DEF CON 31 Phish Stories Contest
https://media.defcon.org/

The Jester!

ENTRANT 3 - birdbird

########################## BACKSTORY SECTION - Entry 3 - birdbird ##########################

For this phish, I am attempting a two-pronged attack that really aims to push incredulity for us, while existing in the universe I’m creating. Pat and Julia are of particular interest to me.

Initial Assumptions: As a single location brick-and-mortar bakery, they are a close-knit group. Although they specialize in custard and cream, they sell other things; They want to drum up press to facilitate expansion; Given their graduation years, they are all around 26-27 years old; As Zillenials, they are internet-cautious (especially Johnny) but also very aware of entertainment for advertising, a la “All PR is good PR”; Julia (+ others) would like to publish a cookbook

Key Assumptions: Pat is an AVID bird enthusiast. She believes she can teach Linda to talk, and regularly attends Parrot Kindergarten (this is a real thing for birds, beyond parrots); Pat is single; Tech-dummy Pat has easily researched, public, poorly protected social media + the bakery IG must have someone they follow with a public IG that can be used for research; As business owners, their emails will be easy to find (OSINT: search, common formats, data breaches)

I did take some liberties in assuming that Pat love-loves birds and is single, but I think that the rest of my assumptions are logical generation-based conclusions as someone in the same age group. Given Johnny is a security professional, he’s right out to target. But Pat readily admits she’s the least tech savvy. Furthermore, she has a niche hobby that I can use to establish familiarity. Although she’s not a baker herself, I envision she either has some rudimentary skills, or if she doesn’t, she still clicks the link to talk and see if perhaps Julia or Johnny would be a good fit, directly forwards the email (hopefully just) to Julia who clicks it because it feels a little more credible when passed on that way.

I think that even Johnny, a security professional, might fall for it if Pat just passes it on as “my friend reached out to me, but I don’t know if I’m good enough to go on…but maybe you are” and I think that since Pat and the bakery are looking to expand, they’ll be more interested in this opportunity, because of the press potential. Even if Pat isn’t single, she may still click for her parakeet to make a friend and even for the sake of PR a baker may pretend to be single.

Now, I could have just done a general baking show casting call or I could have made it just a custard baking show rather than all baked goods but I love the absurdity of dating shows and I have faith that although they specialize in custard, they know how to do non-custards but would also make the most of the opportunity to show off custard so good it makes someone fall in love—I mean, what a great accolade!

After the target clicks the email, I imagine that a variety of things could happen, including downloading a malicious file that would compromise the user device. But I think I’d like to really play the long game here or maybe turn this into a pig butchering scheme. So I’d take them to an actual calendar view but require them to logon to say, gmail, to view. I’d spoof an overlay of the logon page, let it redirect to the right one after they enter their info and hopefully get their email PWD. And once it’s scheduled, I’d send an email with a Skype link. I’m choosing Skype because it’s less common nowadays, doesn’t use 2FA and is linked to MSOffice accounts. Same deal, spoofed page, steal IDs, redirect. Now I have two logons and access to all of their documents and emails. Could at this point do a low-code ransom, just change their PWDs, copy their cloud, delete everything…Sucks to be a sucker 


########################## E-MAIL SECTION - Entry 3 - birdbird ##########################

Hi Pat,
It was so good to connect with you at Parrot Kindergarten’s event last month. There were so many people there, but my Luly really took a shine to Linda. I need to make it back to another class. Anyways, I remember you mentioning you were looking for innovative ways to drum up some business for your bakery and I actually just got tapped to cast for a new show. Stay with me, but it’s a variation on Love is Blind and Great British Bake-Off. We’re casting for a new show called Pastry Perfect Partner. Since we’re already acquainted, I wanted to reach out to you more personally about coming on this show, if you have some time for a call. But I’ve attached the standard intro spiel I give at the bottom.
Keep this between you and me, but Paul Hollywood the moderator! ;)

Do you want to put some time on my calendar to talk about this? Maybe we can set up a parakeet date too :) http://bit.lyz/12345abcd
Find the icing to your cake, the sprinkle to your donut, the chocolate chip to your cookie! Kinetic Love, the studio behind shows like Love is Blind, The Ultimatum, and Married at First Sight is now casting for a new show, Perfect Pastry Partner!

On this show, amazing bakers from around the world match whisks and lock lips. Will it be love at first bite, or will you need to sugar up your fellow fudge aficionados? In this competition, ten bakeries send their best to blind bake for their fellow contestants, and if it feels dulce de right-che to both of you then PPP will send you on a P-P-Perfect date!
Over a period of three weeks, you’ll be invited to make your signature pastries and pick a partner based off theirs. You’ll then be challenged to make their signature dish. Everyone will be challenged to make a few classics as well. Then, you’ll go on dates with the person who’s perfect pastries you appreciate most assuming they like yours too! But twists upon twists, batman! You have no idea what they look like, your only basis for choosing a partner will be their pastry. Each week you will be blind baking in a private studio kitchen. Maybe you’ll match with a different person each time, or maybe you’ll consistently love each other’s creations. PPP challenges you to show off your personality through the art of food. Are you ready?

Although there’s no prize money, as this isn’t a competition for anything (besides love!), Pastry Perfect Partner is looking to collaborate with participating bakeries at the end to release a promotional cookbook with both signatures and notable spins on classic pastries that will be featured in the show. There will be a royalty sharing agreement and opportunity for future partnership, sponsorship, and brand deals.

As a part of the show, we’ll also be taking cameras to each bakery to give the audience a feel for who they’re rooting for in addition to several on-set interviews. We also recognize that sometimes, inspiration doesn’t strike fast so if you choose to participate, we’ll give you six weeks to prepare and perfect what you’ll be showcasing.
Please, if you have any questions don’t hesitate to email me back.

Your Custard Comrade(s),
Chun (and Luly!)