Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

8/3/2010
06:33 AM
John H. Sawyer
John H. Sawyer
Commentary
50%
50%

Using The 36 Stratagems For Social Engineering

I attended several great presentations during last week's BSides and Defcon. HD's VxWorks, egyp7's phpterpreter, and David Kennedy's SET talks were a few of my favorites, with great content and demos, but one that I found especially refreshing and fun was Jayson Street's "Deceiving the Heavens to Cross the Sea: Using the 36 Stratagems for Social Engineering."

I attended several great presentations during last week's BSides and Defcon. HD's VxWorks, egyp7's phpterpreter, and David Kennedy's SET talks were a few of my favorites, with great content and demos, but one that I found especially refreshing and fun was Jayson Street's "Deceiving the Heavens to Cross the Sea: Using the 36 Stratagems for Social Engineering."Jayson started the talk with a demo stating he could guess what you ate for dinner by simply asking five questions. Instead of guessing what the volunteer ate, he social engineered her into answering three of the questions that led to the compromise of Sarah Palin's Yahoo e-mail account last year. It was a great demo and not unlike so many examples we see in daily life, such as drawings for free gym memberships and e-mail asking you to sign up for a webinar with the chance to win an iPad.

The talk went through some of the history surrounding the 36 stratagems, social engineering, and how social engineering techniques vary by the target's country. Jayson then dug into examples of how the stratagems can be applied to social engineering.

The first stratagem Jayson covered was "#3: Killing with a Borrowed Knife," or in other words, let the employee be the attack vector. Some of the examples included tailgating employees by inserting yourself between a man and woman, then holding the door open for the woman in order to tailgate right in after her. And then there's the poorly sanitized BreakMyNetworkDesign.com examples (need I say more?).

The second stratagem covered was "#13: Scheme with Beauties," during which Jayson covered using Facebook with an attractive profile picture to gain more information about a company by becoming a fan of the company and "friending" its employees. When it's time to communicate with the user via voice, he recommended the World of Warcraft USB headset with preconfigured voice changing capabilities -- his demo of the headset's usage was hilarious.

A few more stratagems were covered, and Jayson also showed off his "vest of doom" that he wears to penetration-testing engagements. It's filled with USB flash drives, USB hard drives, screwdrivers, USB wireless adapter, voice recorder, and much more. When the videos from Defcon are posted, I highly recommend you watch this particular talk, which contains good, practical advice for using social engineering in penetration testing.

You know where I'm going with this? That's right! If you're not doing social engineering during your penetration testing, then your clients aren't getting a true picture of their security posture and likely don't want you to do it because they know it's a common area of weakness. To illustrate my point, here's a story David Kennedy used in his Social Engineering Toolkit (SET) talk at BSidesLV. During his Notacon talk, he asked who was using SET. One person raised his hand and said he's not allowed to use it anymore at work. When Dave asked why, the audience member stated management was tired of a 100% success rate!

Also, Jayson was kind enough to donate copies of his book, "Dissecting the Hack: The F0rb1dd3n Network," to Hackers for Charity and the Electronic Frontier Foundation. Each copy was signed by many wonderful members of the infosec community, and I was the lucky winner of the Hackers for Charity copy. Thank you, HfC and Jayson.

John H. Sawyer is a senior security engineer on the IT Security Team at the University of Florida. The views and opinions expressed in this blog are his own and do not represent the views and opinions of the UF IT Security Team or the University of Florida. When John's not fighting flaming, malware-infested machines or performing autopsies on blitzed boxes, he can usually be found hanging with his family, bouncing a baby on one knee and balancing a laptop on the other. Special to Dark Reading.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
NSA Appoints Rob Joyce as Cyber Director
Dark Reading Staff 1/15/2021
Vulnerability Management Has a Data Problem
Tal Morgenstern, Co-Founder & Chief Product Officer, Vulcan Cyber,  1/14/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This is not what I meant by "I would like to share some desk space"
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-28452
PUBLISHED: 2021-01-20
This affects the package com.softwaremill.akka-http-session:core_2.12 from 0 and before 0.6.1; all versions of package com.softwaremill.akka-http-session:core_2.11; the package com.softwaremill.akka-http-session:core_2.13 from 0 and before 0.6.1. CSRF protection can be bypassed by forging a request ...
CVE-2020-28483
PUBLISHED: 2021-01-20
This affects all versions of package github.com/gin-gonic/gin. When gin is exposed directly to the internet, a client's IP can be spoofed by setting the X-Forwarded-For header.
CVE-2021-21269
PUBLISHED: 2021-01-20
Keymaker is a Mastodon Community Finder based Matrix Community serverlist page Server. In Keymaker before version 0.2.0, the assets endpoint did not check for the extension. The rust `join` method without checking user input might have made it abe to do a Path Traversal attack causing to read more f...
CVE-2020-25686
PUBLISHED: 2021-01-20
A flaw was found in dnsmasq before version 2.83. When receiving a query, dnsmasq does not check for an existing pending request for the same name and forwards a new request. By default, a maximum of 150 pending queries can be sent to upstream servers, so there can be at most 150 queries for the same...
CVE-2020-25687
PUBLISHED: 2021-01-20
A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. This flaw allows a remote attacker, who can create valid DNS replies, to cause an overflow in a heap-allocated memory. This...