Slashdot Mirror
DefCon Contest Rattles FBI's Nerves
snydeq writes "A DefCon contest that invites contestants to trick employees at 30 US corporations into revealing not-so-sensitive data has rattled nerves at the FBI. Chris Hadnagy, who is organizing the contest, also noted concerns from the financial industry, which fears hackers will target personal information. The contest will run for three days, with participants attempting to unearth data from an undisclosed list of about 30 US companies. The contest will take place in a room in the Riviera hotel in Las Vegas furnished with a soundproof booth and a speaker, so an audience can hear the contestants call companies and try to weasel out what data they can get from unwitting employees."
The group organizing the contest has established a strict set of rules to ensure participants don't violate any laws. Update: 07/31 04:45 GMT by S : PCWorld has coverage of one of the day's more successful attacks.
What dumbasses at the FBI and in the financial industry:
"The list of target organizations will not include any financial, government, educational, or health care organizations;"
It's nice to see the hacker community making a move to acknowledge its roots. Social engineering is the oldest and easily the most challenging/rewarding form of real hacking.
What's more gratifying, beating the password out of a hash after weeks of brute force or having the mark just tell you in a five-minute phone call?
Women are like electronics: you don't know how damaged they are until you try to turn them on.
Who here clicked the link to www.social-engineer.org before thinking about the potential consequences?
Have you just been had? :-)
With reasonable men I will reason; with humane men I will plead; but to tyrants I will give no quarter. -- William Lloyd
Social-Engineering.org's server is on fire!
The CTF Rules
Each Social Engineer is sent via email a dossier with the name and URL of their target company chosen from the pool of submitted names.
Pre-Defcon you are allowed to gather any type of information you can glean from the WWW, their websites, Google searches and by using other passive information gathering techniques. You are prohibited from calling, emailing or contacting the company in any way before the Defcon event. We will be monitoring this and points will be deducted for "cheating".
The goal is to gather points for the information obtained and plan a realistic and appropriate attack vector. The point system will be revealed during the Defcon event. All information should be stored in a professional looking report. 1 week prior to Defcon you will submit your dossiers for review to the judging panel.
They will be sent their time slot (day/time) to perform their attack vector at Defcon. At Defcon each social engineer will be given 5 minutes to explain to the crowd what they did and what their attack vector is.
They are then given 20 minutes to perform their attack vector and points are awarded for information gathered as well as goals successfully accomplished during the process.
A scoreboard will be kept and at the end some excellent prizes will be awarded.
The Flag
The "flag" is custom list of specific bits of information, which you will have to discover during your 20-minute phone call.The judging panel created the list, and points will be awarded for each item present on the list. This list will be presented to you on the day of the event
THE DO NOT LIST:
Underlying idea of this contest is: No one gets victimized in the duration of this contest. Social Engineering skills can be demonstrated without engaging in unethical activities. The contest focuses on the skills of the contestant, not who does the most damage.
Items that are not allowed to be targeted at any point of the contest:
1) No going after very confidential data. (i.e. SS#, Credit Card Numbers, etc). No Illegal Data
2) Nothing that can get Social-Engineer.org, Defcon, or the participants in the contest sued
3) No porn
4) At no point are any techniques allowed to be used that would make a target feel as if they are "at risk" in any manner. (ie. "We have reason to believe that your account has been compromised.")
5) No targeting information such as passwords.
6) No pretexts that would appear to be any manner of government agency, law enforcement, or legally liable entity.
7) The social engineer must only call the target company, not relatives or family of any employee
8) Use common sense, if something seems unethical - don't do it. If you have questions, ask a judge
If at any point in the contest it appears that contestants are targeting anything on the "No" list, they will receive one warning. After the one warning they are disqualified from the contest.
Here, here and here.
They probably won't have to do much. They've sent a letter stating that my personal information has gone missing three times in two years. In the age of data mining, I don't think this will be as much of a challenge.
"If you don't tell me, I'll look at the dumpster behind your building and read the name on it!"
I feel sorry for the poor fish in the barrel that gets shot on this one.
Unwittingly, right now, some guy/gal is sitting in their cubical and is on the cusp of getting the phone call that thrusts them into the international spotlight when the tape of the winning team's efforts is played. They might even lose their job for doing nothing more than, well, doing their job, or answering a harmless set of questions.
Lindsay Blanton
RadioReference.com
they probably set the whole thing up so they could document the attempts rather than dream them up on their own so they could develop a counter procedure policy.
If anything social engineering is THE weakest link in the security chain. Let the geeks handle the hardware security but people really and truly need to keep having it pounded into them that they always need to be vigilant and to recognize these attempts.
Posting as AC for obvious reasons, and I can't offer anything in the way of proof (again, for obvious reasons) but I do work for the US Navy in a division that deals with intelligence. We've been getting floods of emails from up on high warning us about Defcon "threats" and that we shouldn't answer any questions from people who call us that we don't know, etc etc.
what if that info just comes out? like the other side just start saying it all or some act's like a VP that need help and some one just gives them way to much info?
Given that the information they want is so innocuous (see their examples,) the way I would probably handle it is:
1.) Get a list of past DefCon attendees from the company.
2.) Find prior attendees NOT attending the current DefCon.
3.) Call those prior attendees up and say "DefCon this year is doing a social engineering CTF, can you help me out by providing some silly and innocuous data about your company/building?"
This could work surprisingly well, so long as you got somebody willing to play along and help you "cheat."
In fact, this approach (or something similar) would probably be so common and so effective that there might be a rule added against it.
What would be particularly funny is if you didn't actually check if they were attending this year, and the "victim" was sitting in the audience!
"The group organizing the contest has established a strict set of rules to ensure participants don't violate any laws. "
I think what REALLY scares these guys (the Feds and the Banks) is that they know damn well that MOST hackers out there do not limit themselves with any silly, self-imposed rules.
Just imagine what the contestants could do without legality/illegality issues hindering them. Anything learned here will simply be repeated, by someone, with no such hindrances in place.
On my desk phone at work, if someone calls from their desk or a number that is currently listed in the directory, their name and number shows up on the display. It's pretty obvious if someone calls up from an outside line. Now if the contestant is allowed to try to spoof my company's phone system into thinking they are from say, HR, more power to them..
Just the other day we had a submission about how we aren't prepared for the "cyberwarz" because we can't get people who knows this sort of stuff, or thinks along these lines.
Well, damn, seems to me this would be a great excerise for the fbi/ hls, and whoever else to see about hiring/training peeps for those sort of jobs.
Of course, that makes sense and wouldn't be used.
Be seeing you...
Except for the long, deadly strings that are attached, they sum up the rules pretty well.
Guns don't kill people, "with glowing hearts" kills people.
The sites have been slashdotted. How do I enter myself into the competition?
- Hacker
I haven't been to a Defcon yet. Shit always comes up. But, don't they still take cash at the door? Do you have to provide a photo ID? I've been to several conventions where I observed the people ahead of me and when they don't ask for an ID, I just give a fake name and pay cash. I used to have a bunch of ID badges for "JW Smythe" hanging on my office wall (when I had an office) from various places. I don't feel it's necessary for every schmuck in the world to know who I really am.
Serious? Seriousness is well above my pay grade.
When I worked for (unnamed company) when DefCon was on the timetable, they'd send memo's to all staff to be aware of social engineering attemps.
AKA, we know you've been lax, anyone who gets caught is fired.
I like Deuteronomy 21:10-14 better. All US soldiers would have convenient Muslim slave-women, whom they could cast aside by beating them without any need to support them economically, then simply grab another one at the next village they raid.
And if they're already married, the next 10 verses deal with how the first-born son of the wife he hates cannot be discarded in favor of the son of wife he likes, so I hope all you gals at home got knocked up by your soldier boys before they went out and grabbed some Muslim MILF, because that new Muslim boy kid is going to inherit the house, and the car.
Daughters? Too bad. Maybe they can be left in villages for the Iraqi men to conquer so they don't get lonely ovor the next 20 years of this bloodbath.
For the record, those jeans does not make your ass look fat.
Your ass makes your ass look fat.
People replying to my sig annoy me. That's why I change it all the time.
It's obvious that management types are leaking into the Defcon community heavily. I hate the phrase "Social Engineering" and cringe when I hear it. Just another plastic-like buzzword used by management goons on powerpoint slides. The art (it's an Art, not a Science) has been around for a long damn time and already has a name:
http://en.wikipedia.org/wiki/Grifting (aka Confidence Trick)
There's no need to give it a bullshit name make-over.
What a concept, I wish I could go, just to see this one in action. hopefully someone will youtube it...please,please,please...