Pen Testers Break Into Gov't Agency With Fake Social Media ID 109
itwbennett writes "Security experts used fake Facebook and LinkedIn profiles to penetrate the defenses of an (unnamed) U.S. government agency with a high level of cybersecurity awareness. The attack was part of a sanctioned penetration test performed in 2012 and its results were presented Wednesday at the RSA Europe security conference in Amsterdam. The testers built a credible online identity for a fictional woman named Emily Williams and used that identity to pose as a new hire at the targeted organization. The attackers managed to launch sophisticated attacks against the agency's employees, including an IT security manager who didn't even have a social media presence. Within the first 15 hours, Emily Williams had 60 Facebook connections and 55 LinkedIn connections with employees from the targeted organization and its contractors. After 24 hours she had 3 job offers from other companies."
Pen testers? (Score:5, Funny)
Prime Numbers (Score:2)
Re: (Score:1)
It's not unheard of. But a few google searches or a single phone call could've answered that one. (It's hard to attend MIT and not leave an internet fingerprint.)
Re: (Score:1)
Re: (Score:2, Offtopic)
Good. It's nice that they're having a good time. And I'm pleased to meet their friends on Slashdot!
Security? (Score:5, Insightful)
Forget security, the real headline should be "How to get 3 job offers in 24 hours". She must have had some serious (fake) qualifications and/or a smoking hot profile pic.
Re:Security? (Score:4, Insightful)
Yeah, I imagine by "job offer" they mean "recruiter spam".
And by "high level of cybersecurity awareness" they mean that some cunt installed Norton on the desktops.
Re: (Score:1)
Yes. And you should hire "her" without a face-to-face interview, or an actual background check. (and given the apparent nature of the job, a security check / validate "her" security clearance.)
Re: (Score:3, Funny)
So you're to blame for everything that's wrong with me!
Re: (Score:2)
Forget security, the real headline should be "How to get 3 job offers in 24 hours". She must have had some serious (fake) qualifications and/or a smoking hot profile pic.
I'm on LinkedIn and I get lots of fake job offers.
Oh wait, that's not what you were talking about.
Re: (Score:2)
Re: (Score:2)
Wait, a job OFFER in 24 hours, without even an interview or a meeting? Sure, I can see getting 3 requests from recruiters in 24 hours, although that number would be somewhat low.
What else do we expect to do? (Score:5, Funny)
And yet when I accuse people I just met at the company of being Chinese spies, I am the one who is sent to HR. There is some kind of double standard here.
Re: (Score:2, Troll)
Re: (Score:3)
Re: (Score:2, Funny)
We don't like bad beer. We just drink American beer when we're spying on you in an attempt to fit in...
Re:What else do we expect to do? (Score:5, Insightful)
They look just like us but like bad beer and hockey.
And the ones who like good beer stay in Canada.
Re: (Score:2)
There's plenty: micks, paddies, bogtrotters, spud-munchers...
Re: (Score:2)
Aina? Yaderhey, I was better in the '70s.
Re: (Score:2)
Canada had what, like six or eight medals (out of about 300) in the 2012 World Beer Cup? I guess they did sweep the gluten-free category, so there's that.
Yeah, I know American brewers greatly outnumber other countries, so of course they will dominate the medal count. Still, Canada had almost 50 entrants in 2012 and were barely a blip on the radar and 2/3 of the judges are from outside the US.
Point? The best beer in the world likely comes from the brewery that is near where you live.
Re: (Score:2)
Do you post AC because you like to make up statistics?
75% is a gross exaggeration. There seems to be 20 "American Style" categories (out of 95), and fruit beer, coffee beer, chocolate beer, speciality beer, and honey beer does not add up.
You probably also missed all the non-European beers that won European style categories as well. Marzen, Vienna Lager, Kolsch, German Brown Ale, Hefeweizen, Witbier, Saison, a good handful of Belgian styles, a good handful of English styles (including a win for the local S
Re: (Score:1)
Point? The best beer in the world likely comes from the brewery that is near where you live.
Here in Brazil?! Wow...
Re: (Score:2)
Yes, and American baseball teams also swept the World Series. Over 90% of the winners of the Miss Universe competition were born on Earth. Is that supposed to impress anyone?
More than half of all beer sold and consumed in the USA is either Budweiser, Bud Light, or Coors Light. Claiming that craft beers, with less than a 5% market share between them, are somehow representative of beer in the USA is at best wilful ignorance and at worst, marketing.
Re: (Score:1)
Pro tip for you: The world beer cup is a marketing scheme. You pay them for the medals you want, and you get to use the medals in your advertising. I should know, I work in an ad agency and one of our ex clients was a brewery. Their completely average middle of the road swill would have all kinds of medals they won at those things, heavily featured in the advertising like they just climbed Mount Everest or cured cancer or something. It's all bullshit, the medals are bought and paid for.
Re: (Score:2)
Or they try to get you to join their curling club...
Job offers? (Score:2)
How good can a company be if they offer you a job solely on your so-called resume?
No interview, no verification..
Re: (Score:3, Insightful)
Probably just headhunters. I get those all the time through Linkedin.
Re:Job offers? (Score:5, Interesting)
I do regularly get contacted by Indian firms via e-mail or even by phone, but as soon as they find out I am a citizen and not an H1b, then they lose interest.
Re: (Score:2)
Yea, I've had quite a few headhunter's trying to get me to submit my resume to them but no actual Job Offers.
[John]
Re: (Score:2)
The worst is when they tell you one of your colleagues is leaving, and they've recommended you to them, so they need your CV.
I turned around and asked my three partners what they were selling their shares for. Recruiter hung up while they were laughing.
Re:Job offers? (Score:5, Insightful)
How good can a company be if they offer you a job solely on your so-called resume?
No interview, no verification..
I suspect they are grossly misusing the term "job offer." Could be an indication of just what sort of people they have working in their own organization.
Re: (Score:2)
How good can a company be if they offer you a job solely on your so-called resume?
No interview, no verification..
I suspect they are grossly misusing the term "job offer."
I concur; they're probably referring to those mass-spam-emails that go something like "I was looking at your [systems administration focused] resume, and thought you would be a perfect fit for the insurance salesman/financial advisor at some random company that remains nameless."
I get no less than 3 of those a day myself.
Because they used an attractive woman. (Score:5, Interesting)
New security measure: male employees are castrated upon hire. They tried the same attack with a male profile and received no hits.
Aside from that interesting bit, we have heard this story over and over again: Large organizations contain at least a few stupid people. Those stupid people, who are mostly well intentioned, work around security measures and run Java applets to see the company Christmas card, a card that is actually an attack.
Re:Because they used an attractive woman. (Score:5, Insightful)
so really the title should be "attractive women more likely to get job offers." move along, no story here.
Re: (Score:1, Insightful)
so really the title should be "attractive women more likely to get job offers." move along, no story here.
More hires and more everything. I was once surprised by how cute was the Dell representative for HPC in my region. Then I saw the one from IBM. And then the one from HP. By then I had gotten the pattern: they all get cute girls to try to get the geeks to buy their stuff.
Re: (Score:3)
They even sell drugs such as Viagra and alcohol to help you have sex (with partners).
Re: (Score:2)
The women I always see in Viagra (or other ED meds) commercials are in their mid 50's and up.
Not to say older women cannot be attractive, but I wouldn't really call them "booth babes".
Re: (Score:2)
The women I always see in Viagra (or other ED meds) commercials are in their mid 50's and up.
Not to say older women cannot be attractive, but I wouldn't really call them "booth babes".
That's who they are trying to appeal to. Mother's been taking hormones to avoid menopause, and the old man's little soldier isn't saluting like it used to, so she trots him off to the dangler Doc.
If you showed them young women, she'd just get pissed.
Re: (Score:2)
> By then I had gotten the pattern: they all get cute girls to try to get the geeks to buy their stuff.
And by the by, this is isn't the be all nor end all of what they do to get the geeks to buy their stuff either. At my previous company, before the bribery scandal, some things were just blatant. In fact, the vendors had us so good, only the new ones (like Rehat when we first were in talks with them) bothered with an attractive rep in a revealing dress.
The rest just funded our open bar Christmas party, i
Re: (Score:2)
Re: (Score:3)
A friend of mine has an attractive wife. Her mom had a document needed to be faxed. Neither had a fax machine so the mom told the daughter to take it to Office Depot and fax. I don't know if the mom mis-spoke or if the girl had a blonde moment (or both) but in any case, she went to Home Depot instead and asked the guy at the customer service counter to fax it. The guy was like "Um, we don't usually do this, but OK."
Re: (Score:2)
A friend of mine has an attractive wife. Her mom had a document needed to be faxed. Neither had a fax machine so the mom told the daughter to take it to Office Depot and fax. I don't know if the mom mis-spoke or if the girl had a blonde moment (or both) but in any case, she went to Home Depot instead and asked the guy at the customer service counter to fax it. The guy was like "Um, we don't usually do this, but OK."
Absolutely. My better half is pretty attractive, and I'm just an ugly old white dude. I learned long ago that for certain things, like what you speak of, or going into a hardware store, they'll follow her around, and avoid me. So I have her stand there looking cute, horny sales guy comes up and asks if he can help her. Then I come around the corner and ask the actual questions.
I even had her drive off the lot after picking me up at work. You turn on to the main road about 30 feet from a sop light. I've wa
Re: (Score:1)
bbbbutt I thought Straight White Male was the easiest setting??
Re: (Score:2)
I look around at claims like that, and claims of systemic racism and it brings up a term that I didn't know was missing from my vocabulary until recently: Path Dependence
One observation that sticks out in my mind related to this: Children of middle class people who started their lives poor, are more likely to end up poor than middle class children whose parents started out in the middle class.
So, even if you make some sort of change that is supposed to help fix the inequality of opportunity, it doesn't mean
Re: (Score:2)
I do agree with you in your first paragraph - there are a lot ways our culture still makes it harder to be a woman, but there are some laws around that screw guys and make it easy if you're a woman, too. Ideally, we'd fix both types of laws.
After that it goes right into troll territory, though - "It's bizarre how some guys are in their twenties and have simply zero interest in women. They have literally nothing in common with them and no interest in them." Not bizarre at all, I would have no desire to get m
Re: (Score:3)
Re: (Score:1)
New security measure: male employees are castrated upon hire.
Or, hire a bunch of hookers so that male employees stop caring so much.
Large organizations contain at least a few stupid people. Those stupid people, who are mostly well intentioned, work around security measures and run Java applets to see the company Christmas card
Stupid people are the ones who run java :)
Re:Because they used an attractive woman. (Score:5, Informative)
The IT world article explains that the fake account was an attractive woman. The victims who exposed their organizations to attack were men who were trying to "help" this attractive woman in her new position.
Executive summary:
Fake Facebook and Linkedin accounts created for a non-existent attractive 28 year old female who was supposedly a new employee. Apparently the account sent out a lot of friend invitations which were accepted by (seemingly mostly) men who never questioned the invitation or why they had never met this person in real life. The men fell all over themselves to "help" this new employee with some even offering to bypass official channels to get her working sooner. So basically lonely nerds take a shot that friending and helping a hot new chick at work might get them something down the road. The fact that she got job offers means nothing as everybody I know who uses Linkedin (for the record I do not use it) gets job offers all the time. One more thing - they made some fake postings from her so that an internet search would seem to indicate she was a real person. And her Facebook account had a link to an external site with a Java security attack that got some suckers to click on it.
So, they didn't really penetrate anything (Score:1)
Presumably this attractive 28 year old female would have to eventually show up in person with ID for an interview or at least an employee badge, right? How did they plan to handle that part of the "penetration"?
Re: (Score:1)
why do they need to show up in person when they already broke into the computer systems, which was their entire goal?
Re: (Score:2)
Presumably this attractive 28 year old female would have to eventually show up in person with ID for an interview or at least an employee badge, right? How did they plan to handle that part of the "penetration"?
To me, that is the really strange part. Where I worked last, you got your access to anything - the building, your computer, your passwords - in person. A security person escorted you to your badge photo, and you didn't go anywhere with out that. This is not a difficult fix folks.
Re: (Score:2)
I keep seeing people refer to those LinkedIn recruiter contacts as "job offers".
To me they really more look like inquiries, but you still have to pass an interview and prove your endorsements are legit before you get an ACTUAL offer. Not to nit-pick but it's lame when someone gets a recruiter contact and is all "Google offered me a job". Uhhh... NO.
Re: (Score:2)
It's not even about "getting something down the road". Men just turn stupid even when they know there's no chance or they're not interested in it anyway. There's a part of the psyche that wants to help someone who looks cute (puppy or child or attractive woman). There's a part who wants to help out the grandmother. But the fat guy in the tee shirt with lunch stains on it gets told "dude, read the documentation." It's human nature.
I never get job offers from linkedIn. However I do get lots of recruiter
reward over punishhment. (Score:2)
Instead of castration you should have an inhouse department that mainly has women so the lonely tech staff does not have to look at the outside. Think of an art/marketing department integrated in the technical department.
Re: (Score:3)
They tried the same attack with a male profile and received no hits.
A male wouldn't have helped the organizations diversity quota.
Since when ... (Score:3)
...was being added to an employee's facebook or linkedin page a 'Security Attack' or really any sort of real risk? How is making a friend request a "Sophisticated Attack"? Sure, you can start linking information together, but this is an attack in the same way that a honey bee at the pool counts as a deadly swarm of African hornets.
As for the "job offer," why do I suspect that the 'job offers' were not real job offers, but rather requests to apply for a job? You know, like everyone who's on linkedin who has any qualifications or prior experience gets about 3-4x a day, more if you've got a resume with certain keywords in it? Anyway, why is any of that relevant to a security probe?
I read a book a while back about some of the phone phreakers, and at one point they brought a woman in to the pentagon to demonstrate social manipulation. She was given only a normal phone and phonebook, and asked to get the daily schedule of a specific general, and something like 40 minutes later, she had it. They also had examples of people having extra keys made for doors, purchases and deliveries being made, phone systems being rerouted, and so on. Those sorts of things are attacks.
This was just fluff.
Re:Since when ... (Score:5, Informative)
(and then I read the article)
Okay, the point where they then use the connections to send out xmas cards linked to an attack site which people went to, and how they somehow scammed someone into sending her a work laptop and network access credentials.
That might be better to lead with the actual attacks in the summary, and not just some sort of information gathering setup.
Re: (Score:3)
When you manipulate people face-to-face to bypass security, it is called social engineering.
When you do _exactly_ the same thing not face-to-face but using a computer, it is suddenly "the system's" fault.
Re: (Score:1)
Social Engineering is still a hack. It doesn't require nearly the technical know-how in most instances, but it is still a target on one of the most vulnerable points of a system... The User. Information acquired through social engineering is just as damaging as information acquired through technical hacking. Never forget that without the people integrated into it for its self perpetuation, a system would not have a purpose to exist. Any time a person is trained in the operation or management of a system
Perhaps the best defense.. (Score:2)
Curious... (Score:4, Insightful)
"The attack used built-in Java functionality to get the shell instead of exploiting a vulnerability and required user interaction, but despite these technical limitations, it was very successful, according to Lakhani."
I'm curious what the "required user interaction" was...
I'm pretty tech secure savvy - run noscript, only use the computer with condoms on, etc; But I wonder if I would've fallen for this as well...
If I got a "Christmas Card" from somebody on my company's email I would've allowed the java applet to run. There's an automatic assumption of trust *inside the system* and I would've also assumed that the sandbox mode would be reasonably secure. Was the "user interaction" just allowing the applet to run or did it also ask for something like internet access, which would've thrown up a red flag?
Re: (Score:3)
If I got a "Christmas Card" from somebody on my company's email I would've allowed the java applet to run.
So would I. But I work for an open source company, and you can download everything we have from our website. So security isn't a big concern because their is nothing to steal. In the past, I worked for a defense contractor that did classified work. If an employee emailed a co-worker a java applet, or any other executable content, they would receive a written warning. On the second offense, they would likely lose their clearance and their job.
Re:Curious... (Score:4, Interesting)
If I got a "Christmas Card" from somebody on my company's email I would've allowed the java applet to run.
When I worked for Boeing, one of the supervisors on my project was a fan of Asian male porn (use your imagination). More than a few e-mails supposedly from him contained malware. Given the firewalls we had, I have to think that the infection was hosted on his system. Probably a laptop he carried back and forth to work.
Fortunatly, I ran a Linux desktop, so no Asian male porn popups for me.
Job offer is not "break into" (Score:1)
Re:Job offer is not "break into" (Score:4, Informative)
To "Break Into" you have to get hired, get past security clearance process and then get hired into position that has access to something valuable, then succeed at taking it. When you are willing to manufacture lies "job offer" is an easy part.
Maybe you didn't read all of the article.
[...] men working for the targeted agency offered to help her get started faster in her alleged new job within the organization by going around the usual channels to provide her with a work laptop and network access. The level of access she got in this way was higher than what she would have normally received through the proper channels if she had really been a new hire [...]
If you read very carefully, you will see that "Emily Williams" was given access to the secure but unnamed organization's network without having to do any of those things.
Re: (Score:1)
Here is what pen testers succeeding would look like: Leveraging zero-day exploit in the popular social media platform pen testers gained remote access to Gov't Agency's internal network that
Re: (Score:3)
I don't think "But she didn't play FAIR!" is an acceptable defense here. Someone from outside of a secure organization was able to gain access to protected assets by doing little more than asking nicely. What little defense there was had been penetrated long before any of the spear phishing took place.
Re: (Score:2)
Here is car analogy to help you understand - you have a perfect car alarm, but you car can still get towed away in a sound-proof truck.
Social Media (Score:5, Interesting)
Well, I don't accept connections on Facebook from anyone at work. Too many folks who have distasteful lives (and I don't want them knowing my stuff either). I have received the occasional Facebook chick spam. I figure it's porn and I certainly don't need Facebook to find porn :)
I deleted my Linkedin profile a week or two ago so no connections there either. Way too many headhunter spams ("we have a sysadmin job in New Jersey for 6 months for $20 an hour" or better "we are a temp agency, do you need any accounting people?"), marketing spams ("we have this awesome windows management tool" You do know I'm a Unix admin, right?), folks who have no idea of what I do who think I'm a great C programmer, and quite a few folks I have no idea who they are who want to link. So not seeing any benefit, I bailed.
I also don't click on such attachments or Facebook posts. I have relatives sending me links to such Christmas or Birthday card sites and I choose not to click the link. Just a tad paranoid I guess.
In reading the article:
The experiment also shows that attractive women get special treatment in the male-dominated IT industry. The majority of individuals who went out of their way to help Emily Williams were men. The team actually tried a similar test in parallel with a fake male social media profile and got no useful connections.
I wonder if they though to try it with a plainer woman. Since women are so underrepresented in IT, any woman might have received the "special treatment".
In general though, I think it's true. Social Networking, either by Social Media or in person will certainly eventually gain you access. Folks are helpful. At work the Customer Service folks get the most awards for being helpful. Upper management even had a Customer Service demonstration for our last company wide meeting. I think it'll take a big change to get that sort of behavior changed.
[John]
Re: (Score:1)
I also don't click on such attachments or Facebook posts. I have relatives sending me links to such Christmas or Birthday card sites and I choose not to click the link. Just a tad paranoid I guess
That doesn't sound paranoid to me. Most of my relatives don't even know how to shut down their laptops and just leave them in sleep till the battery dies and then wonder why the battery's are shot after a year. They are also way to trusting online, they might get a spam email saying "CHECK OUT R NEW CHRSTMS CARD APP!!!" and click on it and then use the malware site to send all there friends/family a "Christmas Card" which infects there computer an who ever opens it.
My general rule is, if it's from my Mom, S
Elaborate social engineering hack != "pen testing" (Score:4, Interesting)
An elaborate multi-factored social engineering hack (commonly referred as a "heist") is quite different than a penetrate test. Anybody can commit fraud, be it a computer illiterate juvenile or a network security contractor (*cough*Snowden*cough*) by virtue of misleading or reconfiguring enough influential factors (people, systems) to pass whatever security measures are in place.
The same outcome could have occurred by stealing an employee's security badge -- especially if there's an uncanny visual resemblance.
In other words... no news here.
Re:Elaborate social engineering hack != "pen testi (Score:5, Insightful)
How is it *not* a penetration test? They were testing whether they could get in. They got in. How does it matter whether they got in because they tricked a computer into letting them in, or a person? Both avenues are equally important if you want your office to be secure.
Re: (Score:2)
The answer is 'scope creep'. Penetration testers operate under 'normal use' assumptions and will attack system and interfaces 'head-on'. For example, if you have a password-protected interface then it is assumed that password is not know and cannot be known unless said interface can be manipulated in divulging it. Generally speaking you assume that policy and procedures are followed. While you could always torture sysadmin for passwords "getting in" this way will not tell you much about system security. As
Re: (Score:1)
Thank you, sinij. I was going to respond with something similar (scope creep).
Re: (Score:3)
In my experience, social engineering is part of a thorough pen test, just as physical security is. It's usually the most successful/easiest part, too.
Real New is 100% Break-in Success! (Score:2)
To quote the speaker "Every time we include social engineering in our penetration tests we have a hundred percent success rate,"
That was in big organizations including cybersecurity teams. What this means is that there is a giant freekin SUV wide hole into ALL organizations unless they have smarted up in recent months. Like I am sure they did at healthcare.gov, right?
Re: (Score:2)
Can we think a little less with our dicks guys?
Penetration Testing: Rule 34.