Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

Tech Insight: DEF CON 21 Highlights Dangers Of Social Engineering

Popular contest and presentation show real risks associated with social engineering

We hear about the dangers of social engineering and see phishing e-mail messages come in an attempt to steal user credentials, but it isn't always clear just how effective social engineering can be. The recent DEF CON 21 conference in Las Vegas, however, offered up a chance to see the powerful effects of social engineering through contests and presentations highlighting the dangers.

The popular Social Engineering Capture the Flag (SECTF) competition returned for its fifth year and pitted some of the best social engineers against each other. The contest was to see who is best at scouring the Internet for details about a company and then milking that company's users for information over the phone.

The contestants are given time prior to the conference to research the companies that have been selected as targets. During the conference, each contestant is put in a soundproof room and given 20 minutes to call the company and trick employees into giving them as much information as possible.

SECTF participants are looking to gather the same types of information that an actual attacker would be interested in -- things like the operating systems in use, if tech support is handled in-house or by a third party, wireless network details, employee-specific information, and the names of vendors used for security guards, trash handling, and janitorial services.

According to the organizers, the goal of SECTF is to raise awareness of the threat that social engineering poses for companies and their customers. The contestants demonstrate attacks commonly used by malicious attackers. The difference is that strict rules are in place during the contest to prevent loss from being broken, personal information being obtained and exposed, and abuse of the target's employees.

One of the highest scoring activities that a contestant can perform is manipulating a target into visiting a specific website. While some security professionals may not see this as a big threat because of the security controls they have in place, the presentation by Dave Kennedy, TrustedSec founder and principal security consultant, and Nick Hitchcock, TrustedSec senior security consultant, will certainly make them think otherwise.

During Kennedy and Hitchcock's talk, "The Dirty South -- Getting Justified with Technology," the presenters focused on 12 steps that companies can use to develop a more secure environment without losing sight of business needs. With a focus on getting back to the basics of security, they outlined an iterative and reflective approach that starts with traditional defensive strategies and security controls, includes education and awareness, and provides a feedback loop to make sure successful processes continue as the process starts back at step 1.

To drive home their message, the presenters arranged for a live social-engineering demonstration against an actual client to demonstrate how even the latest and greatest security technologies are not enough to protect enterprise networks. Kennedy and Hitchcock enlisted well-known social engineer Kevin Mitnick to carry out the attack and trick a user into visiting a website that had been set up to exploit the user's Web browser.

Just before the attack, Kennedy called his client to confirm they still had permission to proceed and ask a few questions about the security products in place. The client confirmed that it had a next-generation firewall by one of the top providers, application whitelisting, egress filtering, and SMTP sandboxing technology. Then Mitnick went to work convincing one of the client's users over the phone that he needed to fill out a health benefits form online.

When the user opened the website in Internet Explorer and clicked "yes" on a pop-up, Mitnick said the user had accepted the new policy form and was done. At the same time, numerous remote Metasploit Meterpreter backdoor sessions showed up on the presenter's screens in front of the DEF CON audience, causing cheers and applause. Combined with Mitnick's social-engineering skills and new features in Kennedy's Social Engineering Toolkit (SET), the presenters had just bypassed many hundreds of thousands of dollars of security technologies in front of a live audience.

Even with all of those security solutions in place, their attack was successful and demonstrated how an actual malicious attacker could carry out the same attack. When asked in an interview with Dark Reading about the live demo, Kennedy said, "I wanted to show that we as an industry are trying to take shortcuts to fix problems. The latest security products aren't going to protect you against hackers -- vulnerability scans, yes, but not the hackers."

Those solutions and shortcuts end up leaving companies with a false sense of security. Kennedy told Dark Reading that his goal is to get the information out there through his presentation and tools like SET. "If the information isn't available, people can't use it to make systems more secure. SET has brought what we can do to the forefront through penetration testing and social engineering."

With their presentation and the SECTF, DEF CON 21 attendees certainly got a dose of awareness regarding the dangers of social engineering and the ease in which it can be used to help defeat "next-generation" security technologies. The question now is whether companies will use this knowledge or keep looking for shortcuts.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Why Cyber-Risk Is a C-Suite Issue
Marc Wilczek, Digital Strategist & CIO Advisor,  11/12/2019
DevSecOps: The Answer to the Cloud Security Skills Gap
Lamont Orange, Chief Information Security Officer at Netskope,  11/15/2019
Attackers' Costs Increasing as Businesses Focus on Security
Robert Lemos, Contributing Writer,  11/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19040
PUBLISHED: 2019-11-17
KairosDB through 1.2.2 has XSS in view.html because of showErrorMessage in js/graph.js, as demonstrated by view.html?q= with a '"sampling":{"value":"<script>' substring.
CVE-2019-19041
PUBLISHED: 2019-11-17
An issue was discovered in Xorux Lpar2RRD 6.11 and Stor2RRD 2.61, as distributed in Xorux 2.41. They do not correctly verify the integrity of an upgrade package before processing it. As a result, official upgrade packages can be modified to inject an arbitrary Bash script that will be executed by th...
CVE-2019-19012
PUBLISHED: 2019-11-17
An integer overflow in the search_in_range function in regexec.c in Oniguruma 6.x before 6.9.4_rc2 leads to an out-of-bounds read, in which the offset of this read is under the control of an attacker. (This only affects the 32-bit compiled version). Remote attackers can cause a denial-of-service or ...
CVE-2019-19022
PUBLISHED: 2019-11-17
iTerm2 through 3.3.6 has potentially insufficient documentation about the presence of search history in com.googlecode.iterm2.plist, which might allow remote attackers to obtain sensitive information, as demonstrated by searching for the NoSyncSearchHistory string in .plist files within public Git r...
CVE-2019-19035
PUBLISHED: 2019-11-17
jhead 3.03 is affected by: heap-based buffer over-read. The impact is: Denial of service. The component is: ReadJpegSections and process_SOFn in jpgfile.c. The attack vector is: Open a specially crafted JPEG file.