Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

8/3/2010
06:33 AM
John H. Sawyer
John H. Sawyer
Commentary
50%
50%

Using The 36 Stratagems For Social Engineering

I attended several great presentations during last week's BSides and Defcon. HD's VxWorks, egyp7's phpterpreter, and David Kennedy's SET talks were a few of my favorites, with great content and demos, but one that I found especially refreshing and fun was Jayson Street's "Deceiving the Heavens to Cross the Sea: Using the 36 Stratagems for Social Engineering."

I attended several great presentations during last week's BSides and Defcon. HD's VxWorks, egyp7's phpterpreter, and David Kennedy's SET talks were a few of my favorites, with great content and demos, but one that I found especially refreshing and fun was Jayson Street's "Deceiving the Heavens to Cross the Sea: Using the 36 Stratagems for Social Engineering."Jayson started the talk with a demo stating he could guess what you ate for dinner by simply asking five questions. Instead of guessing what the volunteer ate, he social engineered her into answering three of the questions that led to the compromise of Sarah Palin's Yahoo e-mail account last year. It was a great demo and not unlike so many examples we see in daily life, such as drawings for free gym memberships and e-mail asking you to sign up for a webinar with the chance to win an iPad.

The talk went through some of the history surrounding the 36 stratagems, social engineering, and how social engineering techniques vary by the target's country. Jayson then dug into examples of how the stratagems can be applied to social engineering.

The first stratagem Jayson covered was "#3: Killing with a Borrowed Knife," or in other words, let the employee be the attack vector. Some of the examples included tailgating employees by inserting yourself between a man and woman, then holding the door open for the woman in order to tailgate right in after her. And then there's the poorly sanitized BreakMyNetworkDesign.com examples (need I say more?).

The second stratagem covered was "#13: Scheme with Beauties," during which Jayson covered using Facebook with an attractive profile picture to gain more information about a company by becoming a fan of the company and "friending" its employees. When it's time to communicate with the user via voice, he recommended the World of Warcraft USB headset with preconfigured voice changing capabilities -- his demo of the headset's usage was hilarious.

A few more stratagems were covered, and Jayson also showed off his "vest of doom" that he wears to penetration-testing engagements. It's filled with USB flash drives, USB hard drives, screwdrivers, USB wireless adapter, voice recorder, and much more. When the videos from Defcon are posted, I highly recommend you watch this particular talk, which contains good, practical advice for using social engineering in penetration testing.

You know where I'm going with this? That's right! If you're not doing social engineering during your penetration testing, then your clients aren't getting a true picture of their security posture and likely don't want you to do it because they know it's a common area of weakness. To illustrate my point, here's a story David Kennedy used in his Social Engineering Toolkit (SET) talk at BSidesLV. During his Notacon talk, he asked who was using SET. One person raised his hand and said he's not allowed to use it anymore at work. When Dave asked why, the audience member stated management was tired of a 100% success rate!

Also, Jayson was kind enough to donate copies of his book, "Dissecting the Hack: The F0rb1dd3n Network," to Hackers for Charity and the Electronic Frontier Foundation. Each copy was signed by many wonderful members of the infosec community, and I was the lucky winner of the Hackers for Charity copy. Thank you, HfC and Jayson.

John H. Sawyer is a senior security engineer on the IT Security Team at the University of Florida. The views and opinions expressed in this blog are his own and do not represent the views and opinions of the UF IT Security Team or the University of Florida. When John's not fighting flaming, malware-infested machines or performing autopsies on blitzed boxes, he can usually be found hanging with his family, bouncing a baby on one knee and balancing a laptop on the other. Special to Dark Reading.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
DevSecOps: The Answer to the Cloud Security Skills Gap
Lamont Orange, Chief Information Security Officer at Netskope,  11/15/2019
Attackers' Costs Increasing as Businesses Focus on Security
Robert Lemos, Contributing Writer,  11/15/2019
Human Nature vs. AI: A False Dichotomy?
John McClurg, Sr. VP & CISO, BlackBerry,  11/18/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: -when I told you that our cyber-defense was from another age
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-15073
PUBLISHED: 2019-11-20
An Open Redirect vulnerability for all browsers in MAIL2000 through version 6.0 and 7.0, which will redirect to a malicious site without authentication. This vulnerability affects many mail system of governments, organizations, companies and universities.
CVE-2019-15072
PUBLISHED: 2019-11-20
The login feature in "/cgi-bin/portal" in MAIL2000 through version 6.0 and 7.0 has a cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code via any parameter. This vulnerability affects many mail system of governments, organizations, companies and universities.
CVE-2019-15071
PUBLISHED: 2019-11-20
The "/cgi-bin/go" page in MAIL2000 through version 6.0 and 7.0 has a cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code via ACTION parameter without authentication. The code can executed for any user accessing the page. This vulnerability affects many mail syste...
CVE-2019-6176
PUBLISHED: 2019-11-20
A potential vulnerability reported in ThinkPad USB-C Dock Firmware version 3.7.2 may allow a denial of service.
CVE-2019-6184
PUBLISHED: 2019-11-20
A potential vulnerability in the discontinued Customer Engagement Service (CCSDK) software version 2.0.21.1 may allow local privilege escalation.