14708564
story
Comments: 136 + - News: DefCon Contest Rattles FBI's Nerves on Friday July 30, @07:34PM
background: url(//a.fsdn.com/sd/topics/topicsecurity.gif); width:59px; height:78px;
security
background: url(//a.fsdn.com/sd/topics/topicnews.gif); width:60px; height:66px;
news
background: url(//a.fsdn.com/sd/topics/topicit.gif); width:75px; height:61px;
it
snydeq writes "A DefCon contest that invites contestants to trick employees at 30 US corporations into revealing not-so-sensitive data has rattled nerves at the FBI. Chris Hadnagy, who is organizing the contest, also noted concerns from the financial industry, which fears hackers will target personal information. The contest will run for three days, with participants attempting to unearth data from an undisclosed list of about 30 US companies. The contest will take place in a room in the Riviera hotel in Las Vegas furnished with a soundproof booth and a speaker, so an audience can hear the contestants call companies and try to weasel out what data they can get from unwitting employees."
The group organizing the contest has established a strict set of rules to ensure participants don't violate any laws. Update: 07/31 04:45 GMT by S : PCWorld has coverage of one of the day's more successful attacks.
Related Stories
I like work; it fascinates me; I can sit and look at it for hours.
All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2010 Geeknet, Inc.
Dumbasses @ FBI (Score:4, Interesting)
What dumbasses at the FBI and in the financial industry:
"The list of target organizations will not include any financial, government, educational, or health care organizations;"
Re:Dumbasses @ FBI (Score:5, Funny)
"Do you have Prince Albert in a can?"
Parent
Re: (Score:2)
If you make any false claims at all then it would probably come under wire fraud.
A straightforward "Please tell me your password" probably isn't illegal (IANAL though)
Keep in mind though that false claims would probably include *implied* things as well so even if you speak no word which is not the truth you may still be trying to mislead someone and there's probably laws covering that.
Re: (Score:2)
The definitions of unauthorized access to a computer system vary quite a lot by state, but rest assured, all 50 states have their own laws against accessing a computer system against the owners wishes.
Even if you finagled router logins from a company(*), the courts could find such information does not constitute authorization to use the login to access private data on the network.
*This of course being wildly unlikely, since even if they're open to clients outside the LAN, the only people who would have the
Re: (Score:2)
Seriously. This is supposed to be a contest, a challenge of information security.
No point in fighting a war of wits with the unarmed.
Re: (Score:2)
You don't seriously believe that they were worried about being targeted, do you? Half these people outsource to the same overseas/unregulated call centers, so the same social engineering tricks will work and there's nothing that can be done about it without looking stupid. The other half have employees that are almost certain to fall for social engineering tricks but are "well-connected". In academia, you can kick someone upstairs* in situations like that. In a business, there's rarely an upstairs to kick t
Re: (Score:3, Interesting)
Well then the contest isn't hardly impressive, is it?
Because those are the very places that real black-hats would target, so those are the ones with the measures in place to intercept attempts at social-engineering exploits.
How hard is it to talk your way into a grocery store's customer list?
Re: (Score:2)
We're talking about a bunch of hackers here. When I went to my first Defcon, I was socially ackward as all get out. It would have been fantastic to observe real life social engineering in progress. Given the insane size of convention these days, I'm sure that even if a small fraction of the attendees are like I was, that's a few hundred people who would be interested in a social engineering demonstration. Hell, that they can even setup a soundproof booth to do the exhibition in the first place is a testi
Re: (Score:3, Interesting)
Because those are the very places that real black-hats would target, so those are the ones with the measures in place to intercept attempts at social-engineering exploits.
I work at one of those places, and I gotta say... those "measures" aren't as stringent as I'd like them to be. That is to say - we get employee training (CBT) once a year to refresh our knowledge of various procedures, and it touches briefly on social engineering (a single slide).
Now - I'm in the IS department, so it may be that those in lending ops, etc have a different story. For us the "measures" in place rely solely on the common sense of each employee.
Scary, isn't it?
Re: (Score:2)
Re: (Score:3, Insightful)
Unfortunately - yes! Hide the head in the sand, that seems to be the answer nowadays for any- and everything? For a long time, excuse me - started in 60's, I was either responsible of or designing systems and infrastructures for safe and secure, often global environments - can't say that they were perfect, nothing ever is. Time to time (often) the hired security testing groups / companies were able to find some problems, even if documents in wastebaskets - in IT(?) which should have known better, but the ma
This is refreshing (Score:5, Insightful)
It's nice to see the hacker community making a move to acknowledge its roots. Social engineering is the oldest and easily the most challenging/rewarding form of real hacking.
What's more gratifying, beating the password out of a hash after weeks of brute force or having the mark just tell you in a five-minute phone call?
Re: (Score:3, Funny)
Re: (Score:2)
You forgot to tell me to get off your lawn, old timer. :P
Re:This is refreshing (Score:5, Funny)
I prefer to beat the password out of the mark after 5 minutes of brute force.
Parent
Re: (Score:3, Informative)
http://xkcd.com/538/ [xkcd.com]
That is all.
Re: (Score:2)
Ah yes, rubber hose decryption. Effective but not for the faint of heart.
Re: (Score:2)
Whoosh.
GP was referencing an XKCD page, involving a few cheap hardware tools, as opposed to expensive "brute force" password cracking.
Re: (Score:2)
uhhhh uhhh whoosh xkcd *farts* *sniff sniff*
Hi! Welcome to Slashdot!
Re: (Score:2)
Wow, the population of grim humourless dicks on slashdot seems to have expanded considerably these last few months.
Re: (Score:3, Informative)
Hackers by and large just do it for the challenge. Both creating and solving intellectual puzzles.
Crackers OTOH usually do it for nefarious reasons. If you're a cracker, it's usually to achieve an objective for a greater plan. You want to be silent, stealthy, and render the goal long before anyone becomes the wiser. Social engineering for all its effectiveness increases the risk of exposure.
Re: (Score:2)
Bullshit. Read linky below.
http://blogs.techrepublic.com.com/security/?p=1400 [com.com]
Okay, be honest. (Score:5, Funny)
Who here clicked the link to www.social-engineer.org before thinking about the potential consequences?
Have you just been had? :-)
Re: (Score:2)
Very close, actually.
Rules and Do-Not-Do list (Score:5, Informative)
The CTF Rules
Each Social Engineer is sent via email a dossier with the name and URL of their target company chosen from the pool of submitted names.
Pre-Defcon you are allowed to gather any type of information you can glean from the WWW, their websites, Google searches and by using other passive information gathering techniques. You are prohibited from calling, emailing or contacting the company in any way before the Defcon event. We will be monitoring this and points will be deducted for "cheating".
The goal is to gather points for the information obtained and plan a realistic and appropriate attack vector. The point system will be revealed during the Defcon event. All information should be stored in a professional looking report. 1 week prior to Defcon you will submit your dossiers for review to the judging panel.
They will be sent their time slot (day/time) to perform their attack vector at Defcon. At Defcon each social engineer will be given 5 minutes to explain to the crowd what they did and what their attack vector is.
They are then given 20 minutes to perform their attack vector and points are awarded for information gathered as well as goals successfully accomplished during the process.
A scoreboard will be kept and at the end some excellent prizes will be awarded.
The Flag
The "flag" is custom list of specific bits of information, which you will have to discover during your 20-minute phone call.The judging panel created the list, and points will be awarded for each item present on the list. This list will be presented to you on the day of the event
THE DO NOT LIST:
Underlying idea of this contest is: No one gets victimized in the duration of this contest. Social Engineering skills can be demonstrated without engaging in unethical activities. The contest focuses on the skills of the contestant, not who does the most damage.
Items that are not allowed to be targeted at any point of the contest:
1) No going after very confidential data. (i.e. SS#, Credit Card Numbers, etc). No Illegal Data
2) Nothing that can get Social-Engineer.org, Defcon, or the participants in the contest sued
3) No porn
4) At no point are any techniques allowed to be used that would make a target feel as if they are "at risk" in any manner. (ie. "We have reason to believe that your account has been compromised.")
5) No targeting information such as passwords.
6) No pretexts that would appear to be any manner of government agency, law enforcement, or legally liable entity.
7) The social engineer must only call the target company, not relatives or family of any employee
8) Use common sense, if something seems unethical - don't do it. If you have questions, ask a judge
If at any point in the contest it appears that contestants are targeting anything on the "No" list, they will receive one warning. After the one warning they are disqualified from the contest.
Re: (Score:3, Insightful)
If they aren't going after confidential data, then what exactly is the point here? What I mean is, why would a company care about non-sensitive data, so what protections/security/whatever are they supposedly penetrating here?
Re:Rules and Do-Not-Do list (Score:5, Insightful)
Not everything needs to be about obtaining damaging information. Imagine talking to a random stranger and trying to solicit information from them. It's not as easy as it sounds.
Seriously, try this some time, just go up to a stranger and get their middle name. It will be harder than you think in most cases, if not impossible.
Social Engineering is a skill. You have to be very good to go under the "what the fuck does this guy want" radar. You have to be able to read people without seeing them and be able to think very quickly in a very dynamic situation. Again, all while staying under their radar.
Getting confidential, personally sensitive, or business critical information isn't the point nor appears to be the goal. Merely being good with your social skills (and we're talking a special breed of nerds here, no offense to them though), no great with them, is the point. Having a laundry list of weird and/or "not normally given out" information and trying to gain it, that's going to be hard.
Parent
Re: (Score:2)
"Excuse me sir, what is your middle name?"
Re:Rules and Do-Not-Do list (Score:4, Insightful)
[ignores you like a homeless guy asking for a dollar for more booze and walks away]
Good try.
"Excuse me sir, I'm with the [state] joint anticrime taskforce." [flashes official looking id printed up not long before] "We're performing random checks on the citizens in this area. May I see a photo ID?"
[citizen hands him his drivers license].
"Thank you Mr " [reads last name from ID] ". We've already had several instances today where criminals have attempted to run when asked for their identification. Have a wonderful day. We appreciate your cooperation."
His middle name was Henry. He was born October 28, 1955.
I know, in the game you're not allowed to pretend to be from a government agency. It just made this easier. If you're digging for personal information, you just have to craft "who" you are to be something where they'd want to hand over the information without asking too many questions.
Parent
Re: (Score:2)
Because this exercise, conducted WITH OUT ethical stops, would lead to compromised internal data.
Re:Rules and Do-Not-Do list (Score:4, Interesting)
Parent
what if that info just comes out? like the other s (Score:2)
what if that info just comes out? like the other side just start saying it all or some act's like a VP that need help and some one just gives them way to much info?
Re: (Score:2)
Wait back up to the part where the organisers can detect wrongdoing before the contest starts because "we will be monitoring this." How?
Re: (Score:2)
Doesn't this cover everything?
I've heard it said many times that you can be sued for anything.
"Nothing that can get Social-Engineer.org, Defcon, or the participants in the contest sued"
The companies could sue for their feelings being hurt, they could sue for damage to their reputation, they could sue for the wasted time of their employee, they could sue the organizer for being ugly, they could sue for the sky being blue.
Now weather they'd win for some of those things is a different matter.
Not-so-sensitive?! (Score:4, Funny)
"If you don't tell me, I'll look at the dumpster behind your building and read the name on it!"
I feel sorry (Score:5, Insightful)
I feel sorry for the poor fish in the barrel that gets shot on this one.
Unwittingly, right now, some guy/gal is sitting in their cubical and is on the cusp of getting the phone call that thrusts them into the international spotlight when the tape of the winning team's efforts is played. They might even lose their job for doing nothing more than, well, doing their job, or answering a harmless set of questions.
Re: (Score:3, Interesting)
No, this is good (Score:4, Insightful)
I can verify this (Score:5, Informative)
Posting as AC for obvious reasons, and I can't offer anything in the way of proof (again, for obvious reasons) but I do work for the US Navy in a division that deals with intelligence. We've been getting floods of emails from up on high warning us about Defcon "threats" and that we shouldn't answer any questions from people who call us that we don't know, etc etc.
Re: (Score:3, Insightful)
Wait, so what do the higher-ups expect you do on ordinary days when Defcon isn't running? Be less vigilant and answer any and all questions posed? What silly advice. What's a good precaution in the week of Defcon should be good *all*of*the*time*.
All they're really trying to avoid is potential embarrassment if something gets in the news.
Re:I can verify this (Score:5, Insightful)
That doesn't mean it's not worth occasionally reiterating, especially when there's a specific reason to believe there may be an increased chance of something happening.
It's not like they're spending millions of dollars to defend it or something, just sending a few emails.
Parent
The information they want is almost too innocuous. (Score:3, Funny)
1.) Get a list of past DefCon attendees from the company.
2.) Find prior attendees NOT attending the current DefCon.
3.) Call those prior attendees up and say "DefCon this year is doing a social engineering CTF, can you help me out by providing some silly and innocuous data about your company/building?"
This could work surprisingly well, so long as you got somebody willing to play along and help you "cheat."
In fact, this approach (or something similar) would probably be so common and so effective that there might be a rule added against it.
What would be particularly funny is if you didn't actually check if they were attending this year, and the "victim" was sitting in the audience!
ahem... (Score:3, Insightful)
"The group organizing the contest has established a strict set of rules to ensure participants don't violate any laws. "
I think what REALLY scares these guys (the Feds and the Banks) is that they know damn well that MOST hackers out there do not limit themselves with any silly, self-imposed rules.
Just imagine what the contestants could do without legality/illegality issues hindering them. Anything learned here will simply be repeated, by someone, with no such hindrances in place.
Can they spoof CallerID? (Score:4, Interesting)
On my desk phone at work, if someone calls from their desk or a number that is currently listed in the directory, their name and number shows up on the display. It's pretty obvious if someone calls up from an outside line. Now if the contestant is allowed to try to spoof my company's phone system into thinking they are from say, HR, more power to them..
Re: (Score:3, Informative)
The usual approach is to call someone pretty much at random, and ask to be transferred to the real target. That person then sees an internal number (typically of someone they don't know) calling them and to some degree lets their guard down.
Re: (Score:3, Informative)
Usually it's not that tough to get info. I always maintained an East coast US phone number, regardless of where I was working. I was always doing work things from my cell phone, like dealing with datacenter folks.
Sometimes in the course of normal work, I'd need to acquire access for a coworker to a site. My name was usually listed as a person authorized to make account changes. If it wasn't, I knew the people who would be. A few times, I called as the owner of the company,
Is this what the cyberczar wants? (Score:3, Insightful)
Just the other day we had a submission about how we aren't prepared for the "cyberwarz" because we can't get people who knows this sort of stuff, or thinks along these lines.
Well, damn, seems to me this would be a great excerise for the fbi/ hls, and whoever else to see about hiring/training peeps for those sort of jobs.
Of course, that makes sense and wouldn't be used.
Re: (Score:2)
Careful, that creaking sound that comes from your chair isn't actually a creak.. The gubment put a listening device in it and sometimes you hear feedback from their end. In fact, that's how you can tell it's a new version of the bug. They can whisper suggestive things to you as a form of mild brainwashing. I mean, really, your libido isn't that great, they're just failing to get you to go to the kiddie porn sites. Sadly they only keep catching you viewing the granny porn.
Shhhh!
Re:If they go to my bank... (Score:4, Insightful)
And yet you continue to do business with them. It's pretty obvious why they don't have to do much.
Parent
Re:If they go to my bank... (Score:4, Interesting)
Sometimes that info comes from places you'd rather it not. I got a letter a couple years ago from the VA (United States Veterans Affairs). I was in the military for about a month, almost 20 years ago. (It was a preexisting disqualifying medical condition, for anyone who really wonders.) They sent it to a friends house where I frequently got mail. It stated that my personal information may have been compromised due to a breach of the VA computers. I had seen the news story about it about a month before and didn't think it would apply to me. It's so comforting that I was in a system I shouldn't have been in, and they lost my information to unknown parties, who could be doing almost anything with it. Since they knew a valid address for me, nowhere near where I lived when they collected the data, I have to assume they kept addresses updated from another source.
Ya, I'd rather not do business with the VA, but apparently they know about me.
Sometimes I wonder about banks that I've done business with in the past. Some have closed and merged so many times, I have no clue who they are now. A friend of mine got a nasty letter from a bank a couple years ago. He had closed his account with them over 20 years before that. Apparently when they merged with other banks, to fluff their "account holders" numbers, they reopened closed accounts. After the mergers, they started assessing fees to the accounts. He was now on the hook for all kinds of fees they assessed the closed account plus interest. When he tried to straighten it out, the bank couldn't find the record, other than the fact that he owed the money. He still gets calls from collections every once in a while asking for the money.
Parent