Big corporations "hacked" in Defcon social engineering contest
Posted on 08 August 2011.
Most of the recent high-profile cyber attacks against corporations and government organizations have one thing in common - they all started with a successful social engineering attempt.


It often takes the form of a specially crafted email carrying malware disguised as a legitimate corporate document or links that take the recipient to a site that exploits vulnerabilities in the software he uses, but successful social engineering can also take the form of asking directly what you want to know.

And it is precisely that approach that has been tested for the second year in a row during the Defcon conference in Las Vegas.

The capture-the-flag-style competition involved contestants placing phone calls to employees of companies such as Oracle, AT&T, Delta Air Lines, Symantec and Apple, and trying to trick them into revealing information such as the company's backup and data securing practices, wireless network use, names of companies whose employees have physical access to the company offices (providers of toner and copier paper, onsite security, etc.), and more.

Last year's edition of the competition has proved that such attempts are often successful - out of some fifty employees approached via phone by the contestants, only three became suspicious and terminated the call without divulging any information.

This year, the company whose employees proved the least prepared to fend off such attacks was Oracle, but other targets have also disappointed.

According to Reuters, some of the targeted employees divulged information about their computer's configuration, which would allow attackers to send out the appropriate malware for targeting that particular system.

What's even more scary is that many have actually surfed to specific pages when instructed to do so by the contestants who were impersonating employees of the companies' IT department. If they had been actual attackers, those employees' computers would now be infected with malware.

Once again, the contestants have demonstrated effectively why social engineering is one of the best-loved weapons in cyber attackers' arsenal.






Spotlight

Targeted attack protection via network topology alteration

Posted on 17 October 2014.  |  This article from Trend Micro tackles how network topology can aid in defending the enterprise network from risks posed by targeted attacks.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Mon, Oct 20th
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //