Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Home Depot, Other Retailers Get Social Engineered
Oldest First  |  Newest First  |  Threaded View
Page 1 / 2   >   >>
SteveMorlan
100%
0%
SteveMorlan,
User Rank: Apprentice
9/4/2014 | 2:52:06 PM
Ease of Access
Thank you for the mention of Schmooze Operators. Stephanie and I had a lot of fun participating in the competition. Perhaps the most concerning part, was the ease at which information was acquired from all of the companies. 

Social Engineering training ought to be implemented as part of the security training at all major companies. Regardless of how many millions of dollars are spent on security devices and services, the weakest link will always be the person that speaks to the public. 
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
9/4/2014 | 2:58:54 PM
Re: Ease of Access
Hi Steve--thanks for your note. I'm curious -- from your perspective, which flags were the most difficult to capture? 
SteveMorlan
50%
50%
SteveMorlan,
User Rank: Apprentice
9/4/2014 | 3:18:00 PM
Re: Ease of Access
Kelly,

From what I viewed and experienced, antivirus was one of the hardest to acquire, simply because the information was hidden from the employee, not because the employee was not willing. I watched multiple teams acquire phone system info, os version and service pack, computer make and model, vendor information, etc. Once the employee starts giving information, your trust with them builds and they happily hand over information. 

One of the most entertaining flags was asking the individual to navigate to a website. All the teams used the seorg.org address. In many cases, the individual actually went to the site more than once on the same call. What is so funny about this, is that the site says "What is Social Engineering?" in bold font on the top of the page. 

Most importantly, it is not the employees' fault. The majority of these individuals have simply not been trained to handle social engineering. The folks that run the contest do an excellent job of reporting their findings and protecting the individuals involved. I hope that more companies implement training for these types of attacks. 
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
9/4/2014 | 3:25:47 PM
Re: Ease of Access
Thank you for sharing this insight, Steve. So you were the substitute team member/volunteer for the audience when the other Schmooze Operator member got sick? How hard was that--jumping in?
SteveMorlan
100%
0%
SteveMorlan,
User Rank: Apprentice
9/4/2014 | 3:36:11 PM
Re: Ease of Access
Haha. So, it was very surprising. I have never competed before or used Social Engineering in any professional environment. I had roughly one hour to prepare for the contest before joining Stephanie in the booth, so I didn't. She wrote a script ahead of time, which I glanced at, but none of it flowed nicely with my personality. Consequently, I chose to wing it. She also provided me with a list of flags, which is what I went off of. 

In the booth she initiated the call by grabbing non-tehnical information and then transferring to me, a member of the security team, which was brilliant on her part because it played to stereotypical gender roles. My experience with tech support, sales, and system administration took over from there. 

I was very nervous before sitting down in the booth, but the laughter and cheers from the crowd made it much easier. 
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
9/4/2014 | 3:43:48 PM
Re: Ease of Access
Really, really interesting. It sounds like you two were a good balance of personalities and perspectives.

So--are you thinking you'll form a team for next year?
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
9/4/2014 | 3:43:48 PM
Re: Ease of Access
Really, really interesting. It sounds like you two were a good balance of personalities and perspectives.

So--are you thinking you'll form a team for next year?
SteveMorlan
50%
50%
SteveMorlan,
User Rank: Apprentice
9/4/2014 | 3:54:28 PM
Re: Ease of Access
Unfortunately, we likely won't. Chris has not released how the competition will be run next year. Moreover, this year teams were assigned randomly so that experienced individuals were placed with new individuals. 

If I am allowed, I would love to participate again. I found the entire experience rewarding and enjoyable. Moreover, it gives me examples of attacks that could be leveraged against the company I currently work for; allowing us to make changes to our training to incorporate new concerns. 
Kelly Jackson Higgins
100%
0%
Kelly Jackson Higgins,
User Rank: Strategist
9/4/2014 | 3:55:53 PM
Re: Ease of Access
It's great that you can take back to your company the firsthand experience of what can happen to employees in social engineering situations.
Marilyn Cohodas
100%
0%
Marilyn Cohodas,
User Rank: Strategist
9/4/2014 | 4:06:03 PM
fascinating thread
Wow! This a great thread. Thanks @SteveMorlan for sharing your experience on the winning team at Social Engineering Capture the Flag (SECTF) competition at DEF CON. Love the details. It really brings the competition to life..
Page 1 / 2   >   >>


News
FluBot Malware's Rapid Spread May Soon Hit US Phones
Kelly Sheridan, Staff Editor, Dark Reading,  4/28/2021
Slideshows
7 Modern-Day Cybersecurity Realities
Steve Zurier, Contributing Writer,  4/30/2021
Commentary
How to Secure Employees' Home Wi-Fi Networks
Bert Kashyap, CEO and Co-Founder at SecureW2,  4/28/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-31755
PUBLISHED: 2021-05-07
An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /goform/setmac allows attackers to execute arbitrary code on the system via a crafted post request.
CVE-2021-31756
PUBLISHED: 2021-05-07
An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /gofrom/setwanType allows attackers to execute arbitrary code on the system via a crafted post request. This occurs when input vector controlled by malicious attack get copie...
CVE-2021-31757
PUBLISHED: 2021-05-07
An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /goform/setVLAN allows attackers to execute arbitrary code on the system via a crafted post request.
CVE-2021-31758
PUBLISHED: 2021-05-07
An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /goform/setportList allows attackers to execute arbitrary code on the system via a crafted post request.
CVE-2021-31458
PUBLISHED: 2021-05-07
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handlin...