×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

DefCon Contest Rattles FBI's Nerves

Soulskill posted more than 3 years ago | from the par-for-the-course dept.

Security 136

snydeq writes "A DefCon contest that invites contestants to trick employees at 30 US corporations into revealing not-so-sensitive data has rattled nerves at the FBI. Chris Hadnagy, who is organizing the contest, also noted concerns from the financial industry, which fears hackers will target personal information. The contest will run for three days, with participants attempting to unearth data from an undisclosed list of about 30 US companies. The contest will take place in a room in the Riviera hotel in Las Vegas furnished with a soundproof booth and a speaker, so an audience can hear the contestants call companies and try to weasel out what data they can get from unwitting employees." The group organizing the contest has established a strict set of rules to ensure participants don't violate any laws. Update: 07/31 04:45 GMT by S : PCWorld has coverage of one of the day's more successful attacks.

cancel ×
This is a preview of your comment

No Comment Title Entered

Anonymous Coward 1 minute ago

No Comment Entered

136 comments

Dumbasses @ FBI (3, Interesting)

blackraven14250 (902843) | more than 3 years ago | (#33091232)

What dumbasses at the FBI and in the financial industry:

"The list of target organizations will not include any financial, government, educational, or health care organizations;"

Re:Dumbasses @ FBI (4, Funny)

msauve (701917) | more than 3 years ago | (#33091278)

Well, that leaves retail.

"Do you have Prince Albert in a can?"

Re:Dumbasses @ FBI (1)

Soilworker (795251) | more than 3 years ago | (#33091630)

It's illegal to ask someone their password ??

I mean, I don't see what I'm doing illegal if I call some compagny and ask what is their router password... They are those in the illegality if they give my sensitive data from their compagny no ?

Re:Dumbasses @ FBI (1)

HungryHobo (1314109) | more than 3 years ago | (#33092220)

If you make any false claims at all then it would probably come under wire fraud.

A straightforward "Please tell me your password" probably isn't illegal (IANAL though)

Keep in mind though that false claims would probably include *implied* things as well so even if you speak no word which is not the truth you may still be trying to mislead someone and there's probably laws covering that.

Re:Dumbasses @ FBI (1)

digitalunity (19107) | more than 3 years ago | (#33092338)

The definitions of unauthorized access to a computer system vary quite a lot by state, but rest assured, all 50 states have their own laws against accessing a computer system against the owners wishes.

Even if you finagled router logins from a company(*), the courts could find such information does not constitute authorization to use the login to access private data on the network.

*This of course being wildly unlikely, since even if they're open to clients outside the LAN, the only people who would have the information are likely to know better than to give it out.

Re:Dumbasses @ FBI (1)

mysidia (191772) | more than 3 years ago | (#33092724)

Hm.. so what happens if a social 'hacker' (after they already obtained credentials) uses social engineering techniques to get "permission" from an employee to login to a router that the employee has no business giving permission for someone to log in to?

"Hi, i'm the networking consultant. I've received a report that internet speeds in your department at company XXXX are slow, and i'm ready to fix that and speed things up. I just need your permission to..........

Re:Dumbasses @ FBI (-1, Offtopic)

Anonymous Coward | more than 3 years ago | (#33091660)

No but J edgar Hoover perhaps wanted Prince Albert in his can

Re:Dumbasses @ FBI (0)

Anonymous Coward | more than 3 years ago | (#33091316)

In the financial industry, sure.

At the bureau, not so much. Unlike financial institutions, their concern doesn't stop at their doorstep -- they're tasked with law enforcement, so if they think someone might be breaking laws, they've got every right to be concerned.

Re:Dumbasses @ FBI (1)

Zerth (26112) | more than 3 years ago | (#33091318)

Seriously. This is supposed to be a contest, a challenge of information security.

No point in fighting a war of wits with the unarmed.

Re:Dumbasses @ FBI (1)

slick7 (1703596) | more than 3 years ago | (#33093446)

Seriously. This is supposed to be a contest, a challenge of information security.

No point in fighting a war of wits with the unarmed.

After reading Kevin Mitnick's "The Art of Deception", I now firmly believe in P.T. Barnum's adage that there is a sucker born every minute. The fact the Fools, Boobs and Idiots were possibly out finessed by some kid/ tween/ teen/ adolescent in information harvesting goes to show you that BA's, MA's and PHD's are probably over-rated. Just like that /. article somewhere else in this compendium states.

Re:Dumbasses @ FBI (1)

fbjon (692006) | more than 3 years ago | (#33093508)

You must be confused. Education does not affect one's ability to not get fooled in the first place, so there's no reason to under-rate it as you do.

Re:Dumbasses @ FBI (1)

CharlyFoxtrot (1607527) | more than 3 years ago | (#33094034)

More educated people might be more likely to be fooled since they "know" they are too smart to fall for any funny business. Nothing like arrogance to blind someone.

Re:Dumbasses @ FBI (1)

jd (1658) | more than 3 years ago | (#33091340)

You don't seriously believe that they were worried about being targeted, do you? Half these people outsource to the same overseas/unregulated call centers, so the same social engineering tricks will work and there's nothing that can be done about it without looking stupid. The other half have employees that are almost certain to fall for social engineering tricks but are "well-connected". In academia, you can kick someone upstairs* in situations like that. In a business, there's rarely an upstairs to kick them.

*Promoting people into positions that pay better but have minimal contact with the outside world and virtually no actual authority. Plenty of sub-committees, though. Lots of those. That way, you can get rid of high-risk people whilst keeping them close at hand. The lofty ivory towers aren't to isolate the scholars from the masses, they're to keep the masses safe from those who have totally lost it.

Re:Dumbasses @ FBI (0, Offtopic)

Trivial Solutions (1724416) | more than 3 years ago | (#33091632)

They're not dumb, but once you learn their tricks, you force them to think new stuff. They havew shock-and-awe potential at first. Now, I have shock-and-awe potential. God says... receiveth requirements prisoner tends commander inwardly SMALL resigned wondering blessing amazement solitude must command recognising vindicating fifth languages eligible sharp reacheth Saturn saith sat nowhere funding excepted gaze arrived Catholics ease sad throughout beast few detached see disclosed venerable Descend cogo

Re:Dumbasses @ FBI (0)

Anonymous Coward | more than 3 years ago | (#33092834)

God says... receiveth requirements prisoner tends commander inwardly SMALL resigned wondering blessing amazement solitude must command recognising vindicating fifth languages eligible sharp reacheth Saturn saith sat nowhere funding excepted gaze arrived Catholics ease sad throughout beast few detached see disclosed venerable Descend cogo

In that case, I think God should lay off the wacky weed...

Re:Dumbasses @ FBI (2, Interesting)

blair1q (305137) | more than 3 years ago | (#33091730)

Well then the contest isn't hardly impressive, is it?

Because those are the very places that real black-hats would target, so those are the ones with the measures in place to intercept attempts at social-engineering exploits.

How hard is it to talk your way into a grocery store's customer list?

Re:Dumbasses @ FBI (1)

dave562 (969951) | more than 3 years ago | (#33092478)

We're talking about a bunch of hackers here. When I went to my first Defcon, I was socially ackward as all get out. It would have been fantastic to observe real life social engineering in progress. Given the insane size of convention these days, I'm sure that even if a small fraction of the attendees are like I was, that's a few hundred people who would be interested in a social engineering demonstration. Hell, that they can even setup a soundproof booth to do the exhibition in the first place is a testiment to how far the con has come. It sure as hell wouldn't have fit in the tiny conference room in the Sands.

Re:Dumbasses @ FBI (1)

afabbro (33948) | more than 3 years ago | (#33092990)

We're talking about a bunch of hackers here. When I went to my first Defcon, I was socially ackward as all get out.

Ah, so you fit right in.

Re:Dumbasses @ FBI (2, Interesting)

thePowerOfGrayskull (905905) | more than 3 years ago | (#33092822)

Because those are the very places that real black-hats would target, so those are the ones with the measures in place to intercept attempts at social-engineering exploits.

I work at one of those places, and I gotta say... those "measures" aren't as stringent as I'd like them to be. That is to say - we get employee training (CBT) once a year to refresh our knowledge of various procedures, and it touches briefly on social engineering (a single slide).

Now - I'm in the IS department, so it may be that those in lending ops, etc have a different story. For us the "measures" in place rely solely on the common sense of each employee.

Scary, isn't it?

Re:Dumbasses @ FBI (1)

clarkkent09 (1104833) | more than 3 years ago | (#33092090)

The publicity hardly helps. I wonder if any of the organizations called will know what's going on and use the opportunity to mess with the contestants.

Re:Dumbasses @ FBI (2, Insightful)

tuomoks (246421) | more than 3 years ago | (#33093058)

Unfortunately - yes! Hide the head in the sand, that seems to be the answer nowadays for any- and everything? For a long time, excuse me - started in 60's, I was either responsible of or designing systems and infrastructures for safe and secure, often global environments - can't say that they were perfect, nothing ever is. Time to time (often) the hired security testing groups / companies were able to find some problems, even if documents in wastebaskets - in IT(?) which should have known better, but the main thing was to find the problems, not to hide them!

You look companies / corporations today, they use much, much more money and time to hide the problems, trying to recover from problems, paying to public and/or government the fines, whatever than preventing the problems? Nothing (much) wrong, business as usually, but sometimes wonder why the stockholders / owners are willing to throw good money - and sometimes good reputation, away? Just wondering - LOL!

This is refreshing (4, Insightful)

Majik Sheff (930627) | more than 3 years ago | (#33091300)

It's nice to see the hacker community making a move to acknowledge its roots. Social engineering is the oldest and easily the most challenging/rewarding form of real hacking.

What's more gratifying, beating the password out of a hash after weeks of brute force or having the mark just tell you in a five-minute phone call?

Re:This is refreshing (2, Funny)

al0ha (1262684) | more than 3 years ago | (#33091372)

Yeah - social engineering used to be called grifting. But I guess grifting is not as cool a buzzword as anything associated with engineering. Social engineering, puhleez; like it takes a lot of brains to grift a rube.

Re:This is refreshing (5, Funny)

Hatta (162192) | more than 3 years ago | (#33091540)

I prefer to beat the password out of the mark after 5 minutes of brute force.

Re:This is refreshing (0)

Anonymous Coward | more than 3 years ago | (#33091756)

That's why everyone call you a script kiddie.

Re:This is refreshing (1)

Runaway1956 (1322357) | more than 3 years ago | (#33091894)

Whoosh.

GP was referencing an XKCD page, involving a few cheap hardware tools, as opposed to expensive "brute force" password cracking.

Re:This is refreshing (-1, Flamebait)

Anonymous Coward | more than 3 years ago | (#33092168)

Whoosh.

GP was referencing an XKCD page, involving a few cheap hardware tools, as opposed to expensive "brute force" password cracking.

what's with you self-congratulatory "whoosh" fucks anyway? i'm not the least bit surprised you reference XKCD, it seems to be a magnet for your kind. it's a somewhat entertaining, occasionally clever, poorly-drawn comic that you meme repeaters can't seem to get enough of. end of fascination with XKCD.

you like cartoons and comics so i got one for you. you remind me of the people in that South Park episode about the hybrid cars who are so smug that they love the smell and taste of their own farts. uhhhh uhhh whoosh xkcd *farts* *sniff sniff*

i'm not the AC to who you replied but since you seem to have difficulty comprehending him i can explain it for you. the point is, the rubber-hose method requires no technical skill and therefore any script kiddie could do it.

Re:This is refreshing (1)

HungryHobo (1314109) | more than 3 years ago | (#33092244)

Wow, the population of grim humourless dicks on slashdot seems to have expanded considerably these last few months.

Re:This is refreshing (0)

Anonymous Coward | more than 3 years ago | (#33092590)

That is a change I most enthusiastically welcome if it means I'll see less of the countless knee-jerk attempts at humor every single Slashdot discussion is drowned in. Sadly, this doesn't seem to be the case.

Re:This is refreshing (1)

dsoltesz (563978) | more than 3 years ago | (#33093284)

At one time, about five minutes ago, I would have agreed wholeheartedly. But now that I've seen grim humorless clueless trolling dicks in action, I'll take the lame geek humor. That's what comment moderation is all about.

Re:This is refreshing (0)

Anonymous Coward | more than 3 years ago | (#33093410)

Wow, the population of grim humourless dicks on slashdot seems to have expanded considerably these last few months.

Runaway1956's "whoosh" would have been humorous ... if it was valid. It was not valid. This raises the question of why Runaway1956 didn't realize that himself. Smugness at having the flimsiest excuse to say "whoosh" to somebody was the explanation offered.

You know what else describes a humorless dick? Laughing at something that isn't really funny. Like a repetitive Slashdot meme that was funny the first several hundred times but has since lost its luster. Like such a meme that wasn't even used correctly. Like such a meme used in such a way for no reason other than to elevate oneself and show solidarity with a group by putting someone else down falsely. That's the humorless part.

The dick part is that you call someone names for pointing out that there is something wrong with this. I'll let you in on a little revelation about yourself. You don't defend these sad attempts at wit and wisdom because they are genuinely humorous. No. You defend them because you want desperately to feel like you belong someplace and are part of some group or culture. A big part of that feeling is reinforcing the artifacts of that culture. That's why you defend the Slashdot memes.

Try being an individual if you manage to find the guts. Until then, be comforted by your membership in another group you've not yet recognized, for the population of cowards like you has remained roughly the same.

Re:This is refreshing (0)

Anonymous Coward | more than 3 years ago | (#33092308)

You must be new here.

Re:This is refreshing (0)

Anonymous Coward | more than 3 years ago | (#33093506)

u mad?

Re:This is refreshing (2, Informative)

DigiShaman (671371) | more than 3 years ago | (#33091784)

Hackers by and large just do it for the challenge. Both creating and solving intellectual puzzles.

Crackers OTOH usually do it for nefarious reasons. If you're a cracker, it's usually to achieve an objective for a greater plan. You want to be silent, stealthy, and render the goal long before anyone becomes the wiser. Social engineering for all its effectiveness increases the risk of exposure.

Re:This is refreshing (-1, Troll)

B4light (1144317) | more than 3 years ago | (#33091836)

Hackers hack computers. Crackers crack programs. Stop coming up with stupid definitions that are not correct.

Re:This is refreshing (0)

Anonymous Coward | more than 3 years ago | (#33092980)

Lol wut? Hacker/cracker is hard/software "engineering" ? Your card plz.

Re:This is refreshing (1)

dsoltesz (563978) | more than 3 years ago | (#33093298)

Sheesh people! Who the hell left the front door unlocked? Next thing you know we'll have Twilight fans wandering in here. Perhaps it's time to add a "Poser" moderation category.

Re:This is refreshing (0)

Anonymous Coward | more than 3 years ago | (#33092982)

If anything, this is (or should be), a fairly sound experiement in social engineering and present day perceptive security.

I'd argue that the FBI and financial industries are reacting the opposite of how they should. If properly monitored, this should produce some fairly valuable intel for them, presumably free of charge.

I have to wonder if reactionary fear for anything 'unfacillitated by the Gov.' is standard procedure? Seems like it's been that way for decades.

Re:This is refreshing (1)

slick7 (1703596) | more than 3 years ago | (#33093458)

It's nice to see the hacker community making a move to acknowledge its roots. Social engineering is the oldest and easily the most challenging/rewarding form of real hacking.

What's more gratifying, beating the password out of a hash after weeks of brute force or having the mark just tell you in a five-minute phone call?

Wait until the Chinese (or name your ethnic group here) get a load of this. The sophistication of the American haxorz is limited by the human languages they speak.

Okay, be honest. (4, Funny)

peacefinder (469349) | more than 3 years ago | (#33091330)

Who here clicked the link to www.social-engineer.org before thinking about the potential consequences?

Have you just been had? :-)

Re:Okay, be honest. (0)

Anonymous Coward | more than 3 years ago | (#33092218)

I clicked it from home. But, the thing is so slashdotted that it doesn't even load anyway. It just times out. Or, is that just what they want me to think? Oh no, now you've got me wondering...

Someone call 911! (0)

Anonymous Coward | more than 3 years ago | (#33091332)

Social-Engineering.org's server is on fire!

Rules and Do-Not-Do list (5, Informative)

Zerth (26112) | more than 3 years ago | (#33091374)

The CTF Rules

Each Social Engineer is sent via email a dossier with the name and URL of their target company chosen from the pool of submitted names.

Pre-Defcon you are allowed to gather any type of information you can glean from the WWW, their websites, Google searches and by using other passive information gathering techniques. You are prohibited from calling, emailing or contacting the company in any way before the Defcon event. We will be monitoring this and points will be deducted for "cheating".

The goal is to gather points for the information obtained and plan a realistic and appropriate attack vector. The point system will be revealed during the Defcon event. All information should be stored in a professional looking report. 1 week prior to Defcon you will submit your dossiers for review to the judging panel.

They will be sent their time slot (day/time) to perform their attack vector at Defcon. At Defcon each social engineer will be given 5 minutes to explain to the crowd what they did and what their attack vector is.

They are then given 20 minutes to perform their attack vector and points are awarded for information gathered as well as goals successfully accomplished during the process.
A scoreboard will be kept and at the end some excellent prizes will be awarded.

The Flag

The "flag" is custom list of specific bits of information, which you will have to discover during your 20-minute phone call.The judging panel created the list, and points will be awarded for each item present on the list. This list will be presented to you on the day of the event

THE DO NOT LIST:

Underlying idea of this contest is: No one gets victimized in the duration of this contest. Social Engineering skills can be demonstrated without engaging in unethical activities. The contest focuses on the skills of the contestant, not who does the most damage.

Items that are not allowed to be targeted at any point of the contest:

1) No going after very confidential data. (i.e. SS#, Credit Card Numbers, etc). No Illegal Data
2) Nothing that can get Social-Engineer.org, Defcon, or the participants in the contest sued
3) No porn
4) At no point are any techniques allowed to be used that would make a target feel as if they are "at risk" in any manner. (ie. "We have reason to believe that your account has been compromised.")
5) No targeting information such as passwords.
6) No pretexts that would appear to be any manner of government agency, law enforcement, or legally liable entity.
7) The social engineer must only call the target company, not relatives or family of any employee
8) Use common sense, if something seems unethical - don't do it. If you have questions, ask a judge
If at any point in the contest it appears that contestants are targeting anything on the "No" list, they will receive one warning. After the one warning they are disqualified from the contest.

Re:Rules and Do-Not-Do list (2, Insightful)

Score Whore (32328) | more than 3 years ago | (#33091454)

If they aren't going after confidential data, then what exactly is the point here? What I mean is, why would a company care about non-sensitive data, so what protections/security/whatever are they supposedly penetrating here?

Re:Rules and Do-Not-Do list (5, Insightful)

rotide (1015173) | more than 3 years ago | (#33091572)

Not everything needs to be about obtaining damaging information. Imagine talking to a random stranger and trying to solicit information from them. It's not as easy as it sounds.

Seriously, try this some time, just go up to a stranger and get their middle name. It will be harder than you think in most cases, if not impossible.

Social Engineering is a skill. You have to be very good to go under the "what the fuck does this guy want" radar. You have to be able to read people without seeing them and be able to think very quickly in a very dynamic situation. Again, all while staying under their radar.

Getting confidential, personally sensitive, or business critical information isn't the point nor appears to be the goal. Merely being good with your social skills (and we're talking a special breed of nerds here, no offense to them though), no great with them, is the point. Having a laundry list of weird and/or "not normally given out" information and trying to gain it, that's going to be hard.

Re:Rules and Do-Not-Do list (1)

lisany (700361) | more than 3 years ago | (#33091772)

"Excuse me sir, what is your middle name?"

Re:Rules and Do-Not-Do list (3, Insightful)

JWSmythe (446288) | more than 3 years ago | (#33092390)

    [ignores you like a homeless guy asking for a dollar for more booze and walks away]

    Good try.

    "Excuse me sir, I'm with the [state] joint anticrime taskforce." [flashes official looking id printed up not long before] "We're performing random checks on the citizens in this area. May I see a photo ID?"

    [citizen hands him his drivers license].

    "Thank you Mr " [reads last name from ID] ". We've already had several instances today where criminals have attempted to run when asked for their identification. Have a wonderful day. We appreciate your cooperation."

    His middle name was Henry. He was born October 28, 1955.

    I know, in the game you're not allowed to pretend to be from a government agency. It just made this easier. If you're digging for personal information, you just have to craft "who" you are to be something where they'd want to hand over the information without asking too many questions.

Re:Rules and Do-Not-Do list (1)

Score Whore (32328) | more than 3 years ago | (#33093634)

I don't think you get my point.

If I'm sitting on the bus and you sit down near me and say hello, I'll go ahead and say hello back. If you then comment about the weather I'll respond about the weather. We can have a nice conversation about a local sports team, you might ask me if I was at the game yesterday and I'll tell you no, I wasn't. You can go ahead and pat yourself on the back about extracting that information with your mad social engineering skills, but the reality is all you've done is be part of normal conversation. If you don't manage to get something I give a shit about keeping private, if you don't establish some kind of trust above and beyond the ordinary, if you don't get inside my walls, you've not accomplished anything. The fact that I talked to you about inconsequential chit-chat isn't social engineering, it's just being a normally functioning human being.

This contest is like demonstrating safe cracking skills by going to the bank and taking cigarette butts from the ashtray outside the front doors.

Re:Rules and Do-Not-Do list (4, Interesting)

garompeta (1068578) | more than 3 years ago | (#33091818)

There are very cool pranks done at HOPE, which was enlightening. Emmanuel Goldstein called to BP and ended up convincing an employee to leave open the office door, and telling him that because it was too late he wouldn't be appearing with the company van. He didn't get any confidential information regarding to the store (surprisingly, some of the employees seemed to be trained and others seemed to be very stupid to understand the questions) but if wanted he could have gone to the gas station with a free pass to the office, from an unmarked unbranded van. That is social engineering.

what if that info just comes out? like the other s (1)

Joe The Dragon (967727) | more than 3 years ago | (#33091822)

what if that info just comes out? like the other side just start saying it all or some act's like a VP that need help and some one just gives them way to much info?

Re:Rules and Do-Not-Do list (1)

Snowmit (704081) | more than 3 years ago | (#33091908)

Wait back up to the part where the organisers can detect wrongdoing before the contest starts because "we will be monitoring this." How?

Re:Rules and Do-Not-Do list (1)

HungryHobo (1314109) | more than 3 years ago | (#33092284)

Doesn't this cover everything?
I've heard it said many times that you can be sued for anything.

"Nothing that can get Social-Engineer.org, Defcon, or the participants in the contest sued"

The companies could sue for their feelings being hurt, they could sue for damage to their reputation, they could sue for the wasted time of their employee, they could sue the organizer for being ugly, they could sue for the sky being blue.

Now weather they'd win for some of those things is a different matter.

If they go to my bank... (1)

Reginald2 (1859758) | more than 3 years ago | (#33091424)

They probably won't have to do much. They've sent a letter stating that my personal information has gone missing three times in two years. In the age of data mining, I don't think this will be as much of a challenge.

Re:If they go to my bank... (3, Insightful)

John Hasler (414242) | more than 3 years ago | (#33091668)

They probably won't have to do much. They've sent a letter stating that my personal information has gone missing three times in two years.

And yet you continue to do business with them. It's pretty obvious why they don't have to do much.

Re:If they go to my bank... (3, Interesting)

JWSmythe (446288) | more than 3 years ago | (#33092498)

    Sometimes that info comes from places you'd rather it not. I got a letter a couple years ago from the VA (United States Veterans Affairs). I was in the military for about a month, almost 20 years ago. (It was a preexisting disqualifying medical condition, for anyone who really wonders.) They sent it to a friends house where I frequently got mail. It stated that my personal information may have been compromised due to a breach of the VA computers. I had seen the news story about it about a month before and didn't think it would apply to me. It's so comforting that I was in a system I shouldn't have been in, and they lost my information to unknown parties, who could be doing almost anything with it. Since they knew a valid address for me, nowhere near where I lived when they collected the data, I have to assume they kept addresses updated from another source.

    Ya, I'd rather not do business with the VA, but apparently they know about me.

    Sometimes I wonder about banks that I've done business with in the past. Some have closed and merged so many times, I have no clue who they are now. A friend of mine got a nasty letter from a bank a couple years ago. He had closed his account with them over 20 years before that. Apparently when they merged with other banks, to fluff their "account holders" numbers, they reopened closed accounts. After the mergers, they started assessing fees to the accounts. He was now on the hook for all kinds of fees they assessed the closed account plus interest. When he tried to straighten it out, the bank couldn't find the record, other than the fact that he owed the money. He still gets calls from collections every once in a while asking for the money.

Re:If they go to my bank... (1)

Reginald2 (1859758) | more than 3 years ago | (#33093292)

What isn't obvious is that if banks are too big to fail why are there so many around my house?

lol

Not-so-sensitive?! (4, Funny)

zyxwvutsr (542520) | more than 3 years ago | (#33091468)

What participants can do is collect data on less sensitive subjects such as, "who does your dumpster removal; who takes care of your paper shredding," Hadnagy said.

"If you don't tell me, I'll look at the dumpster behind your building and read the name on it!"

Re:Not-so-sensitive?! (1)

tommeke100 (755660) | more than 3 years ago | (#33093988)

yeah exactly!
And how hard is it to get an operator job in a call-center?
If someone really wants information low-paid operators have access too, how about getting a job there and have access to whatever you like?

Re:Not-so-sensitive?! (1)

CharlyFoxtrot (1607527) | more than 3 years ago | (#33094044)

yeah exactly!

And how hard is it to get an operator job in a call-center?

If someone really wants information low-paid operators have access too, how about getting a job there and have access to whatever you like?

It's more risky if they know who you are and are physically on site, not to mention a lot more time consuming.

I feel sorry (5, Insightful)

blantonl (784786) | more than 3 years ago | (#33091484)

I feel sorry for the poor fish in the barrel that gets shot on this one.

Unwittingly, right now, some guy/gal is sitting in their cubical and is on the cusp of getting the phone call that thrusts them into the international spotlight when the tape of the winning team's efforts is played. They might even lose their job for doing nothing more than, well, doing their job, or answering a harmless set of questions.

Re:I feel sorry (0)

Anonymous Coward | more than 3 years ago | (#33092158)

Not me, I got laid off two weeks ago.

Re:I feel sorry (1)

craw (6958) | more than 3 years ago | (#33092932)

I also feel sorry for the poor fish in the barrel. What would be interesting to monitor is how far up the management chain the sh*t flies.

In a more perfect world, those that succumb to social engineering would then have their bosses/supervisors subjected to the same social engineering, and if they fail, their bosses/supervisors would then be subjected to social engineering....

Re:I feel sorry (2, Interesting)

T Murphy (1054674) | more than 3 years ago | (#33093646)

If their boss actually follows what happens at DefCon, that boss might be smart enough to know how to handle the situation without firing anybody.

Re:I feel sorry (1)

drinkypoo (153816) | more than 3 years ago | (#33093996)

They might even lose their job for doing nothing more than, well, doing their job, or answering a harmless set of questions.

If they lose their job for doing their job, then they can lose their job for doing their job any old time, not just if they are used to win this contest. What is far more likely is that they will lose their job for doing something they thought was their job: giving away information they are not really supposed to. And they should lose their job in this instance. It does not matter if someone is trying to fool them, or if they are just idiots. If they can't do the job, then they need to not have it.

rattles FBI nerves... (1)

Michael Kristopeit (1751814) | more than 3 years ago | (#33091490)

yeah, the nerves around their funny bone.

they probably set the whole thing up so they could document the attempts rather than dream them up on their own so they could develop a counter procedure policy.

Re:rattles FBI nerves... (1)

rotide (1015173) | more than 3 years ago | (#33091598)

Careful, that creaking sound that comes from your chair isn't actually a creak.. The gubment put a listening device in it and sometimes you hear feedback from their end. In fact, that's how you can tell it's a new version of the bug. They can whisper suggestive things to you as a form of mild brainwashing. I mean, really, your libido isn't that great, they're just failing to get you to go to the kiddie porn sites. Sadly they only keep catching you viewing the granny porn.

Shhhh!

Ugh (-1)

Anonymous Coward | more than 3 years ago | (#33091526)

All this does is put others on a heightened alert, and make this sort of thing harder to do. They're ruining it for everyone prancing around in the spotlight like this.

No, this is good (3, Insightful)

i_want_you_to_throw_ (559379) | more than 3 years ago | (#33091672)

If anything social engineering is THE weakest link in the security chain. Let the geeks handle the hardware security but people really and truly need to keep having it pounded into them that they always need to be vigilant and to recognize these attempts.

I can verify this (5, Informative)

Anonymous Coward | more than 3 years ago | (#33091710)

Posting as AC for obvious reasons, and I can't offer anything in the way of proof (again, for obvious reasons) but I do work for the US Navy in a division that deals with intelligence. We've been getting floods of emails from up on high warning us about Defcon "threats" and that we shouldn't answer any questions from people who call us that we don't know, etc etc.

Re:I can verify this (3, Insightful)

Anonymous Coward | more than 3 years ago | (#33092242)

Wait, so what do the higher-ups expect you do on ordinary days when Defcon isn't running? Be less vigilant and answer any and all questions posed? What silly advice. What's a good precaution in the week of Defcon should be good *all*of*the*time*.

All they're really trying to avoid is potential embarrassment if something gets in the news.

Re:I can verify this (4, Insightful)

Dhalka226 (559740) | more than 3 years ago | (#33092998)

That doesn't mean it's not worth occasionally reiterating, especially when there's a specific reason to believe there may be an increased chance of something happening.

It's not like they're spending millions of dollars to defend it or something, just sending a few emails.

Re:I can verify this (0)

Anonymous Coward | more than 3 years ago | (#33092716)

I don't doubt it we have gotten many over here as well. I forwarded this article to most of the department and everyone is really getting a kick out of it. I doubt anything will make it over here since we don't take many civilian calls anyway. What section are you in anyway? I might even be in the same building!

Re:I can verify this (1)

nospam007 (722110) | more than 3 years ago | (#33094046)

"we shouldn't answer any questions from people who call us that we don't know, etc etc."

Yeah, I never get a virus because I open only mails from my friends.

The information they want is almost too innocuous. (2, Funny)

yakovlev (210738) | more than 3 years ago | (#33091900)

Given that the information they want is so innocuous (see their examples,) the way I would probably handle it is:

1.) Get a list of past DefCon attendees from the company.
2.) Find prior attendees NOT attending the current DefCon.
3.) Call those prior attendees up and say "DefCon this year is doing a social engineering CTF, can you help me out by providing some silly and innocuous data about your company/building?"

This could work surprisingly well, so long as you got somebody willing to play along and help you "cheat."

In fact, this approach (or something similar) would probably be so common and so effective that there might be a rule added against it.

What would be particularly funny is if you didn't actually check if they were attending this year, and the "victim" was sitting in the audience!

Re:The information they want is almost too innocuo (0, Offtopic)

JWSmythe (446288) | more than 3 years ago | (#33092598)

    I haven't been to a Defcon yet. Shit always comes up. But, don't they still take cash at the door? Do you have to provide a photo ID? I've been to several conventions where I observed the people ahead of me and when they don't ask for an ID, I just give a fake name and pay cash. I used to have a bunch of ID badges for "JW Smythe" hanging on my office wall (when I had an office) from various places. I don't feel it's necessary for every schmuck in the world to know who I really am.

ahem... (2, Insightful)

Anachragnome (1008495) | more than 3 years ago | (#33091982)

"The group organizing the contest has established a strict set of rules to ensure participants don't violate any laws. "

I think what REALLY scares these guys (the Feds and the Banks) is that they know damn well that MOST hackers out there do not limit themselves with any silly, self-imposed rules.

Just imagine what the contestants could do without legality/illegality issues hindering them. Anything learned here will simply be repeated, by someone, with no such hindrances in place.

Can they spoof CallerID? (3, Interesting)

HockeyPuck (141947) | more than 3 years ago | (#33091992)

On my desk phone at work, if someone calls from their desk or a number that is currently listed in the directory, their name and number shows up on the display. It's pretty obvious if someone calls up from an outside line. Now if the contestant is allowed to try to spoof my company's phone system into thinking they are from say, HR, more power to them..

Re:Can they spoof CallerID? (2, Informative)

radish (98371) | more than 3 years ago | (#33092318)

The usual approach is to call someone pretty much at random, and ask to be transferred to the real target. That person then sees an internal number (typically of someone they don't know) calling them and to some degree lets their guard down.

Re:Can they spoof CallerID? (2, Informative)

JWSmythe (446288) | more than 3 years ago | (#33092644)

    Usually it's not that tough to get info. I always maintained an East coast US phone number, regardless of where I was working. I was always doing work things from my cell phone, like dealing with datacenter folks.

    Sometimes in the course of normal work, I'd need to acquire access for a coworker to a site. My name was usually listed as a person authorized to make account changes. If it wasn't, I knew the people who would be. A few times, I called as the owner of the company, added myself to the list of people with site access and then scheduled myself to show up and get an access badge. It didn't matter that I was calling from a cell phone from the wrong side of the country. If those should fail, the good old "I just started work here yesterday, I was told to do this..." got it done. A few places wanted emails from authorized individuals to make changes. Oohh, spoofing an email, that's real tough to do.

From: William Gates
    To: HR
    Subject: JW Smythe

    JW Smythe has been hired to work in the IT department. Provide him all the required credentials so he can begin work on August 2, 2010.

    BG

  It was easier where I knew all the right addresses, and the writing styles of the authorized folks. That, and I wouldn't get in trouble, since they actually did tell me to do it, even though the third party didn't know.

Re:Can they spoof CallerID? (1)

tibit (1762298) | more than 3 years ago | (#33093442)

It's trivial to spoof caller ID in the U.S. Heck, at work our ISDN provider gladly accepts any 10 digit calling party number we feel like providing them. This is the prime reason why you DON'T want to enable pin-less calling from your "home" number, when using calling card services.

Pin-less calling means that the calling card system uses caller ID to bypass the pin. At one point I made a bet with a friend, that I can pick any popular calling card access number, random 10k numbers from a 1M+ metro area area code, and I'll hit at least one number whose owner enabled pin-less calling. I set it to auto-detect and log based on how quickly after the language got selected the silence detector kicked in -- the announcements differ in length between "please enter pin number" and "you have ... x hours ... y minutes available". I hit three pin-less numbers in 10k tries. And I didn't cheat -- I selected a "nominal" area code that wasn't a big immigrant population center. The test took a couple days using idle lines.

I like these set of rules better (-1, Offtopic)

sonamchauhan (587356) | more than 3 years ago | (#33092110)

You shall not steal, you shall not deal falsely, and you shall not lie to one another
- Leviticus 19:11 (NRSV)

Re:I like these set of rules better (1)

Redlazer (786403) | more than 3 years ago | (#33092334)

Except for the long, deadly strings that are attached, they sum up the rules pretty well.

Re:I like these set of rules better (0)

Anonymous Coward | more than 3 years ago | (#33092968)

I like Deuteronomy 21:10-14 better. All US soldiers would have convenient Muslim slave-women, whom they could cast aside by beating them without any need to support them economically, then simply grab another one at the next village they raid.

And if they're already married, the next 10 verses deal with how the first-born son of the wife he hates cannot be discarded in favor of the son of wife he likes, so I hope all you gals at home got knocked up by your soldier boys before they went out and grabbed some Muslim MILF, because that new Muslim boy kid is going to inherit the house, and the car.

Daughters? Too bad. Maybe they can be left in villages for the Iraqi men to conquer so they don't get lonely ovor the next 20 years of this bloodbath.

Re:I like these set of rules better (1)

Jedi Alec (258881) | more than 3 years ago | (#33094052)

For the record, those jeans does not make your ass look fat.

Your ass makes your ass look fat.

Is this what the cyberczar wants? (2, Insightful)

Nyder (754090) | more than 3 years ago | (#33092142)

Just the other day we had a submission about how we aren't prepared for the "cyberwarz" because we can't get people who knows this sort of stuff, or thinks along these lines.

Well, damn, seems to me this would be a great excerise for the fbi/ hls, and whoever else to see about hiring/training peeps for those sort of jobs.

Of course, that makes sense and wouldn't be used.

Entry Form? (0)

Anonymous Coward | more than 3 years ago | (#33092454)

The sites have been slashdotted. How do I enter myself into the competition?

- Hacker

When I worked for ... (0)

Anonymous Coward | more than 3 years ago | (#33092692)

When I worked for (unnamed company) when DefCon was on the timetable, they'd send memo's to all staff to be aware of social engineering attemps.

AKA, we know you've been lax, anyone who gets caught is fired.

Load More Comments
Slashdot Account

Need an Account?

Forgot your password?

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>
Sign up for Slashdot Newsletters
Create a Slashdot Account

Loading...