Winning a SANS 504 CTF without winning a SANS CTF
Using reconnaissance and social engineering to manipulate security professionals and win CTF challenges.
Summary
Social Engineering Challenge
A SANS instructor challenged to socially engineer CTF answers. Choosing personal challenge, the attacker used reconnaissance and social engineering.
Modern Exploitation
Modern technology designed for connectivity and convenience can be exploited by skilled attackers. Facebook and Google lost significant money to similar techniques.
Reconnaissance and Technology
Good reconnaissance combined with modern technology enables attackers to manipulate even vigilant security professionals. The technique works despite threats from the instructor's ex-Navy Seal background.
Walking Away
Successful exploitation allows winning challenge coins without technically winning the CTF, demonstrating the power of social engineering in security contexts.
Related talks
Village Presentations·44 min
Wayne Crowder
Wayne Crowder draws parallels between professional sport fishing and targeted phishing, illustrating how environmental recon yields high-yield social engineering.
Main Stage·20 min
Mystic
Mystic - Mimicry Mimicry Mimicry is the ability to survive by mimicking your surroundings.
Main Stage·1 hr 5 min
Bryan Glancey
Bryan Glancey - Weakest Link Presentation and demonstration of attack attempts against common security software.