Vulnerabilities / Threats

8/16/2013
09:38 PM
50%
50%

Tech Insight: DEF CON 21 Highlights Dangers Of Social Engineering

Popular contest and presentation show real risks associated with social engineering

We hear about the dangers of social engineering and see phishing e-mail messages come in an attempt to steal user credentials, but it isn't always clear just how effective social engineering can be. The recent DEF CON 21 conference in Las Vegas, however, offered up a chance to see the powerful effects of social engineering through contests and presentations highlighting the dangers.

The popular Social Engineering Capture the Flag (SECTF) competition returned for its fifth year and pitted some of the best social engineers against each other. The contest was to see who is best at scouring the Internet for details about a company and then milking that company's users for information over the phone.

The contestants are given time prior to the conference to research the companies that have been selected as targets. During the conference, each contestant is put in a soundproof room and given 20 minutes to call the company and trick employees into giving them as much information as possible.

SECTF participants are looking to gather the same types of information that an actual attacker would be interested in -- things like the operating systems in use, if tech support is handled in-house or by a third party, wireless network details, employee-specific information, and the names of vendors used for security guards, trash handling, and janitorial services.

According to the organizers, the goal of SECTF is to raise awareness of the threat that social engineering poses for companies and their customers. The contestants demonstrate attacks commonly used by malicious attackers. The difference is that strict rules are in place during the contest to prevent loss from being broken, personal information being obtained and exposed, and abuse of the target's employees.

One of the highest scoring activities that a contestant can perform is manipulating a target into visiting a specific website. While some security professionals may not see this as a big threat because of the security controls they have in place, the presentation by Dave Kennedy, TrustedSec founder and principal security consultant, and Nick Hitchcock, TrustedSec senior security consultant, will certainly make them think otherwise.

During Kennedy and Hitchcock's talk, "The Dirty South -- Getting Justified with Technology," the presenters focused on 12 steps that companies can use to develop a more secure environment without losing sight of business needs. With a focus on getting back to the basics of security, they outlined an iterative and reflective approach that starts with traditional defensive strategies and security controls, includes education and awareness, and provides a feedback loop to make sure successful processes continue as the process starts back at step 1.

To drive home their message, the presenters arranged for a live social-engineering demonstration against an actual client to demonstrate how even the latest and greatest security technologies are not enough to protect enterprise networks. Kennedy and Hitchcock enlisted well-known social engineer Kevin Mitnick to carry out the attack and trick a user into visiting a website that had been set up to exploit the user's Web browser.

Just before the attack, Kennedy called his client to confirm they still had permission to proceed and ask a few questions about the security products in place. The client confirmed that it had a next-generation firewall by one of the top providers, application whitelisting, egress filtering, and SMTP sandboxing technology. Then Mitnick went to work convincing one of the client's users over the phone that he needed to fill out a health benefits form online.

When the user opened the website in Internet Explorer and clicked "yes" on a pop-up, Mitnick said the user had accepted the new policy form and was done. At the same time, numerous remote Metasploit Meterpreter backdoor sessions showed up on the presenter's screens in front of the DEF CON audience, causing cheers and applause. Combined with Mitnick's social-engineering skills and new features in Kennedy's Social Engineering Toolkit (SET), the presenters had just bypassed many hundreds of thousands of dollars of security technologies in front of a live audience.

Even with all of those security solutions in place, their attack was successful and demonstrated how an actual malicious attacker could carry out the same attack. When asked in an interview with Dark Reading about the live demo, Kennedy said, "I wanted to show that we as an industry are trying to take shortcuts to fix problems. The latest security products aren't going to protect you against hackers -- vulnerability scans, yes, but not the hackers."

Those solutions and shortcuts end up leaving companies with a false sense of security. Kennedy told Dark Reading that his goal is to get the information out there through his presentation and tools like SET. "If the information isn't available, people can't use it to make systems more secure. SET has brought what we can do to the forefront through penetration testing and social engineering."

With their presentation and the SECTF, DEF CON 21 attendees certainly got a dose of awareness regarding the dangers of social engineering and the ease in which it can be used to help defeat "next-generation" security technologies. The question now is whether companies will use this knowledge or keep looking for shortcuts.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Veterans Find New Roles in Enterprise Cybersecurity
Kelly Sheridan, Staff Editor, Dark Reading,  11/12/2018
Empathy: The Next Killer App for Cybersecurity?
Shay Colson, CISSP, Senior Manager, CyberClarity360,  11/13/2018
Understanding Evil Twin AP Attacks and How to Prevent Them
Ryan Orsi, Director of Product Management for Wi-Fi at WatchGuard Technologies,  11/14/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
Online Malware and Threats: A Profile of Today's Security Posture
Online Malware and Threats: A Profile of Today's Security Posture
This report offers insight on how security professionals plan to invest in cybersecurity, and how they are prioritizing their resources. Find out what your peers have planned today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-15759
PUBLISHED: 2018-11-19
Pivotal Cloud Foundry On Demand Services SDK, versions prior to 0.24 contain an insecure method of verifying credentials. A remote unauthenticated malicious user may make many requests to the service broker with different credentials, allowing them to infer valid credentials and gain access to perfo...
CVE-2018-15761
PUBLISHED: 2018-11-19
Cloud Foundry UAA release, versions prior to v64.0, and UAA, versions prior to 4.23.0, contains a validation error which allows for privilege escalation. A remote authenticated user may modify the url and content of a consent page to gain a token with arbitrary scopes that escalates their privileges...
CVE-2018-17190
PUBLISHED: 2018-11-19
In all versions of Apache Spark, its standalone resource manager accepts code to execute on a 'master' host, that then runs that code on 'worker' hosts. The master itself does not, by design, execute user code. A specially-crafted request to the master can, however, cause the master to execute code ...
CVE-2018-1841
PUBLISHED: 2018-11-19
IBM Cloud Private 2.1.0 could allow a local user to obtain the CA Private Key due to it being world readable in boot/master node. IBM X-Force ID: 150901.
CVE-2018-18519
PUBLISHED: 2018-11-19
BestXsoftware Best Free Keylogger 5.2.9 allows local users to gain privileges via a Trojan horse "%PROGRAMFILES%\BFK 5.2.9\syscrb.exe" file because of insecure permissions for the BUILTIN\Users group.