Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Database Security
Authentication
Mobile
Privacy
Compliance
Careers and People
Identity & Access Management
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
Comments
Home Depot, Other Retailers Get Social Engineered
Threaded  |  Newest First  |  Oldest First
SteveMorlan
SteveMorlan,
 User Rank: Apprentice
9/4/2014 | 2:52:06 PM
Ease of Access
Thank you for the mention of Schmooze Operators. Stephanie and I had a lot of fun participating in the competition. Perhaps the most concerning part, was the ease at which information was acquired from all of the companies. 

Social Engineering training ought to be implemented as part of the security training at all major companies. Regardless of how many millions of dollars are spent on security devices and services, the weakest link will always be the person that speaks to the public. 
Kelly Jackson Higgins
Kelly Jackson Higgins,
 User Rank: Strategist
9/4/2014 | 2:58:54 PM
Re: Ease of Access
Hi Steve--thanks for your note. I'm curious -- from your perspective, which flags were the most difficult to capture? 
SteveMorlan
SteveMorlan,
 User Rank: Apprentice
9/4/2014 | 3:18:00 PM
Re: Ease of Access
Kelly,

From what I viewed and experienced, antivirus was one of the hardest to acquire, simply because the information was hidden from the employee, not because the employee was not willing. I watched multiple teams acquire phone system info, os version and service pack, computer make and model, vendor information, etc. Once the employee starts giving information, your trust with them builds and they happily hand over information. 

One of the most entertaining flags was asking the individual to navigate to a website. All the teams used the seorg.org address. In many cases, the individual actually went to the site more than once on the same call. What is so funny about this, is that the site says "What is Social Engineering?" in bold font on the top of the page. 

Most importantly, it is not the employees' fault. The majority of these individuals have simply not been trained to handle social engineering. The folks that run the contest do an excellent job of reporting their findings and protecting the individuals involved. I hope that more companies implement training for these types of attacks. 
Kelly Jackson Higgins
Kelly Jackson Higgins,
 User Rank: Strategist
9/4/2014 | 3:25:47 PM
Re: Ease of Access
Thank you for sharing this insight, Steve. So you were the substitute team member/volunteer for the audience when the other Schmooze Operator member got sick? How hard was that--jumping in?
SteveMorlan
SteveMorlan,
 User Rank: Apprentice
9/4/2014 | 3:36:11 PM
Re: Ease of Access
Haha. So, it was very surprising. I have never competed before or used Social Engineering in any professional environment. I had roughly one hour to prepare for the contest before joining Stephanie in the booth, so I didn't. She wrote a script ahead of time, which I glanced at, but none of it flowed nicely with my personality. Consequently, I chose to wing it. She also provided me with a list of flags, which is what I went off of. 

In the booth she initiated the call by grabbing non-tehnical information and then transferring to me, a member of the security team, which was brilliant on her part because it played to stereotypical gender roles. My experience with tech support, sales, and system administration took over from there. 

I was very nervous before sitting down in the booth, but the laughter and cheers from the crowd made it much easier. 
Kelly Jackson Higgins
Kelly Jackson Higgins,
 User Rank: Strategist
9/4/2014 | 3:43:48 PM
Re: Ease of Access
Really, really interesting. It sounds like you two were a good balance of personalities and perspectives.

So--are you thinking you'll form a team for next year?
SteveMorlan
SteveMorlan,
 User Rank: Apprentice
9/4/2014 | 3:54:28 PM
Re: Ease of Access
Unfortunately, we likely won't. Chris has not released how the competition will be run next year. Moreover, this year teams were assigned randomly so that experienced individuals were placed with new individuals. 

If I am allowed, I would love to participate again. I found the entire experience rewarding and enjoyable. Moreover, it gives me examples of attacks that could be leveraged against the company I currently work for; allowing us to make changes to our training to incorporate new concerns. 
Kelly Jackson Higgins
Kelly Jackson Higgins,
 User Rank: Strategist
9/4/2014 | 3:55:53 PM
Re: Ease of Access
It's great that you can take back to your company the firsthand experience of what can happen to employees in social engineering situations.
Marilyn Cohodas
Marilyn Cohodas,
 User Rank: Strategist
9/4/2014 | 4:06:03 PM
fascinating thread
Wow! This a great thread. Thanks @SteveMorlan for sharing your experience on the winning team at Social Engineering Capture the Flag (SECTF) competition at DEF CON. Love the details. It really brings the competition to life..
Kelly Jackson Higgins
Kelly Jackson Higgins,
 User Rank: Strategist
9/4/2014 | 3:43:48 PM
Re: Ease of Access
Really, really interesting. It sounds like you two were a good balance of personalities and perspectives.

So--are you thinking you'll form a team for next year?
Sara Peters
Sara Peters,
 User Rank: Author
9/5/2014 | 11:47:32 AM
first line of defense...
At RSA I spoke to some people at Akamai who do security awareness for their insiders, and they did something that I found kind of awesome and hilarious. They gave out an award for whoever was doing the best job at securing the organization -- which was often all about preventing social engineering. Whoever won that month had the honor of having a stuffed penguin on their desk until someone else was awarded it. 

And the person who kept winning it was not somebody in IT or some executive. 


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The 10 Most Impactful Types of Vulnerabilities for Enterprises Today
Managing system vulnerabilities is one of the old est - and most frustrating - security challenges that enterprise defenders face. Every software application and hardware device ships with intrinsic flaws - flaws that, if critical enough, attackers can exploit from anywhere in the world. It's crucial that defenders take stock of what areas of the tech stack have the most emerging, and critical, vulnerabilities they must manage. It's not just zero day vulnerabilities. Consider that CISA's Known Exploited Vulnerabilities (KEV) catalog lists vulnerabilitlies in widely used applications that are "actively exploited," and most of them are flaws that were discovered several years ago and have been fixed. There are also emerging vulnerabilities in 5G networks, cloud infrastructure, Edge applications, and firmwares to consider.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2023-1142
PUBLISHED: 2023-03-27
In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an attacker could use URL decoding to retrieve system files, credentials, and bypass authentication resulting in privilege escalation.
CVE-2023-1143
PUBLISHED: 2023-03-27
In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an attacker could use Lua scripts, which could allow an attacker to remotely execute arbitrary code.
CVE-2023-1144
PUBLISHED: 2023-03-27
Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contains an improper access control vulnerability in which an attacker can use the Device-Gateway service and bypass authorization, which could result in privilege escalation.
CVE-2023-1145
PUBLISHED: 2023-03-27
Delta Electronics InfraSuite Device Master versions prior to 1.0.5 are affected by a deserialization vulnerability targeting the Device-DataCollect service, which could allow deserialization of requests prior to authentication, resulting in remote code execution.
CVE-2023-1655
PUBLISHED: 2023-03-27
Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.4.0.