Forgot your password?
typodupeerror
Security News IT

DefCon Contest Rattles FBI's Nerves 136

Posted by Soulskill
from the par-for-the-course dept.
snydeq writes "A DefCon contest that invites contestants to trick employees at 30 US corporations into revealing not-so-sensitive data has rattled nerves at the FBI. Chris Hadnagy, who is organizing the contest, also noted concerns from the financial industry, which fears hackers will target personal information. The contest will run for three days, with participants attempting to unearth data from an undisclosed list of about 30 US companies. The contest will take place in a room in the Riviera hotel in Las Vegas furnished with a soundproof booth and a speaker, so an audience can hear the contestants call companies and try to weasel out what data they can get from unwitting employees." The group organizing the contest has established a strict set of rules to ensure participants don't violate any laws. Update: 07/31 04:45 GMT by S : PCWorld has coverage of one of the day's more successful attacks.
This discussion has been archived. No new comments can be posted.

DefCon Contest Rattles FBI's Nerves

Comments Filter:
  • Dumbasses @ FBI (Score:4, Interesting)

    by blackraven14250 (902843) on Friday July 30, 2010 @07:37PM (#33091232)

    What dumbasses at the FBI and in the financial industry:

    "The list of target organizations will not include any financial, government, educational, or health care organizations;"

    • by msauve (701917) on Friday July 30, 2010 @07:42PM (#33091278)
      Well, that leaves retail.

      "Do you have Prince Albert in a can?"
      • It's illegal to ask someone their password ??

        I mean, I don't see what I'm doing illegal if I call some compagny and ask what is their router password... They are those in the illegality if they give my sensitive data from their compagny no ?

        • If you make any false claims at all then it would probably come under wire fraud.

          A straightforward "Please tell me your password" probably isn't illegal (IANAL though)

          Keep in mind though that false claims would probably include *implied* things as well so even if you speak no word which is not the truth you may still be trying to mislead someone and there's probably laws covering that.

          • The definitions of unauthorized access to a computer system vary quite a lot by state, but rest assured, all 50 states have their own laws against accessing a computer system against the owners wishes.

            Even if you finagled router logins from a company(*), the courts could find such information does not constitute authorization to use the login to access private data on the network.

            *This of course being wildly unlikely, since even if they're open to clients outside the LAN, the only people who would have the

            • by mysidia (191772)

              Hm.. so what happens if a social 'hacker' (after they already obtained credentials) uses social engineering techniques to get "permission" from an employee to login to a router that the employee has no business giving permission for someone to log in to?

              "Hi, i'm the networking consultant. I've received a report that internet speeds in your department at company XXXX are slow, and i'm ready to fix that and speed things up. I just need your permission to..........

              • Probably depend on weather you really were the networking consultant for their company.

                Getting authorization to enter the bank vault from the janitor is fairly meaningless if the janitor hasn't the right to grant that access.

                previous I was refering to merely obtaining the info, using the passwords would probably be a different matter.

    • by Zerth (26112)

      Seriously. This is supposed to be a contest, a challenge of information security.

      No point in fighting a war of wits with the unarmed.

      • by slick7 (1703596)

        Seriously. This is supposed to be a contest, a challenge of information security.

        No point in fighting a war of wits with the unarmed.

        After reading Kevin Mitnick's "The Art of Deception", I now firmly believe in P.T. Barnum's adage that there is a sucker born every minute. The fact the Fools, Boobs and Idiots were possibly out finessed by some kid/ tween/ teen/ adolescent in information harvesting goes to show you that BA's, MA's and PHD's are probably over-rated. Just like that /. article somewhere else in this compendium states.

        • by fbjon (692006)
          You must be confused. Education does not affect one's ability to not get fooled in the first place, so there's no reason to under-rate it as you do.
          • More educated people might be more likely to be fooled since they "know" they are too smart to fall for any funny business. Nothing like arrogance to blind someone.

          • by slick7 (1703596)

            You must be confused. Education does not affect one's ability to not get fooled in the first place, so there's no reason to under-rate it as you do.

            True, education does not affect one's ability to be fooled, but experience does.
            I have had the pleasure to work with engineers, the first year it was "I'm the engineer" and I say, "I've been working here for the last ten years". The second or third year there seems to be a mutual agreement that we could learn from each other except for the fact that I already knew this. The fourth year seems to be the one that the engineer seeks my input prior to starting a project to ensure that it does not conflict with o

    • by jd (1658)

      You don't seriously believe that they were worried about being targeted, do you? Half these people outsource to the same overseas/unregulated call centers, so the same social engineering tricks will work and there's nothing that can be done about it without looking stupid. The other half have employees that are almost certain to fall for social engineering tricks but are "well-connected". In academia, you can kick someone upstairs* in situations like that. In a business, there's rarely an upstairs to kick t

    • Re: (Score:3, Interesting)

      by blair1q (305137)

      Well then the contest isn't hardly impressive, is it?

      Because those are the very places that real black-hats would target, so those are the ones with the measures in place to intercept attempts at social-engineering exploits.

      How hard is it to talk your way into a grocery store's customer list?

      • by dave562 (969951)

        We're talking about a bunch of hackers here. When I went to my first Defcon, I was socially ackward as all get out. It would have been fantastic to observe real life social engineering in progress. Given the insane size of convention these days, I'm sure that even if a small fraction of the attendees are like I was, that's a few hundred people who would be interested in a social engineering demonstration. Hell, that they can even setup a soundproof booth to do the exhibition in the first place is a testi

        • by afabbro (33948)

          We're talking about a bunch of hackers here. When I went to my first Defcon, I was socially ackward as all get out.

          Ah, so you fit right in.

          • by dave562 (969951)

            Damn straight. I was so lame that I got up and walked out of Mark Ludwig's presentation on virii and polymorphism.

      • Re: (Score:3, Interesting)

        Because those are the very places that real black-hats would target, so those are the ones with the measures in place to intercept attempts at social-engineering exploits.

        I work at one of those places, and I gotta say... those "measures" aren't as stringent as I'd like them to be. That is to say - we get employee training (CBT) once a year to refresh our knowledge of various procedures, and it touches briefly on social engineering (a single slide).

        Now - I'm in the IS department, so it may be that those in lending ops, etc have a different story. For us the "measures" in place rely solely on the common sense of each employee.

        Scary, isn't it?

        • Re: (Score:2, Interesting)

          by kcwatx (785052)
          What you observed about your corporation and its measures is probably the very reason this contest is taking place. I also work at one of those institutions, and our CBT is a little more comprehensive when it comes to social networking, but its still up to the bottom rung employees to control the information at the telephone outlet. There are maybe 1000 people at my office, half of which work in a contact center for our company and have access to lots and lots of private information, and our company has ot
        • by Stormie (708)

          we get employee training (CBT) once a year to refresh our knowledge of various procedures

          I'm actually surprised how easily security has been compromised, if employees are subjected to cock & ball torture to "refresh" their knowledge of proper procedures. I wouldn't forget in a hurry.

    • The publicity hardly helps. I wonder if any of the organizations called will know what's going on and use the opportunity to mess with the contestants.
    • Re: (Score:3, Insightful)

      by tuomoks (246421)

      Unfortunately - yes! Hide the head in the sand, that seems to be the answer nowadays for any- and everything? For a long time, excuse me - started in 60's, I was either responsible of or designing systems and infrastructures for safe and secure, often global environments - can't say that they were perfect, nothing ever is. Time to time (often) the hired security testing groups / companies were able to find some problems, even if documents in wastebaskets - in IT(?) which should have known better, but the ma

    • What dumbasses at the FBI and in the financial industry:

      "The list of target organizations will not include any financial, government, educational, or health care organizations;"

      Why? Because the division at the FBI responsible for cyber crimes asks what they plan to do? And then is satisfied by the answer?

      I hope they also send an agent to learn and take back ideas on what works to help companies avoid issues.

  • This is refreshing (Score:5, Insightful)

    by Majik Sheff (930627) on Friday July 30, 2010 @07:44PM (#33091300) Journal

    It's nice to see the hacker community making a move to acknowledge its roots. Social engineering is the oldest and easily the most challenging/rewarding form of real hacking.

    What's more gratifying, beating the password out of a hash after weeks of brute force or having the mark just tell you in a five-minute phone call?

    • Re: (Score:3, Funny)

      by al0ha (1262684)
      Yeah - social engineering used to be called grifting. But I guess grifting is not as cool a buzzword as anything associated with engineering. Social engineering, puhleez; like it takes a lot of brains to grift a rube.
    • by Hatta (162192) on Friday July 30, 2010 @08:10PM (#33091540) Journal

      I prefer to beat the password out of the mark after 5 minutes of brute force.

      • Re: (Score:3, Informative)

        by KlaymenDK (713149)

        http://xkcd.com/538/ [xkcd.com]

        That is all.

      • Ah yes, rubber hose decryption. Effective but not for the faint of heart.

    • Re: (Score:3, Informative)

      by DigiShaman (671371)

      Hackers by and large just do it for the challenge. Both creating and solving intellectual puzzles.

      Crackers OTOH usually do it for nefarious reasons. If you're a cracker, it's usually to achieve an objective for a greater plan. You want to be silent, stealthy, and render the goal long before anyone becomes the wiser. Social engineering for all its effectiveness increases the risk of exposure.

    • by slick7 (1703596)

      It's nice to see the hacker community making a move to acknowledge its roots. Social engineering is the oldest and easily the most challenging/rewarding form of real hacking.

      What's more gratifying, beating the password out of a hash after weeks of brute force or having the mark just tell you in a five-minute phone call?

      Wait until the Chinese (or name your ethnic group here) get a load of this. The sophistication of the American haxorz is limited by the human languages they speak.

  • by peacefinder (469349) <alan.dewitt@gm a i l . c om> on Friday July 30, 2010 @07:47PM (#33091330) Journal

    Who here clicked the link to www.social-engineer.org before thinking about the potential consequences?

    Have you just been had? :-)

  • by Zerth (26112) on Friday July 30, 2010 @07:52PM (#33091374) Homepage

    The CTF Rules

    Each Social Engineer is sent via email a dossier with the name and URL of their target company chosen from the pool of submitted names.

    Pre-Defcon you are allowed to gather any type of information you can glean from the WWW, their websites, Google searches and by using other passive information gathering techniques. You are prohibited from calling, emailing or contacting the company in any way before the Defcon event. We will be monitoring this and points will be deducted for "cheating".

    The goal is to gather points for the information obtained and plan a realistic and appropriate attack vector. The point system will be revealed during the Defcon event. All information should be stored in a professional looking report. 1 week prior to Defcon you will submit your dossiers for review to the judging panel.

    They will be sent their time slot (day/time) to perform their attack vector at Defcon. At Defcon each social engineer will be given 5 minutes to explain to the crowd what they did and what their attack vector is.

    They are then given 20 minutes to perform their attack vector and points are awarded for information gathered as well as goals successfully accomplished during the process.
    A scoreboard will be kept and at the end some excellent prizes will be awarded.

    The Flag

    The "flag" is custom list of specific bits of information, which you will have to discover during your 20-minute phone call.The judging panel created the list, and points will be awarded for each item present on the list. This list will be presented to you on the day of the event

    THE DO NOT LIST:

    Underlying idea of this contest is: No one gets victimized in the duration of this contest. Social Engineering skills can be demonstrated without engaging in unethical activities. The contest focuses on the skills of the contestant, not who does the most damage.

    Items that are not allowed to be targeted at any point of the contest:

    1) No going after very confidential data. (i.e. SS#, Credit Card Numbers, etc). No Illegal Data
    2) Nothing that can get Social-Engineer.org, Defcon, or the participants in the contest sued
    3) No porn
    4) At no point are any techniques allowed to be used that would make a target feel as if they are "at risk" in any manner. (ie. "We have reason to believe that your account has been compromised.")
    5) No targeting information such as passwords.
    6) No pretexts that would appear to be any manner of government agency, law enforcement, or legally liable entity.
    7) The social engineer must only call the target company, not relatives or family of any employee
    8) Use common sense, if something seems unethical - don't do it. If you have questions, ask a judge
    If at any point in the contest it appears that contestants are targeting anything on the "No" list, they will receive one warning. After the one warning they are disqualified from the contest.

    • Re: (Score:3, Insightful)

      by Score Whore (32328)

      If they aren't going after confidential data, then what exactly is the point here? What I mean is, why would a company care about non-sensitive data, so what protections/security/whatever are they supposedly penetrating here?

      • by rotide (1015173) on Friday July 30, 2010 @08:14PM (#33091572)

        Not everything needs to be about obtaining damaging information. Imagine talking to a random stranger and trying to solicit information from them. It's not as easy as it sounds.

        Seriously, try this some time, just go up to a stranger and get their middle name. It will be harder than you think in most cases, if not impossible.

        Social Engineering is a skill. You have to be very good to go under the "what the fuck does this guy want" radar. You have to be able to read people without seeing them and be able to think very quickly in a very dynamic situation. Again, all while staying under their radar.

        Getting confidential, personally sensitive, or business critical information isn't the point nor appears to be the goal. Merely being good with your social skills (and we're talking a special breed of nerds here, no offense to them though), no great with them, is the point. Having a laundry list of weird and/or "not normally given out" information and trying to gain it, that's going to be hard.

        • by lisany (700361)

          "Excuse me sir, what is your middle name?"

          • by JWSmythe (446288) <jwsmythe@@@jwsmythe...com> on Friday July 30, 2010 @10:25PM (#33092390) Homepage Journal

                [ignores you like a homeless guy asking for a dollar for more booze and walks away]

                Good try.

                "Excuse me sir, I'm with the [state] joint anticrime taskforce." [flashes official looking id printed up not long before] "We're performing random checks on the citizens in this area. May I see a photo ID?"

                [citizen hands him his drivers license].

                "Thank you Mr " [reads last name from ID] ". We've already had several instances today where criminals have attempted to run when asked for their identification. Have a wonderful day. We appreciate your cooperation."

                His middle name was Henry. He was born October 28, 1955.

                I know, in the game you're not allowed to pretend to be from a government agency. It just made this easier. If you're digging for personal information, you just have to craft "who" you are to be something where they'd want to hand over the information without asking too many questions.

            • by houghi (78078)

              flashes official looking id printed up not long before

              I had this happening to me and I asked for the ID to read a secondf time. Looked at it very carefully. So I would not fall for that.
              At a company I worked, police came and and where escorted back out when they di not show the correct paperwork.

              Mind you, these were all official police officers.

              The look on the faces of those officers was priceless:
              "But we are here to investigate "
              "Without the offcial papers you are two people tresspassing and breaking in un

            • by tomhudson (43916)

              I noticed on the list that they didn't say medical was out of the question. "Hi - we're calling from [insert local hospital name]. There's nothing to be alarmed about - just a minor computer glitch - we have two entries with the same first and last names. Have you ever seen Dr. [insert bogus doctor] in emergency? You're not sure? How about doctor [insert another] in the past two weeks? No. Thank you. To prevent any future problems, I'm going to enter your full name into the computer system - just remembe

              • by JWSmythe (446288)

                That works on the assumption that he's been to the local hospital. I haven't been to a hospital as a patient in about 10 years. That was for a car accident (that I still hurt from). Even knowing that, and the city I live in, there are about a dozen hospitals that I could have gone to. But the general idea would work, it just needs some tuning. A (fake) common billing provider for the local hospitals may work. It doesn't have to be the real billing provider. Most of us don't know who us

                • by tomhudson (43916)
                  Se ... I already know you were in a car accident 10 years ago, that you have lingering pain, and therefore blah blah blah. Insurance providers like that sort of info, as do employers (so that if you hurt yourself on the job they can say "pre-existing condition").
                  • by JWSmythe (446288)

                    Yup, my pre-existing condition isn't something I try to hide. If I were to ever file a workers comp claim, I know their insurance minions would be all over my history, checking every database in existence. It's not hard. My auto and health insurance both show it. The doctors records show it. My prescription history at the pharmacy shows it. Regardless of how protected HIPAA data is suppose to be, folks seem to get a hold of it somehow.

                    My injuries are well documented, so it'

            • by mdf356 (774923)

              My driver's license doesn't have my middle name printed on it, just the initial.

        • by Oyume (464420)

          They don't have middle names here in Japan! NOW WHAT?!

        • I don't think you get my point.

          If I'm sitting on the bus and you sit down near me and say hello, I'll go ahead and say hello back. If you then comment about the weather I'll respond about the weather. We can have a nice conversation about a local sports team, you might ask me if I was at the game yesterday and I'll tell you no, I wasn't. You can go ahead and pat yourself on the back about extracting that information with your mad social engineering skills, but the reality is all you've done is be part of no

          • by rotide (1015173)

            I do understand you and I'm sorry your imagination isn't able to come up with scenarios where there could be information that people normally wouldn't give out that also wouldn't be considered sensitive.

            What version of MS/Open Office are you running?
            Who do you use for offsite backup?
            Who supplies your cat5e/6 cable?

            Try cold calling a business and getting one of those answered let alone all 3. The "wtf are you asking for" alarm will go off insanely fast. So now you have to come up with a scenario where yo

            • Sorry. No matter how much you want to wiggle around, you don't get to tell me what I consider secret.

              (And if you've never received a call asking those questions, then you obviously don't actually work in IT. Getting a call from a salesman asking about your current sources isn't that uncommon and it's not secret.)

          • by tomhudson (43916)

            If I'm sitting on the bus and you sit down near me and say hello, I'll go ahead and say hello back. If you then comment about the weather I'll respond about the weather. We can have a nice conversation about a local sports team, you might ask me if I was at the game yesterday and I'll tell you no, I wasn't. You can go ahead and pat yourself on the back about extracting that information with your mad social engineering skills, but the reality is all you've done is be part of normal conversation.

            I sit on th

            • First, you have an elaborate fantasy life.

              Second:

              If you follow, then I know two things:

              1. You're hiding something
              2. You can be blackmailed over it

              What makes you think you know two things? Maybe you know ten things:

              3. I have nothing to hide, but I think you're cute and am planning on giving you a hard rogering after we've had dinner.
              4. I have nothing to hide, but you've threatened my family and I am planning on stabbing you in the eye socket with a steak knife at t

      • Because this exercise, conducted WITH OUT ethical stops, would lead to compromised internal data.

      • by garompeta (1068578) on Friday July 30, 2010 @08:54PM (#33091818)
        There are very cool pranks done at HOPE, which was enlightening. Emmanuel Goldstein called to BP and ended up convincing an employee to leave open the office door, and telling him that because it was too late he wouldn't be appearing with the company van. He didn't get any confidential information regarding to the store (surprisingly, some of the employees seemed to be trained and others seemed to be very stupid to understand the questions) but if wanted he could have gone to the gas station with a free pass to the office, from an unmarked unbranded van. That is social engineering.
    • what if that info just comes out? like the other side just start saying it all or some act's like a VP that need help and some one just gives them way to much info?

    • by Snowmit (704081)

      Wait back up to the part where the organisers can detect wrongdoing before the contest starts because "we will be monitoring this." How?

    • Doesn't this cover everything?
      I've heard it said many times that you can be sued for anything.

      "Nothing that can get Social-Engineer.org, Defcon, or the participants in the contest sued"

      The companies could sue for their feelings being hurt, they could sue for damage to their reputation, they could sue for the wasted time of their employee, they could sue the organizer for being ugly, they could sue for the sky being blue.

      Now weather they'd win for some of those things is a different matter.

    • by FragHARD (640825)
      Well shoot!!!, the first eight rules ruined my plans :-(
    • No mention of not being able to use LinkedIn. Awesome.

  • Here [googleusercontent.com], here [googleusercontent.com] and here [googleusercontent.com].
  • They probably won't have to do much. They've sent a letter stating that my personal information has gone missing three times in two years. In the age of data mining, I don't think this will be as much of a challenge.
    • by John Hasler (414242) on Friday July 30, 2010 @08:25PM (#33091668) Homepage

      They probably won't have to do much. They've sent a letter stating that my personal information has gone missing three times in two years.

      And yet you continue to do business with them. It's pretty obvious why they don't have to do much.

      • by JWSmythe (446288) <jwsmythe@@@jwsmythe...com> on Friday July 30, 2010 @10:37PM (#33092498) Homepage Journal

            Sometimes that info comes from places you'd rather it not. I got a letter a couple years ago from the VA (United States Veterans Affairs). I was in the military for about a month, almost 20 years ago. (It was a preexisting disqualifying medical condition, for anyone who really wonders.) They sent it to a friends house where I frequently got mail. It stated that my personal information may have been compromised due to a breach of the VA computers. I had seen the news story about it about a month before and didn't think it would apply to me. It's so comforting that I was in a system I shouldn't have been in, and they lost my information to unknown parties, who could be doing almost anything with it. Since they knew a valid address for me, nowhere near where I lived when they collected the data, I have to assume they kept addresses updated from another source.

            Ya, I'd rather not do business with the VA, but apparently they know about me.

            Sometimes I wonder about banks that I've done business with in the past. Some have closed and merged so many times, I have no clue who they are now. A friend of mine got a nasty letter from a bank a couple years ago. He had closed his account with them over 20 years before that. Apparently when they merged with other banks, to fluff their "account holders" numbers, they reopened closed accounts. After the mergers, they started assessing fees to the accounts. He was now on the hook for all kinds of fees they assessed the closed account plus interest. When he tried to straighten it out, the bank couldn't find the record, other than the fact that he owed the money. He still gets calls from collections every once in a while asking for the money.

      • What isn't obvious is that if banks are too big to fail why are there so many around my house?

        lol
  • by zyxwvutsr (542520) on Friday July 30, 2010 @08:03PM (#33091468) Homepage

    What participants can do is collect data on less sensitive subjects such as, "who does your dumpster removal; who takes care of your paper shredding," Hadnagy said.

    "If you don't tell me, I'll look at the dumpster behind your building and read the name on it!"

  • I feel sorry (Score:5, Insightful)

    by blantonl (784786) on Friday July 30, 2010 @08:04PM (#33091484) Homepage

    I feel sorry for the poor fish in the barrel that gets shot on this one.

    Unwittingly, right now, some guy/gal is sitting in their cubical and is on the cusp of getting the phone call that thrusts them into the international spotlight when the tape of the winning team's efforts is played. They might even lose their job for doing nothing more than, well, doing their job, or answering a harmless set of questions.

    • by craw (6958)

      I also feel sorry for the poor fish in the barrel. What would be interesting to monitor is how far up the management chain the sh*t flies.

      In a more perfect world, those that succumb to social engineering would then have their bosses/supervisors subjected to the same social engineering, and if they fail, their bosses/supervisors would then be subjected to social engineering....

    • Re: (Score:3, Interesting)

      by T Murphy (1054674)
      If their boss actually follows what happens at DefCon, that boss might be smart enough to know how to handle the situation without firing anybody.
      • by mldi (1598123)

        ... that boss might be smart enough...

        Isn't that a bit of an oxymoron?

        *ducks*

    • by drinkypoo (153816)

      They might even lose their job for doing nothing more than, well, doing their job, or answering a harmless set of questions.

      If they lose their job for doing their job, then they can lose their job for doing their job any old time, not just if they are used to win this contest. What is far more likely is that they will lose their job for doing something they thought was their job: giving away information they are not really supposed to. And they should lose their job in this instance. It does not matter if someone is trying to fool them, or if they are just idiots. If they can't do the job, then they need to not have it.

  • yeah, the nerves around their funny bone.

    they probably set the whole thing up so they could document the attempts rather than dream them up on their own so they could develop a counter procedure policy.

    • by rotide (1015173)

      Careful, that creaking sound that comes from your chair isn't actually a creak.. The gubment put a listening device in it and sometimes you hear feedback from their end. In fact, that's how you can tell it's a new version of the bug. They can whisper suggestive things to you as a form of mild brainwashing. I mean, really, your libido isn't that great, they're just failing to get you to go to the kiddie porn sites. Sadly they only keep catching you viewing the granny porn.

      Shhhh!

  • No, this is good (Score:4, Insightful)

    by i_want_you_to_throw_ (559379) on Friday July 30, 2010 @08:26PM (#33091672) Homepage Journal
    If anything social engineering is THE weakest link in the security chain. Let the geeks handle the hardware security but people really and truly need to keep having it pounded into them that they always need to be vigilant and to recognize these attempts.
    • by Phat_Tony (661117) *
      Sometimes "improved" technical security makes the social aspect worse, too. Systems departments frequently have the incentive to make sure there are no *technical* exploits to the systems, but if total security is decreased by social security being decreased when technical security is increased, that's not their problem when something goes wrong. I can quickly list three examples from a previous employer:

      - They decided to "increase security" by forcing people to use stronger passwords and to change their
  • I can verify this (Score:5, Informative)

    by Anonymous Coward on Friday July 30, 2010 @08:35PM (#33091710)

    Posting as AC for obvious reasons, and I can't offer anything in the way of proof (again, for obvious reasons) but I do work for the US Navy in a division that deals with intelligence. We've been getting floods of emails from up on high warning us about Defcon "threats" and that we shouldn't answer any questions from people who call us that we don't know, etc etc.

    • Re: (Score:3, Insightful)

      by Anonymous Coward

      Wait, so what do the higher-ups expect you do on ordinary days when Defcon isn't running? Be less vigilant and answer any and all questions posed? What silly advice. What's a good precaution in the week of Defcon should be good *all*of*the*time*.

      All they're really trying to avoid is potential embarrassment if something gets in the news.

    • by nospam007 (722110) *

      "we shouldn't answer any questions from people who call us that we don't know, etc etc."

      Yeah, I never get a virus because I open only mails from my friends.

    • by IICV (652597)

      It's funny because if your higher-ups had actually read the rules that Defcon posted (you know, done a bit of research), they would have realized that the military is not being targeted. If anyone gets a call pumping them for personal information, it's not going to be due to this defcon event.

  • by yakovlev (210738) on Friday July 30, 2010 @09:04PM (#33091900) Homepage
    Given that the information they want is so innocuous (see their examples,) the way I would probably handle it is:

    1.) Get a list of past DefCon attendees from the company.
    2.) Find prior attendees NOT attending the current DefCon.
    3.) Call those prior attendees up and say "DefCon this year is doing a social engineering CTF, can you help me out by providing some silly and innocuous data about your company/building?"

    This could work surprisingly well, so long as you got somebody willing to play along and help you "cheat."

    In fact, this approach (or something similar) would probably be so common and so effective that there might be a rule added against it.

    What would be particularly funny is if you didn't actually check if they were attending this year, and the "victim" was sitting in the audience!
    • Re: (Score:1, Offtopic)

      by JWSmythe (446288)

      I haven't been to a Defcon yet. Shit always comes up. But, don't they still take cash at the door? Do you have to provide a photo ID? I've been to several conventions where I observed the people ahead of me and when they don't ask for an ID, I just give a fake name and pay cash. I used to have a bunch of ID badges for "JW Smythe" hanging on my office wall (when I had an office) from various places. I don't feel it's necessary for every schmuck in the world to know who I really am.

  • ahem... (Score:3, Insightful)

    by Anachragnome (1008495) on Friday July 30, 2010 @09:15PM (#33091982)

    "The group organizing the contest has established a strict set of rules to ensure participants don't violate any laws. "

    I think what REALLY scares these guys (the Feds and the Banks) is that they know damn well that MOST hackers out there do not limit themselves with any silly, self-imposed rules.

    Just imagine what the contestants could do without legality/illegality issues hindering them. Anything learned here will simply be repeated, by someone, with no such hindrances in place.

  • by HockeyPuck (141947) on Friday July 30, 2010 @09:16PM (#33091992)

    On my desk phone at work, if someone calls from their desk or a number that is currently listed in the directory, their name and number shows up on the display. It's pretty obvious if someone calls up from an outside line. Now if the contestant is allowed to try to spoof my company's phone system into thinking they are from say, HR, more power to them..

    • Re: (Score:3, Informative)

      by radish (98371)

      The usual approach is to call someone pretty much at random, and ask to be transferred to the real target. That person then sees an internal number (typically of someone they don't know) calling them and to some degree lets their guard down.

    • Re: (Score:3, Informative)

      by JWSmythe (446288)

      Usually it's not that tough to get info. I always maintained an East coast US phone number, regardless of where I was working. I was always doing work things from my cell phone, like dealing with datacenter folks.

      Sometimes in the course of normal work, I'd need to acquire access for a coworker to a site. My name was usually listed as a person authorized to make account changes. If it wasn't, I knew the people who would be. A few times, I called as the owner of the company,

    • by tibit (1762298)

      It's trivial to spoof caller ID in the U.S. Heck, at work our ISDN provider gladly accepts any 10 digit calling party number we feel like providing them. This is the prime reason why you DON'T want to enable pin-less calling from your "home" number, when using calling card services.

      Pin-less calling means that the calling card system uses caller ID to bypass the pin. At one point I made a bet with a friend, that I can pick any popular calling card access number, random 10k numbers from a 1M+ metro area area

    • by nblender (741424)
      I once did contract work for a north american telecom manufacturer.. The project I was on included a temporary pinhole through the corporate firewall from a specific vendor to an internal database server. I was given contact info for the firewall team at head office (across the border, in another state).. The one day I left the office, I had gotten as far as the lobby and realized I hadn't arranged for the pinhole through the firewall so I walked over to the lobby phone and called the internal extension gi
  • by Nyder (754090) on Friday July 30, 2010 @09:43PM (#33092142) Journal

    Just the other day we had a submission about how we aren't prepared for the "cyberwarz" because we can't get people who knows this sort of stuff, or thinks along these lines.

    Well, damn, seems to me this would be a great excerise for the fbi/ hls, and whoever else to see about hiring/training peeps for those sort of jobs.

    Of course, that makes sense and wouldn't be used.

Behind every great computer sits a skinny little geek.

Working...