Most of the recent high-profile cyber attacks against corporations and government organizations have one thing in common - they all started with a successful social engineering attempt.


It often takes the form of a specially crafted email carrying malware disguised as a legitimate corporate document or links that take the recipient to a site that exploits vulnerabilities in the software he uses, but successful social engineering can also take the form of asking directly what you want to know.

And it is precisely that approach that has been tested for the second year in a row during the Defcon conference in Las Vegas.

The capture-the-flag-style competition involved contestants placing phone calls to employees of companies such as Oracle, AT&T, Delta Air Lines, Symantec and Apple, and trying to trick them into revealing information such as the company's backup and data securing practices, wireless network use, names of companies whose employees have physical access to the company offices (providers of toner and copier paper, onsite security, etc.), and more.

Last year's edition of the competition has proved that such attempts are often successful - out of some fifty employees approached via phone by the contestants, only three became suspicious and terminated the call without divulging any information.

This year, the company whose employees proved the least prepared to fend off such attacks was Oracle, but other targets have also disappointed.

According to Reuters, some of the targeted employees divulged information about their computer's configuration, which would allow attackers to send out the appropriate malware for targeting that particular system.

What's even more scary is that many have actually surfed to specific pages when instructed to do so by the contestants who were impersonating employees of the companies' IT department. If they had been actual attackers, those employees' computers would now be infected with malware.

Once again, the contestants have demonstrated effectively why social engineering is one of the best-loved weapons in cyber attackers' arsenal.