Sunday, August 1, 2010
Smooth-talking hackers test hi-tech titans' skills
Smooth-talking hackers test hi-tech titans' skills
July 31, 2010 by Glenn Chapman
Hackers have been gathering at the infamous DefCon gathering in Las Vegas
Hackers at the infamous DefCon gathering held in Las Vegas are proving that old-fashioned telephone smooth talk is an effective rival to slick software skills when it comes to pulling off attacks on computer networks.
Hackers at an infamous DefCon gathering are proving that old-fashioned smooth talk rivals slick software skills when it comes to pulling off attacks on computer networks.
Ads by Google
Block Hacker Attacks - Analyse security logs & identify hackers. Download GFI EventsManager - www.gfi.com/block-hacker
A first-ever "social engineering" contest here challenges hackers to call workers at 10 companies including technology titans Google, Apple, Cisco, and Microsoft and get them to reveal too much information to strangers.
"Out of all the companies called today, not one company shut us down," said Offensive Security operations manager Christopher Hadnagy, part of the social-engineer.org team behind the competition that kicked off on Friday.
The team kept hackers within the boundaries of the law, but had them coax out enough information to show that workers would have unintentionally made it easier to attack networks.
Workers that unknowingly ended up on calls with hackers ranged from a chief technical officer to IT support personnel and sales people.
One employee was conned into opening programs on a company computer to read off specifications regarding types of software being used, details that would let a hacker tailor viruses to launch at the system.
"You often have to crack through firewalls and burn the perimeter in order to get into the internal organization," said Mati Aharoni of Offensive Security, a company that tests company computer defenses.
"It is much easier to use social engineering techniques to get to the same place."
Other companies targeted were Pepsi, Coca Cola, Shell, BP, Ford, and Proctor & Gamble.
The contest, which continues Saturday at DefCon and promises the winner an Apple iPad tablet computer, is intended to show that hardened computer networks remain vulnerable if people using them are soft touches.
"We didn't want anyone fired or feeling bad at the end of the day," Aharoni said. "We wanted to show that social engineering is a legitimate attack vector."
A saying that long ago made it onto T-shirts at the annual DefCon event is "There is no patch for human stupidity."
"Companies don't think their people will fall for something as simple as someone calling and just asking a few questions," Hadnagy said.
"It doesn't require a very technical level of attacker," Aharoni added. "It requires someone with an ability to schmooze well."
One worker nearly foiled a hacker by insisting he send his questions in an email that would be reviewed and answered if appropriate.
The hacker convinced the worker to change his mind by claiming to be under pressure to finish a report for a boss by that evening.
"As humans, we naturally want to help other people," Hadgagy said. "I'm not advocating not helping people. Just think about what you say before you say it."
Companies that got word of the social engineering contest before DefCon called in the FBI, which was assured by the event organizers that nothing illegal was afoot.
Information about "exploiting human vulnerabilities" was available at the social-engineer.org websit.
(c) 2010 AFP
- wong chee tat :)
July 31, 2010 by Glenn Chapman
Hackers have been gathering at the infamous DefCon gathering in Las Vegas
Hackers at the infamous DefCon gathering held in Las Vegas are proving that old-fashioned telephone smooth talk is an effective rival to slick software skills when it comes to pulling off attacks on computer networks.
Hackers at an infamous DefCon gathering are proving that old-fashioned smooth talk rivals slick software skills when it comes to pulling off attacks on computer networks.
Ads by Google
Block Hacker Attacks - Analyse security logs & identify hackers. Download GFI EventsManager - www.gfi.com/block-hacker
A first-ever "social engineering" contest here challenges hackers to call workers at 10 companies including technology titans Google, Apple, Cisco, and Microsoft and get them to reveal too much information to strangers.
"Out of all the companies called today, not one company shut us down," said Offensive Security operations manager Christopher Hadnagy, part of the social-engineer.org team behind the competition that kicked off on Friday.
The team kept hackers within the boundaries of the law, but had them coax out enough information to show that workers would have unintentionally made it easier to attack networks.
Workers that unknowingly ended up on calls with hackers ranged from a chief technical officer to IT support personnel and sales people.
One employee was conned into opening programs on a company computer to read off specifications regarding types of software being used, details that would let a hacker tailor viruses to launch at the system.
"You often have to crack through firewalls and burn the perimeter in order to get into the internal organization," said Mati Aharoni of Offensive Security, a company that tests company computer defenses.
"It is much easier to use social engineering techniques to get to the same place."
Other companies targeted were Pepsi, Coca Cola, Shell, BP, Ford, and Proctor & Gamble.
The contest, which continues Saturday at DefCon and promises the winner an Apple iPad tablet computer, is intended to show that hardened computer networks remain vulnerable if people using them are soft touches.
"We didn't want anyone fired or feeling bad at the end of the day," Aharoni said. "We wanted to show that social engineering is a legitimate attack vector."
A saying that long ago made it onto T-shirts at the annual DefCon event is "There is no patch for human stupidity."
"Companies don't think their people will fall for something as simple as someone calling and just asking a few questions," Hadnagy said.
"It doesn't require a very technical level of attacker," Aharoni added. "It requires someone with an ability to schmooze well."
One worker nearly foiled a hacker by insisting he send his questions in an email that would be reviewed and answered if appropriate.
The hacker convinced the worker to change his mind by claiming to be under pressure to finish a report for a boss by that evening.
"As humans, we naturally want to help other people," Hadgagy said. "I'm not advocating not helping people. Just think about what you say before you say it."
Companies that got word of the social engineering contest before DefCon called in the FBI, which was assured by the event organizers that nothing illegal was afoot.
Information about "exploiting human vulnerabilities" was available at the social-engineer.org websit.
(c) 2010 AFP
- wong chee tat :)
17 trees uprooted early Sunday
 |
||||||
 |
||||||
SINGAPORE : Seventeen trees were uprooted in the early hours of
Sunday morning, while another 26 trees had branches blown off by gusty
winds of about 77 km/h, according to National Parks Board (NParks).
Of these, eight trees were not managed by NParks.
NParks contractors quickly cleared the fallen trees and branches within the hour, or pushed them to the road verges to be cleared later.
One fallen tree at Jalan Mutiara near River Valley Road hit the boundary wall of a condominium. And a parked car nearby also sustained some scratches.
And over at Burlington Square near Bugis Junction, a restaurant owner recounted what he saw when he approached his restaurant on Sunday morning.
Nayan Patel said: "When I was here, the storm threatened to uproot two trees. The two trees were badly damaged and their branches were falling off. Fortunately it did not happen in the day. So no one was injured."
Of these, eight trees were not managed by NParks.
NParks contractors quickly cleared the fallen trees and branches within the hour, or pushed them to the road verges to be cleared later.
One fallen tree at Jalan Mutiara near River Valley Road hit the boundary wall of a condominium. And a parked car nearby also sustained some scratches.
And over at Burlington Square near Bugis Junction, a restaurant owner recounted what he saw when he approached his restaurant on Sunday morning.
Nayan Patel said: "When I was here, the storm threatened to uproot two trees. The two trees were badly damaged and their branches were falling off. Fortunately it did not happen in the day. So no one was injured."
-
CNA/ms
- wong chee tat :)
Subscribe to:
Posts (Atom)