Exploits in Wetware
summary
Third-place finishes at the Defcon Social Engineering CTF (2017, 2018) back up a claim: OSINT plus vishing easily harvests sensitive enterprise data. Passive recon yields 6,000 minutes of OSINT and public records; a 20 minute live contest extracts VPN, OS, patch level, executive cell numbers and residences. Repeatedly effective pretexts include FedEx, HVAC maintenance, intern/co-op checks and an employee engagement survey. Tools called out: LinkedIn X‑ray, Huntley, Hurricane Electric and Wigle; techniques include the “incorrect confirmation” and layered name‑dropping. Defensive steps are targeted phishing programs, receptionist choke points and microsegmentation.
AI-written summary · about
chapters (11)
- 0:00Welcome and introduction
- 1:51Talk overview and agenda
- 2:33What is social engineering
- 5:45Modern social engineering attacks
- 9:36Social engineering demo
- 11:26SEC TF competition overview
- 14:12OSINT techniques explained
- 17:20Phishing tactics and targets
- 25:58Defending against attacks
- 32:17Tools and resources summary
- 37:32Q&A session
related talks
31mPlease Pick Up: Crafting and Executing Successful Vishing Attacks
58mSocial Engineering: Hacking Humans
44mHacking Humans: Social Engineering Techniques
55mSocial Engineering Overview-How To Prevent Your Co. from Getting Hacked
46mThe Art of Cyber Espionage: Unleashing the Power of SCADA and ICS Hacking
17mOSINT to Compromise
28mThe Path to Infosec is Not Always Linear
54mHacked in hours: Red team assessments unveiling vulnerabilities