Hacking People: No Mask Required

Another big social engineering attack just scammed someone out of another Twitter username, and it seems we haven't quite learned our lessons from Mat Honan's earlier case. Why is social engineering still and issue? Haven't we been dealing with this for decades? This talk is about Social Engineering, the high level overview, some quick history, recent hacks, and lessons we can take with us.

Transcript

1. j fa Hacking People No Mask Required Olc aj
2. Olc aj Olc aj im dav!5 Tom Webster “SamuraiLink3” plus.google.com/+TomWebster SamuraiLink3@gmail.com SamuraiLink3.com @SamuraiLink3
3. 980 sBb Olc aj Old Gods and Boogeymen • Fugitive Hacker • Popularized the use of Social Engineering • Became a security consultant and wrote some books. Kevin Mitnick
4. +x V c f lKas asf a %$34 f sf k Old Gods and Boogeymen Frank Abagnale
5. Nm dagk as adfa 0 dsfasdi Old Gods and Boogeymen • His life portrayed in “Catch Me if You Can” • Impersonated an airline pilot, doctor, lawyer, teaching assistant, security guard, etc... • Expert in forgery and manipulation. Frank Abagnale
6. Magic, Curse, Hex, Incantation It goes by many names, But we know it as:
7. Bba f 0 Ku Tq Magic, Curse, Hex, Incantation It goes by many names, But we know it as: Social Engineering Ol c aj
8. Tg Social Engineering What does that even mean? Communicating With an End Goal
9. a Bb ^qi h dG Nbn d s Social Engineering What does that even mean? Manipulate Con Bluff Cheat Dupe Fraud Deceive Lie Use
10. The old gods’ tricks are alive and well And we still haven’t learned their lessons
11. #ip The old gods’ tricks are alive and well Mat Honan • Lost most of his digital life thanks to social engineering leveraged against Apple and Amazon. • Apple issued a temporary password based on Last 4 of Credit Card and Billing Address. • Using Two-Factor Authentication could have saved him.
12. Bn9 The old gods’ tricks are alive and well Mat Honan • Twitter • Personal Website • Personal Website WHOIS: • Name • Gmail Address • Billing Address • Google • Apple Email Address • Amazon • Last 4 of all known credit cards • Apple • iCloud Access Information Found
13. ][ ; The old gods’ tricks are alive and well Naoki Hiroshima • Lost prized Twitter Account (@N) through extortion, enabled by social engineering. • PayPal gave out personal information and last 4 of credit card due to social engineering attack. • Personal information and social engineering used to take over GoDaddy account and hold web services for ransom. • GoDaddy uses last 6 of credit card, representative had attacker keep guessing starting numbers between 00- 09, since he had the last 4. • Naoki was extorted into releasing his Twitter password.
14. Bbn m %G The old gods’ tricks are alive and well Naoki Hiroshima Information Found • PayPal • Personal Information • Last 4 of Credit Card • GoDaddy representative • Other 2 digits of credit card • Complete domain control • Including MX records
15. What can we do?
16. 1. Learn hard lessons
17. 2. Account linking is dangerous
18. 3. Companies hold the keys to our digital lives
19. 3.1 “Some of the biggest companies in the world have security that is only as good as a minimum-wage phone support worker who has the power to reset your account. And they have valid business reasons for giving them this power.” - Josh Bryant
20. 4. We’re bad at this
21. 5. Stop using Credit Cards for authentication
22. DISTRUST BY DEFAULT
23. Thanks!