Earlier quoted context omitted.
He basically did this: https://www.youtube.com/watch?v=XsrU2dMBVUQ
That is awesome :)
Aren't you the winner?
Did I just win?
101–110 of 140 posts
Re: Did I just win?
#102Re: Did I just win?
#103Earlier quoted context omitted.
Individually, no, but statistically...perhaps?
Perhaps. There's also the depressing reality that you can't actually stop social engineering conclusively. A sysadmin is always going to need to have a login with administrative privileges, and they're always going to be fallible.
Not entirely true, I work at a bank and many of the most critical core banking systems don't have an admin account at all. Yes there are accounts that perform critical system functions, but they dont have passwords and can't be logged on to interactively.
We make changes to those systems by setting up very intricate situations where the changes are all in the right place at the right time and a bunch of approvals sytems have basically got flags indicarinf changes can be made. Then the changes get included as part of the systems normal operations, as in once it gets a bunch of signals for vaious places it pulls in whatever is in a specific clearcase stream.
Obviously the above description is a huge over simplification, but the only way to social engineer that is if you can convince multiple system managers to approve a change which has already been promoted by tech leads in various departments.
Admittedly it makes "hot"fixes a god damn nightmare because 'oh shit, no one noticed a spelling error in the legal disclaimer sent to business customers? Lets get all 150 technical sign offs again... And get me the number of that lawyer who said that we had to include that!'
Re: Did I just win?
#1041. Create issues for items I need fixed on my github repos. 2. Offer a $100 bounty to people who can trick me into getting some string into my projects. The easiest way to "trick" me of course is to hide it inside of a PR which fixes a real issue. 3. Find and remove the string before merging the PR. I've had one of my issues fixed for free. Rinse and repeat! Bonus Round: Stage an announcement on twitter and have some…
You've discovered that social media is mostly used for getting attention. Congratulations, that was very clever of you.
Re: Did I just win?
#105It's not clever to hack something that you can socially engineer, and that should be hacking 101. Clever win.
For those of you misreading this comment: Aelinsaar is saying that if a system/target is vulnerable to social engineering, then hacking (code) that system/target is not clever.
You could take that concept pretty far. There's no computer system that doesn't involve a human element (CS101). And yet some of the most clever people spend their time finding ways to hack the machine element. Their work inevitably gets understood and integrated into software, either through voluntary submissions through bug bounties or otherwise.
Social engineering has been understood for a long time, and yet we can't develop defenses in the same way we can develop defenses in software. So we have an underpaid workforce of software hackers uncovering vulnerabilities which get patched and an overpaid workforce of social engineers exploiting unpatchable vulnerabilities in the human condition.
Who is really being exploited here?
Re: Did I just win?
#106Are some of you actually arguing over whether or not the website qualifies as a "software project?" Goodness, maybe stop taking the world so literally/seriously.
Re: Did I just win?
#1071. Create issues for items I need fixed on my github repos. 2. Offer a $100 bounty to people who can trick me into getting some string into my projects. The easiest way to "trick" me of course is to hide it inside of a PR which fixes a real issue. 3. Find and remove the string before merging the PR. I've had one of my issues fixed for free. Rinse and repeat! Bonus Round: Stage an announcement on twitter and have some…
He offered him BTC for it.
Not so much free...
Re: Did I just win?
#108Earlier quoted context omitted.
For those of you misreading this comment: Aelinsaar is saying that if a system/target is vulnerable to social engineering, then hacking (code) that system/target is not clever.
You could take that concept pretty far. There's no computer system that doesn't involve a human element (CS101). And yet some of the most clever people spend their time finding ways to hack the machine element. Their work inevitably gets understood and integrated into software, either through voluntary submissions through bug bounties or otherwise. Social engineering has been understood for a long time, and yet we c…
You don't need to crack a safe if you can get the combination from the owner. You don't need to pick a lock if you can pick the key from a pocket. It also goes to the classic XKCD comic about the realities of crypto: https://xkcd.com/538/
As for why so little attention is paid to the human side, I think you said it, "We can't develop defenses the same way we can develop defenses in software." Not only that, but a human being who's brilliant in their role in your company, might be singularly unsuited to learning lessons about social engineering.
I suppose if you want a humorous and somewhat dystopian sci-fi view of how this could be managed... you ever read 'Snow Crash'?
Re: Did I just win?
#109[deleted]
Re: Did I just win?
#110Earlier quoted context omitted.
This is what Social Engineering is. Asking someone to do something that they normally would do, in order to get the desired outcome.
Depends on what the desired outcome it. I read the challenge as compromising one of the pieces of software on the website. Doing that with social engineering was the desired outcome. The attacker thought out of the box to tackle a lesser challenge: getting a string on the website itself. It was technically true under rules, funny, and contest issuer even owned up to it. It's not the real challenge, though. No real-wo…
Websites are made of software.