Showing posts with label social engineering. Show all posts
Showing posts with label social engineering. Show all posts

Monday, April 27, 2009

Social Engineering Master Class at ChicagoCon

I'm excited that next week i'll be attending the Social Engineering Master Class at ChicagoCon with Chris Nickerson and Mike Murray. I'll also be sticking around to give my Client-Side talk for the con portion on Saturday.

The outline for the SE Master Class is up and it looks good!

"The world of Information Security is changing. Budgets are tighter, attacks are more sophisticated, and the corporate network is no longer the low hanging fruit. That leaves web-enabled applications as the vector-du-jour, but that well is quickly drying up for organized crime as well. As they creep up the OSI Model looking for easier ways to steal your corporate assets, they are quickly making their way up the stack to the unspoken 8th layer, the end user. So what is the next step in the never-ending escalation of this cyber war?

To find out, we must do as Sun Tzu taught. "Think like our enemy!" That is, after all, the primary tenet of penetration testing AKA ethical hacking, isn't it? After years of hardening physical systems, networks, OSs, and applications, we have now come full circle to a new dawn of attack. People are now the target of the advanced hacker, and the cross-hairs are focused squarely on their foreheads... literally. It is only a matter of time before corporations feel the pain of wetware hacking requiring a new approach to testing and defense. It has become imperative to assemble a world-class team of experts to train professionals on the technologies and methods of the most dangerous and costly attackers, social engineers."

http://www.chicagocon.com/2009s/semasterclass.html

I think there are still seats available for the class and tickets for the con portion as well.

See everyone in Chicago!

-CG

Monday, April 20, 2009

Back from Notacon

g0ne and I just got back from presenting on Client-Side Attacks at Notacon. You can check out his write up here. I have pretty much the same things to say.

It was definitely a unique con especially that it was more "everything tech" versus hardcore security...so like g0ne said we ended up with lots of down time in between talks we were interested in. We spent a bit of time in the lockpick village so that was fun. I usually don't have time to do that stuff because I have talks I want to see.

that's about it...

Up next ChicagoCon in May. I'll also be up there for the Social Engineering Master Class so I'm excited about that.

-CG

Friday, September 12, 2008

Mike Murray on Human Exploitation 101

http://www.ethicalhacker.net/content/view/209/1/

From the article:

"This is going to be all about dealing face-to-face (or voice-to-voice or text-to-text) with real live people and exploiting the natural tendency to trust.

Of course, this skill underpins everything else that we do when on a social-engineering engagement - in order to impersonate a UPS guy, talk someone out of their password, write a great targeted phishing email, or know exactly where to drop the USB keys - you have to have great skills at exploiting the natural tendencies of humans.

This means a deep understanding of the three fundamental skills (that I have mentioned often in introductory talks and articles on this topic) - the ability to communicate, the ability to be aware of your surroundings, and your ability to control the context (or "cognitive frame") of your interaction."


Human 0days are promised in the future!