7 ms·
How I attacked a fellow student
- cdwhite 13y agoGoogle cache: http://webcache.googleusercontent.com/search?hl=en&q=cache%3Ahttp%3A%2F%2Fshaanan.cohney.info%2Fblog%2F2013%2F04%2Fthe-attack%2F http://webcache.googleusercontent.com/search?hl=en&q=cac... (Page is taking some time to load.)
- iancarroll 13y agoDuplicate.
- shaananc 13y agocould you link me to where the original is?
- jabbernotty 13y ago> With this level of trust it would be feasible to gain access to information protecting online accounts, a very scary thought. Does he mean 'feasible to gain access to login information for online accounts'? I have read the page, and i'm not seeing it. Yes, according to the page they had access to some degree of personal information beyond the more publicly accessible. But that isn't the same as having access to their online accounts, or being near to getting it.
- olegbl 13y agoMy impression was that he meant that at that point it was potentially viable to scam some financial information out of the target.
- shaananc 13y agoI meant that with that level of trust it wouldn't be too hard to adapt the attack to shift to gaining that sort of information. ie; We are adding you to our employee database but we need your SSN last 4.
- TazeTSchnitzel 13y ago"indormation protecting online accounts" makes me think of password reset questions.
- ivybridge 13y agoYou would have been better off forcing them to register on your site to submit the resume, then check if they reused a password. Also you exploited trust in a way that could easily lead back to you.
- shaananc 13y agoThat's very true, but it was just a class project, and wouldn't have been the end of the world.
- jsumrall 13y agoI was hoping that by getting them to sign up with the recruiter you would have used that to intercept communication.
- tempestn 13y agoIs Xrecruting.com a typo in the blog post, or in the domain actually registered?
- shaananc 13y agoit's a redacted version of the full link.
- thestranger 13y agoBut did you purposely misspell "recruiting" or was that just a typo.
- shaananc 13y agotypo in the redacted version.
- guylhem 13y agoThe title is a bit misleading. It's not an attack, more like well done social engineering. But the context is very helpful - especially with the amount of detail you provide, along with the email exchange, one can see the target was totally abused. The lanyard, laptop, false recruiting - you really overdid it, but I mean that in a positive way. I like it, it's so great - you could almost make a movie out of it ;-) That's creative thinking. Congrats on your victory.
- shaananc 13y agothanks!
- girvo 13y agoY'know what, I disagree. It's not misleading. Social Engineering _is_ an attack, as far as I am concerned, and honestly when he mentions that it's Social Engineering in the third sentence of the article itself, I don't find it misleading at all. To the guy who did it: Bloody well done. I agree with guyhelm, it's overkill, and we all know that's the best kind of kill ;) Social engineering is actually quite scary, especially when put together with targeted attacks against the individual. It's a one-two punch that is very hard to defend against. I wish the Uni's here in Brisbane would do stuff like that! Well done again, and I'm quite jealous!
- lotsofcows 13y agoRule 37. There is no "overkill".
- deleted 13y ago[deleted]
- deleted 13y ago[deleted]
- breadbox 13y agoIt's actually "bear with me". I'm not sure what "bare with me" would mean.
- deleted 13y ago[deleted]
- louthy 13y agoVery enjoyable read. Congratulations on your success, I can only imagine how stunned they were!
- noonespecial 13y agoThe best attacks are always the ones where the victim is truly surprised at how far you were willing to go to pull it off. So are the best magic tricks.
- new299 13y agoThere's a great quote by Teller on that: "You will be fooled by a trick if it involves more time, money and practice than you (or any other sane onlooker) would be willing to invest. My partner, Penn, and I once produced 500 live cockroaches from a top hat on the desk of talk-show host David Letterman. To prepare this took weeks. We hired an entomologist who provided slow-moving, camera-friendly cockroaches (the kind from under your stove don’t hang around for close-ups) and taught us to pick the bugs up without screaming like preadolescent girls. Then we built a secret compartment out of foam-core (one of the few materials cockroaches can’t cling to) and worked out a devious routine for sneaking the compartment into the hat. More trouble than the trick was worth? To you, probably. But not to magicians." From: http://www.smithsonianmag.com/arts-culture/Teller-Reveals-His-Secrets.html http://www.smithsonianmag.com/arts-culture/Teller-Reveals-Hi...
- shmageggy 13y agoI thought "Please find attached herewith my resume for your kind perusal" was a joke but apparently that's how this person really responded. Recruiters: how does this forced, over-formal tone affect your impression of a candidate?
- shaananc 13y agoThe other student was an international student, his English overall was quite formal. Really lovely guy though :)
- ballstothewalls 13y agoI suspect the other student was more susceptible to this sort of thing since he was a non native speaker. I'd be curious to see if it would've worked on an American.
- sohamsankaran 13y agoSpeaking as an Indian who's had the opportunity to try this sort of thing on various Americans (and a lone Australian), it would've worked. The success of the attack probably has more to do with the susceptibility of each individual victim than their specific native language, though (and this is a sweeping generalization) many Indians do tend to have greater deference to authority (real or imagined) than their American counterparts.
- zaph0d 13y agoI am guessing that the student in question was from India. That's how many Indians write official/business letters; likely a relic of the colonial times.
- enjo 13y agoNot at all. When we have an opening I get dozens of those a day. I honestly skim them to see if there is any relevant information (there usually isn't)... and then go straight to the resume. So the language just doesn't register with me, at least not consciously. Well done versions include a couple of nuggets of information telling me why I should open that resume, but that's surprisingly rare.
- bluehex 13y agoI felt pretty bad for the target. Even though he was fairly warned, and knew to expect social engineering attacks, you could see he was quite excited about the potential opportunity at X co; else he wouldn't have put so much energy into that looong email exchange. Poor, guy. But good lesson, I suppose.
- cbhl 13y agoFound this a rather amusing read. Best of luck on your exam!
- sohamsankaran 13y agoInteresting. If the author is still around, I have a question - would the whois data have given you away, or was this faked/spoofed in some way?
- jmonegro 13y agoYou can quite cheaply (for around $3 depending on the registrar) opt into Whois privacy protection.
- TazeTSchnitzel 13y agoFor a prestigious company to use a Whois hiding shell company service would be suspicious, though.
- drharris 13y agoBut if they are a security-oriented company, maybe not so much. Hiding potential attack vectors (contact info of technical contact) can prevent or delay spear phishing attempts. Now, if Xrecruiting.com and X.com don't match, then that would be a red flag.
- sohamsankaran 13y agoMy point (in agreement with TazeTSchnitzel) was essentially this - if X was a large enough company, I would expect them not to hide their registration details, especially, I would argue, in the case of a security company, so that potential clients and employees can be certain of the veracity the communications they receive. If I were to receive a communication from an email adress not associated with the main domain of the company, I would be instantly suspicious if the whois data was obscured or concealed.
- drharris 13y agoIndeed, as would I. But what makes a successful social engineering attack (or scam, in general) is giving people what they want before they have an opportunity to ask questions. While this exact attack wouldn't work on me now, it might have when I was looking to graduate from university. My desire for an industry job (and a prestigious one at that) might have clouded my typical judgment. So, hiding whois information can be immediately justified by "well, they are a security company", with any doubts expelled. Grifters and illusionists work in much the same way; the plot is full of holes, but over and over people see what they want to see.
- justx1 13y agoWell played... Missing to redact X.com's phone number allows "social engineering" of the company name, though.
- lostlogin 13y agoIt's an interesting time now. It used to frustrate me how I couldn't find an address with just the phone number - despite having a white pages that contained the info. I know this was buy design, for privacy. Now if you search for a number, your bound to get a hit for it, and can work out who it belongs to. I'm sure this will fail me one day, but it hasn't yet.
- kaybe 13y agoGermany's online telephone book does reverse look-up. (People can opt out, but you know how it is..) Is that really so uncommon? Checking some more countries.. the UK doesn't seem to have it, France does. Oh, there's a page for the US: http://www.whitepages.com/reverse_phone http://www.whitepages.com/reverse_phone Today reverse look-up is by design, it seems. The limitation before was probably printing paper and not just a design decision, I'd guess. I'm not sure whether I like the new situation, but then none of my friends actually has a landline.
- pit 13y agoWait a minute. Isn't this guy an asshole?