Home page logo
/

pen-test logo Penetration Testing mailing list archives

RE: Penetration Testing - Human Factor
From: <KeenerPB () mcnosc usmc mil>
Date: Tue, 22 Aug 2006 08:54:59 -0400

I would disagree with Arian regarding the technical aspects of "true"
hacking...in my experience, social engineering plays a huge role in
successful compromise of a network. Most of the time the boundaries are
pretty tight so you have to lob one over the fence (social engineering) in
order to punch out from the inside to defeat the boundary devices. 

One way to audit "user awareness" is to develop three emails attacks...each
one increasing in difficulty of detection...then you log how successful each
one is...this will give you some idea of the effectiveness of current user
awareness training.

The reason I like to use this method is that this is a common vector for
attackers...there are others, but this will give you an idea of whether they
are concientious users...is someone operating in a superuser mode...how easy
is it to gain a successful entry into the network?

Remember...water follows the path of least resistance...so do attackers.

Capt. Paul B. Keener
OIC, Marine Corps Red Team
Marine Corps Network Operations Security Command
 
NIPR: keenerpb () mcnosc usmc mil
SIPR: keenerpb () mcnosc usmc smil mil
STE: 703.784.4327 (DSN 278)
Cell: 703.399.9639

-----Original Message-----
From: Arian J. Evans [mailto:arian.evans () anachronic com] 
Sent: Tuesday, August 22, 2006 12:46 AM
To: pen-test () securityfocus com
Subject: RE: Penetration Testing - Human Factor

I've seen nothing quantifiable.

FWIW - every forensic engagement I have done of "true"
hacking has had nothing to do with social engineering, and was entirely
technical. Most appeared to be performed by SKiddies, but at least one was
very subtle, and was performed by someone with real skill.

I do see a biased sample though, since people do not generally come to me
after they've been socially engineered, unless it's a girl I've dated.

Your first statement does raise the question though about how does a skeptic
conclude something before they gather evidence?

Arian J. Evans

-----Original Message-----
From: Marios A. Spinthiras [mailto:mario () netway com cy]
Sent: Monday, August 21, 2006 1:20 AM
To: pen-test () securityfocus com
Subject: Penetration Testing - Human Factor

As a thorough sceptic Id like to conclude in most cases of a TRUE 
hacking incident social engineering has been a factor of success for 
the malicious user attacking a system.
    For quite a while now I have been compiling methodology on the 
assessment of the weak human security link which can be exploited 
through social engineering. Has anyone got any thoughts they would 
like to share or guidelines to the audit of the human factor when 
security is concerned?

Any information is much apreciated.


Many Thanks,
Mario A. Spinthiras


--------------------------------------------------------------
----------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php
--------------------------------------------------------------
----------


------------------------------------------------------------------------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php
------------------------------------------------------------------------

Attachment: smime.p7s
Description:


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]