12 years in information security experience, but he still considers himself a social
engineer noob. I'm going to quote him on this. He enjoys all aspects of info security, but
enjoys creeping on people and infrastructure using OSINT the most. And he's kind of, even
though he's kind of creepy, he has been accused of having a man crush on the human hacker.
Notice that's accused. This talk is not sponsored by his organization and if it was,
he may be unemployed after giving it. So let's give him our attention. Fahey Owens. The
theme is Beyond Phishing, Building and Sustaining a Corporate SE Program.
Thank you, DEFCON SE Village. Thanks, Chris and Michelle, for this opportunity. I'm a
cybersecurity manager at some financial services company. If you Google me, it'd be pretty
easy to find. I've managed an ethical hacking team, vulnerability management team, and I
have a social engineering team. And they're here today.
And I, if you have any questions about this talk, e-mail me or you can follow me on Twitter.
But I have an announcement to make. I'm a recovery for social, I've been addicted to social
engineering for a long time and I'm in a recovery program for it. But I wasn't always
addicted. In fact, I really didn't believe in social engineering about four or five years
ago. I used to go to DEFCON over in Rio, see the social engineering village, come in, take a seat,
take a look at people in the smelly box. I stayed there for a couple of minutes and I'd leave because I
really didn't believe in it. And I managed an ethical hacking team at the time. And then things
changed. You see, one day I came to work and my boss said, we want you to phish to people. And
I'm like, why would I want to do that? You want me to do what? Phish to people.
That's no fun. I was into Web applications, clients and things of that nature. I did want to phish
not want to phish to people and no one on my team wanted to do that as well. So how hard could
it be? You put a phish together, send an e-mail out and I did that and it was a disaster. We
interrupt operations, the help desk was flooded with calls, the mail team was flooded with
calls and the incident response team was flooded with calls. So I started thinking. I got a
chance to redeem myself. And I had to find a way to answer this question of phishing
organization. So I do what we all do when we have problems. We go to Google. And when I
searched Google I ran upon the social-engineer.org website. Why? That's the same website of the
team that manages the SE Village. So I went there and I listened to all the podcasts that were
there. And I listened to Chris go through puberty in a podcast from number 1 to podcast 60.
I'm just saying, Chris, your voice did get deeper as you moved on. And then I listened to
podcast 44 because that's when a sultry Asian first started. I listened to that podcast about
3 or 4 times. Yeah, I'm a little creepy. 3 or 4. And I read all the SE books and then I
created a methodology. One of the things in this methodology that I created was to communicate.
All the people who should do everything. Okay. And I did that and I had some success. Now,
people still failed, but I did not interrupt the organization's operation at the time. You see
when you run an ethical hacking, or you run vulnerability assessments, you only need to let
the system owner know that you're going to perform an assessment. And they usually complain
because you know they're going to end up with filings. But when you test a people and you
let them know that it's coming they're like, oh OK. And I did that. For the people I was towering back
But see, it comes with a cost. You see that chart at the bottom down there with the line
going down? That's not the click rate. That's your popularity. You see? You will not be
popular if you're phishing the entire organization continuously. So started thinking, is
this really a career? Do really people get, I mean, do people really get paid for this
besides Chris and Michelle? What about the other three deadly social engineering sins such
as USP smishing and phishing? Well, did a Google search and it seems that social
engineering is in good company. It was listed as one of the top six well-paying jobs of 2014.
Right between bomb disposal diver and power line helicopter pilot. And it was still
right behind the elusive ethical hacker. But where are jobs really today? You see, I did a
search on the Google, do a little Google dorking, and you see indeed.com has a lot of
jobs. That's 8,442 jobs. That's enough jobs for us all, right? Well, indeed, simply hired had
150 and zip recruiter had one. You see, those aren't real jobs. Those are fake jobs. Kind of
like fake news. In fact, what they do is they take any hit against social and list it as a job.
So it could be social worker. It could be someone doing something with social media and it's
listed as a social engineering job. But let's take a look at the other side of the spectrum. So,
let's take a closer look at that zip recruiter job. So, this job, it has benefits, which, you
know, we all need benefits. But if you look at the technical skills that you need, you need
about five-plus years of social engineering planning, five-plus years of fishing and vishing
exercise experience, five-plus years operating a simulated fishing platform, and five-plus
years of training and awareness. Now, who in here would really qualify for that job? No, you
wouldn't. They wouldn't. They wouldn't. They wouldn't. They wouldn't. They wouldn't. They wouldn't. They
would all get their asses in the air. But technically that's one. So we Kevinankind, lamb'd
working in Montgomery. We've worked. So, we're working, one. And you know what? That
job is filled. That's probably who applied for it. The job was filled as of July 19th, and don't
ask how I know. As was brought out earlier, we all know that the need for social engineering
continues. Recently, in the IBM cybersecurity threat intelligence index, 95% of all data
breaches involved some form of social engineering, even if an executive board hid it. So, in this
In fact, it continues to impact us as people.
The U.S. elections, good old John Podesta getting a phishing e-mail through the DNC.
And recently they started to state that the French elections were impacted by social engineering as well.
USBs haven't been out of the news.
Just last year there was a study by the University of Illinois that stated about 95% of all students were plugged in USB drives.
And IBM recently shipped USB drives to its customers with malware.
And when it comes to phishing, we don't need to go any further than our own family.
Yes, your grandparents.
Go and ask your grandparents if they've received a phishing call, whether from the IRS or the scam that was going around,
asking if, you know, can you hear me now?
And they say yes, and they get signed up for some type of service.
They get something in the mail.
So the need is still there, whether it's for corporate America.
The need for training is still there, whether it's for corporate America or whether it's for us.
But let's take a look at the millennials.
This is the largest group as of 2015 that's employed in your corporation.
They make up over half of all new hires.
This group is the most technologically advanced group ever.
They literally grew up with the Internet, and they literally grew up with phones in their hands.
This group prefers texting over phone calls.
And, in fact, most of them, over 68%, admit to texting a lot.
Email for them is secondary.
But.
Even with this, overall email use continues to rise.
So that goes to show you that phishing and smishing will be a vector for this generation that's coming in.
I had a chance to do my own survey against millennials, and I had some pretty interesting results.
Fifty-five percent claimed to know about social engineering, so that's pretty good.
You can tell by the size of the audience here.
But ninety-six percent claimed to have been phished or received an unsolicited email.
Or received a phone call or a text message within the last six months.
Eighty-two percent never heard of smishing.
Ninety percent never heard of phishing.
And only 79% would say that they would not plug in a file on a USB drive or a mobile device.
But this arrogant group, 50% of them claim they know how to handle all of the above, even though they never heard of two of them.
Doing research on some of the data that I have access to,
I see a bunch of them still.
They still fail phishing attempts.
In fact, they fail more than us so-called old folks.
Some more research shows that they have poor hygiene as far as security.
There was a recent study that showed that of people who reused their emails,
of the total population that reused their passwords,
of the total populace, 92% were millennials.
In fact, another study showed that even though they're more comfortable using technology than their elders,
that security is still there.
It doesn't flow down into the organization.
So, this is your organization, right?
So how do you move beyond phishing to move to the next three deadly sins?
Smishing, USB access, malicious media, or phishing?
In my experience, I've had to deal with what I call the big three.
HR, legal, and people in the politics.
So, let's start with HR.
We know their job.
Their role is to help protect the people.
They do payroll sometimes.
They do benefits.
And they hire people, and they probably regret hiring me.
But, you want to make sure that you're friends with this group.
You want to make sure that you build a strong relationship with them,
especially if you look to move past phishing.
You don't want to do anything hypothetical like sending a payroll phishing email at the end of the month,
which impacted payroll and your paycheck was messed up a little bit.
And you also want to make sure that you're friends with legal.
They do the thing, you know, they do the right thing.
They do all their lawyer stuff.
I don't know much about law.
But you want to make sure that you understand what the operational impact of sending a phishing email or moving beyond that is.
For instance, on a Friday night, you don't want to send any legal related document because they are obligated to stay there.
And some poor clerk may be there responding to a phishing email unknowingly.
And not that any of this has happened.
Now, let's move on to the last of the big three.
Your company's politics and their ego.
You see.
I have listed Dr. Paul Ekman's seven emotions.
There's anger, disgust, fear, joy, sadness, surprise, and contempt.
Now, you think about the size of your organization.
You think about all of this is always constantly going on.
All these emotions are changing.
All these triggers are happening at any moment of the day.
And when you start to want to move past phishing and they get wind of it, you know, it may be a problem.
I can tell you that I've dealt with anger, disgust, and contempt the most out of all of these seven.
And as you look to move forward with this, you may deal with these as well.
So how do you tame that?
How do you deal with the big three?
First off, you've got to do your homework.
You've got to do the boring stuff.
You've got to go look at your organizational policies and standards.
Because that's the only way that you'll be able to make sure that your programs line up with what the organization says.
How are you supposed to handle a suspicious phone call?
How are you supposed to handle an unsolicited call?
How are you supposed to handle an unsolicited text message on your phone?
Also, you want to add more meat by looking at the threat by using real-time threat intelligence.
You want to look at any threats that happen against your organization and any threats that happen against your industry or your stack.
And also, you want to read any breach reports you can because that will help give you food as you move forward to introducing these new programs or new steps in your program.
And most importantly, you want to create a methodology.
You see, how are you going to handle USB drives across multiple areas?
How are you going to prepare them?
And how are you going to destroy them?
Because there's no way that you send them, even if a USB drive was brought back, there's no way you should send that back out in the field.
The other thing was smishing.
As we look into BYOD devices, you run into legal issues about leaving artifacts on there if you decide to drop payload.
And also the information that you pull back on those devices.
And then, phishing.
Pre-texting.
This is new language for them.
They're not going to understand what a pre-text is, so you're going to have to explain it.
And also, you're going to have to explain what the target should be and what the success rate is.
If someone receives a phishing phone call, what are they supposed to do?
You want to review your local privacy laws, just like they've done here in Nevada.
And you also want to explain how often you're going to do your assessments.
And once again, you've got to communicate to the big three.
And you also want to sustain that.
You're going to want to do data analysis.
You want to get all the data that you can from phishing and smishing results.
You want information like their age and their gender and their language and department of job roles.
Getting this information will help you understand what the attack surface looks like in your organization when it comes to people.
You'll be able to work with training and awareness and have them target their training towards certain parts of the organization.
The other data that you receive from fails from smishing and from the other data that you receive from smishing
and from phishing includes system and device patch information.
You can use that to share with the vulnerability management team to help understand gaps that are in your environment for patching.
And another thing you want to do, get real incidents.
Work with the IR team.
Find out the people who get real phishing emails and check to see what the test results are for them in those phishing emails.
And that way you can also get that to training and awareness and use that to help get specialized training.
And again, continue that line of communication.
And continue that moving on.
And overall you want that to help improve your overall program.
And also you want to get creative.
You know, the organization gets tired or gets used to seeing just your normal fluorescent USB drives with something written across it.
You know, you got a bunch of millennials in there.
They have short attention spans.
So do things like, you know, comic books or comic characters, things of that nature.
And in your organization, people may be starving for hardware.
Use mice.
And I'm not saying you have to program the USB drives.
But just use generic USB drives next to a mouse.
You will be surprised what people plug in.
Even if your organizational policy states that they're not supposed to plug in USB drives, they still plug in a bunch of other things.
And if you don't believe me, get access to your scene logs.
Also, don't try to boil the ocean.
Get access to open source tools.
Use the social engineering tool kit.
Use Kingfisher.
And just recently we started looking at the space.
The smart phone pen test framework from George Weidman.
Other factors that may impact you as you want to move beyond phishing, the size of your organization.
This may not work if it's about 100 people inside your organization.
Okay?
And you also want to make sure you get your executive and leadership buy-in.
I'm fortunate or my organization is fortunate to have that, to have our leaders believe in all four aspects of social engineering.
Okay?
And your budget.
Again, when it comes to USB drives.
You know, not everybody can afford to get 200 rubber duckies.
So you have to get creative.
You may have to write batch files or scripts on those drives.
And last but not least, your company culture.
You know, that plays a big part.
Because, again, as you go against the third leg of that big three, you know, that can be quite challenging to get past.
And if you can't get through any of them, don't try to boil the ocean, as the last speaker said.
Choose just one.
Maybe it's just phishing.
Or maybe it's just phishing.
Depending on if your organization has a large customer service base or a large mobile workforce.
So the goal is to reduce the impact from all social engineering attacks.
Most organizations are doing phishing today.
You know, one of the ways, but we want to push past phishing.
And one of the ways to do that is create a methodology.
You know, we have to communicate with other parts of the organization as we move past phishing.
And we also want to do continuous testing.
Frequency depends upon your culture.
And also you want to take all your findings and make sure that you can get that tied into your social engineering awareness training programs.
So in conclusion, if you're phishing and you're trying to move past that and get to the other four, don't give up.
It's taken me about four years to get to this point.
And also, there's a real need for more social engineering jobs, not just fake ones out there on the web.
So hopefully in the future, one day when you do a job search for social engineer, you'll find about 200 plus jobs.
Thanks.
Any questions?
What's your opinion of services such as Wombat or other platforms that are free-for-all?
I think that SaaS services play a part, especially when you do a large-scale phishing.
But each tool has its particular place.
But I still prefer to use open source tools for certain techniques and attacks.
There's one in the back.
Six to nine months ago, the Department of Homeland Security and the FBI said that they considered phishing to be more dangerous than hacking.
That's right.
I think that's the whole point.
Remember that statement?
Yes, I do.
They actually said that that was more deadly, more dangerous, and more of a threat.
What does that say?
That's saying that it is a threat, right?
I mean, phishing, you know, everyone is phishing right now.
That still continues to be a threat.
In fact, I think the IRS has a training program now that you can take for phishing.
But you can't ignore the other threats.
You know, we still have phishing attacks and smishing attacks that happen.
And especially not only against us personally but against us in corporations.
But, yes, phishing will still be number one for a while.
What about other channels such as Slack?
Such as Slack?
Yeah.
I'll have to think about that one.
So the question is what about other channels such as Slack?
Yeah.
So my organization does a lot of security testing myself and my team because of the nature of the things that we deal with.
But one of the ones I haven't seen them utilize yet is Slack, which would be a very good vector given the rate at which we are hiring people and the people .
So validation against that would be difficult.
So somebody could come in and request something and then your team member may respond to that and provide access without doing proper validation.
And it's not a method that we normally see.
That is a good attack vector.
And I'll have to do some more research on that.
But that's good.
So Slack and other methods of communication.
Yeah.
Any more questions?
Any more questions?
I'm sorry.
Hey, Howie.
What do you think is the least amount of coverage that people don't know about phishing?
Oh, that's a good question.
Which of the four have the least amount of coverage?
I would say most people know about phishing.
And they know about vishing.
They know of it or they've experienced it.
And you hear more people start talking about USB attacks.
And the last would be smishing.
People, they don't know what a smish is or basically a spear phish against a phone.
And they don't know how to respond to that.
No, thank you.
.
.
So how do we handle the limitations of the team size and getting used to the voice?
I'm in a large organization.
So I do a lot of training awareness.
So I don't do any of the calls.
But our team, they're pretty good.
.
.
.
.
.
.
.
.
So the question is have we ever brought in a third party or had a third-party assessment?
People fail or are victimized in their feelings?
Yes.
So that's one of the downsides of kind of doing this, is that you hear a lot of complaints and we have mailboxes or social networking groups set up for people to express themselves.
themselves. And in fact on one of the slides I was going to mention that I think we've
received maybe less than five to ten people who have actually sent emails saying thank you.
Most of them are, you know, why are you doing this? I don't have time for it. This is my
day. This is my job. I don't care. Things of that nature. So one of the things that we do
is I try to give real attacks. I try to give incidents that come across from incident
response and say here, so you don't care about, you know, clicking an email. This is a real
attack that came against this person and the impact would have been X. And that's one thing
that I find helps out a lot. Real attacks. Using canned examples from, you know, a fast tool
doesn't work. But when you show real examples of a CEO who was attacked or just a phishing
attack against someone within the organization, that turns the lights on. Question?
Yeah, I'm kind of curious. These people that are responding backward, negatively, what kind of impact
does it have on them? Are they just wasting their time? Are they off the fire?
No. So, you know, I believe that people should have the ability to express themselves.
But at the same time, you know, they need to understand why we're doing this. So again,
communicating. I like real world information. I like using real world attacks to show them the need.
You misunderstand. What I mean though is people that are upset, are they
upset because of any impact on them other than loss of time because of your attack? Or were they
penalized at all because they didn't handle it very well? I think it's a little bit of both.
So when you read some of the reviews that we received back, it is some point to training.
You know, I haven't had enough training. Or we haven't had, you know, X amount of training. Or it
may be I was in the middle of something and I clicked a link because X. You know, and this was
unfair because my day is busy. So it's a little bit of both.
Good one. So return of investment, when you have a, when you use open source tools,
that keeps down the cost, right? Trying to disperse a boatload of USB drives on a frequent
basis. I can't say how many. You use cheap drives. You know, like I couldn't afford to use
rubber duckies all the time, right? Because of cost. But the return of investment on the overall
program itself. So for me, I really don't have to worry about the click rate going down. I'm not
judged by that. That's another department, which is great. But on the other hand, you want to
define what your success factor is. And that success factor is really defined by what a user
does when they receive a suspicious e-mail or call. Did they follow the right thing? Did they do
the right thing? Which is either, which is reported. You mentioned earlier about real world attacking
and trying to model what actually happened. But you also said about how it might have been
wondrous to interrupt operations. How do you sort of balance the two or three real world attacks
while not simultaneously affecting operations in a negative way? So when you look at real
world attacks, I can use, I can use this. So the, the attack against the DNC, I believe, had a
spear phishing e-mail that was, that was targeted toward cyber security, actually. So the
attack against cyber security, right? When you, when you look at attacks like that, and you
look at the operation, you look at the operational impact. So you're, generally in most
organizations, finance, HR, payroll, those are, you know, those are pretty much your, your
high, high value organizations. And of course you have your executive levels and things of that
nature. So when we go after, when we target those groups, we want to communicate with someone
that's in there, in that area. You want to have someone that's in there that champions you and
understands what's going on. So when you do send that off, so that there's not, you want to
communicate, basically. So there's not mass panic when one of those types of scenarios go off.
Do you, and this kind of goes back to another gentleman's question. When people fail tests,
people who get up there, if they fail on a continuous basis, is there a plan that you guys have in
place within their own management structure to increase the number of people who fail?
How do you address their, uh, knowledge and, uh, feeling responsibility to this?
When they say, I just don't care.
So, okay. So, uh, I'm going to shorten it. How do you, how do you address someone that doesn't care?
Okay. That's a good question because it came up, uh, last week in a conversation that I had.
How do you know that someone doesn't care? You know, how do you know if someone fails 12 times a year,
okay, and they just consistently fail, how do you know that that's egregious? Okay.
So one of the, one of the, the thoughts that I had was you want people to do the right thing no matter
if they fail or not. You want them to report. Is this person doing the right thing or are they just,
you know, failing on purpose? And I think that's, that's probably the only thing that I can
really think of. Are they following the proper, the proper, uh, process for a, a fail within the
organization?
What if they are in a position of power and they can be used to fail? How do you address that?
So, um.
.
If they're, if they're in power and they continues to, continues to fail.
That's, that's still on. Um, camera's still on, right?
.
There is another group that's responsible for training executives at, at my organization.
.
I told you I might be unemployed after this. Yeah.
.
So in the, the slides you had mentioned, uh, uh, an open source framework that wasn't
on the slide.
.
Um, there were, there were, uh, three tools I had listed. One was the, uh, Wisset
social engineering toolkit. The other was King Fisher. And the, the last one was the smart
phone framework by Georgia Weidman.
.
No problem. I got like two minutes. Question?
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
Thank you.