelines for most enterprises. The shift to remote work during the COVID-19 pandemic and digital transformation projects have moved cloud infrastructure front-and-center as enterprises address the associated security risks. This report - a compilation of cutting-edge Black Hat research, in-depth Omdia analysis, and comprehensive Dark Reading reporting - explores how cloud security is rapidly evolving.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2023-0560
PUBLISHED: 2023-01-28
A vulnerability, which was classified as critical, has been found in SourceCodester Online Tours & Travels Management System 1.0. This issue affects some unknown processing of the file admin/practice_pdf.php. The manipulation of the argument id leads to sql injection. The attack may be initiated...
CVE-2023-0561
PUBLISHED: 2023-01-28
A vulnerability, which was classified as critical, was found in SourceCodester Online Tours & Travels Management System 1.0. Affected is an unknown function of the file /user/s.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The expl...
CVE-2023-23628
PUBLISHED: 2023-01-28
Metabase is an open source data analytics platform. Affected versions are subject to Exposure of Sensitive Information to an Unauthorized Actor. Sandboxed users shouldn't be able to view data about other Metabase users anywhere in the Metabase application. However, when a sandbox user views the sett...
CVE-2023-23629
PUBLISHED: 2023-01-28
Metabase is an open source data analytics platform. Affected versions are subject to Improper Privilege Management. As intended, recipients of dashboards subscriptions can view the data as seen by the creator of that subscription. This allows someone with greater access to data to create a dashboard...
CVE-2023-23616
PUBLISHED: 2023-01-28
Discourse is an open-source discussion platform. Prior to version 3.0.1 on the `stable` branch and 3.1.0.beta2 on the `beta` and `tests-passed` branches, when submitting a membership request, there is no character limit for the reason provided with the request. This could potentially allow a user to...