Sign in Subscribe
Software industry

Social Engineers Expose Vulnerabilities in Corporate Security

Strategic Insights

— 1 min read

Social-engineer.Org, a website aimed at improving corporate awareness of social engineering techniques, has released a report detailing the findings of a recent capture the flag (CTF) contest held at Defcon 18 in Las Vegas. The CTF contest targeted 18 companies, including BP, Shell, Apple, and Google, and revealed alarming vulnerabilities in their security measures. The report highlights the ease with which inexperienced social engineers can access and exploit sensitive information from companies, using free resources like social media platforms and customer service departments.

Key Takeaways:

  • The average entry-level and call center employee did not appear to have adequate security training, making them vulnerable to social engineering tactics.
  • Social engineers can gather valuable information from companies using free resources, such as Facebook, LinkedIn, Twitter, Google Search, and Google Street.
  • Inexperienced social engineers were able to penetrate companies using believable pretexts, such as employee satisfaction surveys or recruitment agencies.
  • Contestants were able to fool targets into opening fake URLs, demonstrating a common attack technique.
  • Companies must find a balance between customer-centered training and anti-social-engineer security training to protect themselves from social engineering threats.

Statistics:

  • 18 companies were targeted in the CTF contest.
  • The report found that most entry-level and call center employees were unaware of the risks of sharing seemingly trivial information.
  • Social engineers used a combination of free resources and customer service departments to gather sensitive information.
  • 90% of targeted companies were penetrated by inexperienced social engineers.
  • The average social engineer spent 30 minutes gathering sensitive information from each company.

Sources:

  • Social-Engineer.Org, "Social Engineer CTF Report" (http://social-engineer.org/resources/sectf/Social-Engineer_CTF_Report.pdf)
  • Continuum Worldwide, http://www.continuumww.com/
  • Science Letter, accessed via NewsRx.com on 2010. (Note: No external date was provided for this source)

Read more