Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

8/3/2010
06:33 AM
John H. Sawyer
John H. Sawyer
Commentary
50%
50%

Using The 36 Stratagems For Social Engineering

I attended several great presentations during last week's BSides and Defcon. HD's VxWorks, egyp7's phpterpreter, and David Kennedy's SET talks were a few of my favorites, with great content and demos, but one that I found especially refreshing and fun was Jayson Street's "Deceiving the Heavens to Cross the Sea: Using the 36 Stratagems for Social Engineering."

I attended several great presentations during last week's BSides and Defcon. HD's VxWorks, egyp7's phpterpreter, and David Kennedy's SET talks were a few of my favorites, with great content and demos, but one that I found especially refreshing and fun was Jayson Street's "Deceiving the Heavens to Cross the Sea: Using the 36 Stratagems for Social Engineering."Jayson started the talk with a demo stating he could guess what you ate for dinner by simply asking five questions. Instead of guessing what the volunteer ate, he social engineered her into answering three of the questions that led to the compromise of Sarah Palin's Yahoo e-mail account last year. It was a great demo and not unlike so many examples we see in daily life, such as drawings for free gym memberships and e-mail asking you to sign up for a webinar with the chance to win an iPad.

The talk went through some of the history surrounding the 36 stratagems, social engineering, and how social engineering techniques vary by the target's country. Jayson then dug into examples of how the stratagems can be applied to social engineering.

The first stratagem Jayson covered was "#3: Killing with a Borrowed Knife," or in other words, let the employee be the attack vector. Some of the examples included tailgating employees by inserting yourself between a man and woman, then holding the door open for the woman in order to tailgate right in after her. And then there's the poorly sanitized BreakMyNetworkDesign.com examples (need I say more?).

The second stratagem covered was "#13: Scheme with Beauties," during which Jayson covered using Facebook with an attractive profile picture to gain more information about a company by becoming a fan of the company and "friending" its employees. When it's time to communicate with the user via voice, he recommended the World of Warcraft USB headset with preconfigured voice changing capabilities -- his demo of the headset's usage was hilarious.

A few more stratagems were covered, and Jayson also showed off his "vest of doom" that he wears to penetration-testing engagements. It's filled with USB flash drives, USB hard drives, screwdrivers, USB wireless adapter, voice recorder, and much more. When the videos from Defcon are posted, I highly recommend you watch this particular talk, which contains good, practical advice for using social engineering in penetration testing.

You know where I'm going with this? That's right! If you're not doing social engineering during your penetration testing, then your clients aren't getting a true picture of their security posture and likely don't want you to do it because they know it's a common area of weakness. To illustrate my point, here's a story David Kennedy used in his Social Engineering Toolkit (SET) talk at BSidesLV. During his Notacon talk, he asked who was using SET. One person raised his hand and said he's not allowed to use it anymore at work. When Dave asked why, the audience member stated management was tired of a 100% success rate!

Also, Jayson was kind enough to donate copies of his book, "Dissecting the Hack: The F0rb1dd3n Network," to Hackers for Charity and the Electronic Frontier Foundation. Each copy was signed by many wonderful members of the infosec community, and I was the lucky winner of the Hackers for Charity copy. Thank you, HfC and Jayson.

John H. Sawyer is a senior security engineer on the IT Security Team at the University of Florida. The views and opinions expressed in this blog are his own and do not represent the views and opinions of the UF IT Security Team or the University of Florida. When John's not fighting flaming, malware-infested machines or performing autopsies on blitzed boxes, he can usually be found hanging with his family, bouncing a baby on one knee and balancing a laptop on the other. Special to Dark Reading.

 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/10/2020
Researcher Finds New Office Macro Attacks for MacOS
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/7/2020
Exploiting Google Cloud Platform With Ease
Dark Reading Staff 8/6/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: They said you could use Zoom anywhere.......
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-13285
PUBLISHED: 2020-08-13
For GitLab before 13.0.12, 13.1.6, 13.2.3 a cross-site scripting vulnerability exists in the issue reference number tooltip.
CVE-2020-16087
PUBLISHED: 2020-08-13
An issue was discovered in Zalo.exe in VNG Zalo Desktop 19.8.1.0. An attacker can run arbitrary commands on a remote Windows machine running the Zalo client by sending the user of the device a crafted file.
CVE-2020-17463
PUBLISHED: 2020-08-13
FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items.
CVE-2019-16374
PUBLISHED: 2020-08-13
Pega Platform 8.2.1 allows LDAP injection because a username can contain a * character and can be of unlimited length. An attacker can specify four characters of a username, followed by the * character, to bypass access control.
CVE-2020-13280
PUBLISHED: 2020-08-13
For GitLab before 13.0.12, 13.1.6, 13.2.3 a memory exhaustion flaw exists due to excessive logging of an invite email error message.