Tech Insight: DEF CON 21 Highlights Dangers Of Social Engineering

Popular contest and presentation show real risks associated with social engineering

We hear about the dangers of social engineering and see phishing e-mail messages come in an attempt to steal user credentials, but it isnt always clear just how effective social engineering can be. The recent
DEF CON 21
conference in Las Vegas, however, offered up a chance to see the powerful effects of social engineering through contests and presentations highlighting the dangers.
The popular
Social Engineering Capture the Flag
(SECTF) competition returned for its fifth year and pitted some of the best social engineers against each other. The contest was to see who is best at scouring the Internet for details about a company and then milking that companys users for information over the phone.
The contestants are given time prior to the conference to research the companies that have been selected as targets. During the conference, each contestant is put in a soundproof room and given 20 minutes to call the company and trick employees into giving them as much information as possible.
SECTF participants are looking to gather the same types of information that an actual attacker would be interested in -- things like the operating systems in use, if tech support is handled in-house or by a third party, wireless network details, employee-specific information, and the names of vendors used for security guards, trash handling, and janitorial services.
According to the organizers, the goal of SECTF is to raise awareness of the threat that social engineering poses for companies and their customers. The contestants demonstrate attacks commonly used by malicious attackers. The difference is that strict rules are in place during the contest to prevent loss from being broken, personal information being obtained and exposed, and abuse of the targets employees.
One of the highest scoring activities that a contestant can perform is manipulating a target into visiting a specific website. While some security professionals may not see this as a big threat because of the security controls they have in place, the presentation by Dave Kennedy, TrustedSec founder and principal security consultant, and Nick Hitchcock, TrustedSec senior security consultant, will certainly make them think otherwise.
During Kennedy and Hitchcocks talk,
The Dirty South -- Getting Justified with Technology
, the presenters focused on 12 steps that companies can use to develop a more secure environment without losing sight of business needs. With a focus on getting back to the basics of security, they outlined an iterative and reflective approach that starts with traditional defensive strategies and security controls, includes education and awareness, and provides a feedback loop to make sure successful processes continue as the process starts back at step 1.
To drive home their message, the presenters arranged for a live social-engineering demonstration against an actual client to demonstrate how even the latest and greatest security technologies are not enough to protect enterprise networks. Kennedy and Hitchcock enlisted well-known social engineer Kevin Mitnick to carry out the attack and trick a user into visiting a website that had been set up to exploit the users Web browser.
Just before the attack, Kennedy called his client to confirm they still had permission to proceed and ask a few questions about the security products in place. The client confirmed that it had a next-generation firewall by one of the top providers, application whitelisting, egress filtering, and SMTP sandboxing technology. Then Mitnick went to work convincing one of the clients users over the phone that he needed to fill out a health benefits form online.
When the user opened the website in Internet Explorer and clicked yes on a pop-up, Mitnick said the user had accepted the new policy form and was done. At the same time, numerous remote Metasploit Meterpreter backdoor sessions showed up on the presenters screens in front of the DEF CON audience, causing cheers and applause. Combined with Mitnicks social-engineering skills and new features in Kennedys Social Engineering Toolkit (SET), the presenters had just bypassed many hundreds of thousands of dollars of security technologies in front of a live audience.
Even with all of those security solutions in place, their attack was successful and demonstrated how an actual malicious attacker could carry out the same attack. When asked in an interview with Dark Reading about the live demo, Kennedy said, I wanted to show that we as an industry are trying to take shortcuts to fix problems. The latest security products arent going to protect you against hackers -- vulnerability scans, yes, but not the hackers.
Those solutions and shortcuts end up leaving companies with a false sense of security. Kennedy told Dark Reading that his goal is to get the information out there through his presentation and tools like SET. If the information isnt available, people cant use it to make systems more secure. SET has brought what we can do to the forefront through penetration testing and social engineering.
With their presentation and the SECTF, DEF CON 21 attendees certainly got a dose of awareness regarding the dangers of social engineering and the ease in which it can be used to help defeat next-generation security technologies. The question now is whether companies will use this knowledge or keep looking for shortcuts.
Have a comment on this story? Please click Add Your Comment below. If youd like to contact
Dark Readings
editors directly,
send us a message
.

Last News
▸ IoT Devices on Average Have 25 Vulnerabilities ◂ Discovered: 23/12/2024 Category: security	▸ DHS-funded SWAMP scans code for bugs. ◂ Discovered: 23/12/2024 Category: security	▸ Debunking Machine Learning in Security. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Tech Insight: DEF CON 21 Highlights Dangers Of Social Engineering