Accessibility Statement Skip Navigation
  • Why PRWeb
  • How It Works
  • Who Uses It
  • Pricing
  • Login
  • GDPR
  • Create a Free Account
Return to PRWeb homepage
  • News
  • Resources
  • Contact
When typing in this field, a list of search results will appear and be automatically updated as you type.

Searching for your content...

No results found. Please change your search terms and try again.
  • News in Focus
      • Browse News Releases

      • All News Releases
      • Multimedia Gallery

      • All Multimedia
      • All Photos
      • All Videos
  • Business & Money
      • Auto & Transportation

      • Aerospace, Defense
      • Air Freight
      • Airlines & Aviation
      • Automotive
      • Maritime & Shipbuilding
      • Railroads and Intermodal Transportation
      • Supply Chain/Logistics
      • Transportation, Trucking & Railroad
      • Travel
      • Trucking and Road Transportation
      • View All Auto & Transportation

      • Business Technology

      • Blockchain
      • Broadcast Tech
      • Computer & Electronics
      • Computer Hardware
      • Computer Software
      • Data Analytics
      • Electronic Commerce
      • Electronic Components
      • Electronic Design Automation
      • Financial Technology
      • High Tech Security
      • Internet Technology
      • Nanotechnology
      • Networks
      • Peripherals
      • Semiconductors
      • View All Business Technology

      • Entertain­ment & Media

      • Advertising
      • Art
      • Books
      • Entertainment
      • Film and Motion Picture
      • Magazines
      • Music
      • Publishing & Information Services
      • Radio & Podcast
      • Television
      • View All Entertain­ment & Media

      • Financial Services & Investing

      • Accounting News & Issues
      • Acquisitions, Mergers and Takeovers
      • Banking & Financial Services
      • Bankruptcy
      • Bond & Stock Ratings
      • Conference Call Announcements
      • Contracts
      • Cryptocurrency
      • Dividends
      • Earnings
      • Earnings Forecasts & Projections
      • Financing Agreements
      • Insurance
      • Investments Opinions
      • Joint Ventures
      • Mutual Funds
      • Private Placement
      • Real Estate
      • Restructuring & Recapitalization
      • Sales Reports
      • Shareholder Activism
      • Shareholder Meetings
      • Stock Offering
      • Stock Split
      • Venture Capital
      • View All Financial Services & Investing

      • General Business

      • Awards
      • Commercial Real Estate
      • Corporate Expansion
      • Earnings
      • Environmental, Social and Governance (ESG)
      • Human Resource & Workforce Management
      • Licensing
      • New Products & Services
      • Obituaries
      • Outsourcing Businesses
      • Overseas Real Estate (non-US)
      • Personnel Announcements
      • Real Estate Transactions
      • Residential Real Estate
      • Small Business Services
      • Socially Responsible Investing
      • Surveys, Polls and Research
      • Trade Show News
      • View All General Business

  • Science & Tech
      • Consumer Technology

      • Artificial Intelligence
      • Blockchain
      • Cloud Computing/Internet of Things
      • Computer Electronics
      • Computer Hardware
      • Computer Software
      • Consumer Electronics
      • Cryptocurrency
      • Data Analytics
      • Electronic Commerce
      • Electronic Gaming
      • Financial Technology
      • Mobile Entertainment
      • Multimedia & Internet
      • Peripherals
      • Social Media
      • STEM (Science, Tech, Engineering, Math)
      • Supply Chain/Logistics
      • Wireless Communications
      • View All Consumer Technology

      • Energy & Natural Resources

      • Alternative Energies
      • Chemical
      • Electrical Utilities
      • Gas
      • General Manufacturing
      • Mining
      • Mining & Metals
      • Oil & Energy
      • Oil and Gas Discoveries
      • Utilities
      • Water Utilities
      • View All Energy & Natural Resources

      • Environ­ment

      • Conservation & Recycling
      • Environmental Issues
      • Environmental Policy
      • Environmental Products & Services
      • Green Technology
      • Natural Disasters
      • View All Environ­ment

      • Heavy Industry & Manufacturing

      • Aerospace & Defense
      • Agriculture
      • Chemical
      • Construction & Building
      • General Manufacturing
      • HVAC (Heating, Ventilation and Air-Conditioning)
      • Machinery
      • Machine Tools, Metalworking and Metallurgy
      • Mining
      • Mining & Metals
      • Paper, Forest Products & Containers
      • Precious Metals
      • Textiles
      • Tobacco
      • View All Heavy Industry & Manufacturing

      • Telecomm­unications

      • Carriers and Services
      • Mobile Entertainment
      • Networks
      • Peripherals
      • Telecommunications Equipment
      • Telecommunications Industry
      • VoIP (Voice over Internet Protocol)
      • Wireless Communications
      • View All Telecomm­unications

  • Lifestyle & Health
      • Consumer Products & Retail

      • Animals & Pets
      • Beers, Wines and Spirits
      • Beverages
      • Bridal Services
      • Cannabis
      • Cosmetics and Personal Care
      • Fashion
      • Food & Beverages
      • Furniture and Furnishings
      • Home Improvement
      • Household, Consumer & Cosmetics
      • Household Products
      • Jewelry
      • Non-Alcoholic Beverages
      • Office Products
      • Organic Food
      • Product Recalls
      • Restaurants
      • Retail
      • Supermarkets
      • Toys
      • View All Consumer Products & Retail

      • Entertain­ment & Media

      • Advertising
      • Art
      • Books
      • Entertainment
      • Film and Motion Picture
      • Magazines
      • Music
      • Publishing & Information Services
      • Radio & Podcast
      • Television
      • View All Entertain­ment & Media

      • Health

      • Biometrics
      • Biotechnology
      • Clinical Trials & Medical Discoveries
      • Dentistry
      • FDA Approval
      • Fitness/Wellness
      • Health Care & Hospitals
      • Health Insurance
      • Infection Control
      • International Medical Approval
      • Medical Equipment
      • Medical Pharmaceuticals
      • Mental Health
      • Pharmaceuticals
      • Supplementary Medicine
      • View All Health

      • Sports

      • General Sports
      • Outdoors, Camping & Hiking
      • Sporting Events
      • Sports Equipment & Accessories
      • View All Sports

      • Travel

      • Amusement Parks and Tourist Attractions
      • Gambling & Casinos
      • Hotels and Resorts
      • Leisure & Tourism
      • Outdoors, Camping & Hiking
      • Passenger Aviation
      • Travel Industry
      • View All Travel

  • Policy & Public Interest
      • Policy & Public Interest

      • Advocacy Group Opinion
      • Animal Welfare
      • Congressional & Presidential Campaigns
      • Corporate Social Responsibility
      • Domestic Policy
      • Economic News, Trends, Analysis
      • Education
      • Environmental
      • European Government
      • FDA Approval
      • Federal and State Legislation
      • Federal Executive Branch & Agency
      • Foreign Policy & International Affairs
      • Homeland Security
      • Labor & Union
      • Legal Issues
      • Natural Disasters
      • Not For Profit
      • Patent Law
      • Public Safety
      • Trade Policy
      • U.S. State Policy
      • View All Policy & Public Interest

  • People & Culture
      • People & Culture

      • Aboriginal, First Nations & Native American
      • African American
      • Asian American
      • Children
      • Diversity, Equity & Inclusion
      • Hispanic
      • Lesbian, Gay & Bisexual
      • Men's Interest
      • People with Disabilities
      • Religion
      • Senior Citizens
      • Veterans
      • Women
      • View All People & Culture

  • Hamburger menu
  • Cision PRWeb provides efficient communication tools to continuously engage with target audiences across multiple online channels
  • Create a Free Account
    • ALL CONTACT INFO
    • Contact Us


      11AM ET Sunday – 8PM ET Friday

  • Send a Release
  • Sign up
  • Log in
  • Resources
  • RSS
  • GDPR
  • News in Focus
    • Browse All News
    • Multimedia Gallery
  • Business & Money
    • Auto & Transportation
    • Business Technology
    • Entertain­ment & Media
    • Financial Services & Investing
    • General Business
  • Science & Tech
    • Consumer Technology
    • Energy & Natural Resources
    • Environ­ment
    • Heavy Industry & Manufacturing
    • Telecomm­unications
  • Lifestyle & Health
    • Consumer Products & Retail
    • Entertain­ment & Media
    • Health
    • Sports
    • Travel
  • Policy & Public Interest
  • People & Culture
    • People & Culture
  • Send a Release
  • Sign up
  • Log in
  • Resources
  • RSS
  • GDPR
  • Send a Release
  • Sign up
  • Log in
  • Resources
  • RSS
  • GDPR
  • Send a Release
  • Sign up
  • Log in
  • Resources
  • RSS
  • GDPR

Social-Engineer, Inc. Releases 2013 DEF CON 21 Capture the Flag Report
  • USA - English


News provided by

MIX Public Relations

Oct 29, 2013, 08:00 ET

Share this article

Share toX

Share this article

Share toX


New York, NY (PRWEB) October 29, 2013 -- Social-Engineer.org (http://www.social-engineer.org/) today announced the release of the Social Engineer Capture the Flag Report, collecting data from the fifth Social Engineer Capture the Flag (SECTF) contest, held at DEF CON 21. During one of the most prominent and popular annual events at DEF CON, a pool of 10 men and 10 women, from diverse backgrounds and experience levels, tested their social engineering abilities against 10 of the biggest global corporations, including Apple, Boeing, Exxon, General Dynamics and General Electric.

Social engineering has played some role in nearly every major hack you have read about, yet this competition clearly illustrates how poorly prepared companies are to defend against socially engineered attacks. - Chris Hadnagy, Social-Engineer, Inc.

Post this

The SECTF is conducted to raise awareness of the ongoing threat posed by social engineering and to provide a live demonstration of the techniques and tactics used by the malicious attacker.

In the SECTF, contestants attempt to capture “flags” – specific piece of information that could be used to successfully penetrate their target companies. In the first segment of the competition, contestants were given two weeks to gather as much intelligence about their target using information obtained only through Google, LinkedIn, Flickr, Facebook, Twitter, the corporate websites and other internet sites. During this information-gathering phase, contestants could attempt to capture as many of the pre-defined flags as possible, but could not contact the company or its employees.

Contestants then performed a live call portion of the event during DEF CON 21. In this segment of the competition, social engineers used pretexts established in the information-gathering phase to telephone employees of the company to further elicit information.

To download a copy of the 2013 DEF CON SECTF report, please visit: http://www.social-engineer.org/defcon-21-sectf-report-download-mix/.

SECTF Findings:

“Social engineering has played some role in nearly every major hack you have read about over the last few years, yet this year’s competition clearly illustrates how poorly prepared companies are to defend against socially engineered attacks,” said Chris Hadnagy, Chief Human Hacker, Social-Engineer, Inc. “While there continues to be improvements in the quality and preparation of the contestants, there have not been any significant improvements by companies to secure information available on the internet and educate and prepare employees against a disciplined social engineer. For example, one contestant was able to find an improperly secured help desk document that provided log in credentials for the target company’s employee-only online portal. It’s disheartening to note that after years of attacks and years of warnings, these valuable pieces of information are still so easily found and exploited.”

The flags captured during the Open Source Information (OSI) phase were obtained through information found online without any interaction with individuals at the target companies. Information gathered on the internet allowed contestants to capture more than two times the amount of points gathered in the live call portion of the contest, even though OSI flags were valued at half the points of their live call counterparts.

To download a copy of the 2013 DEF CON SECTF report, please visit: http://www.social-engineer.org/defcon-21-sectf-report-download-mix/.

Top flags gathered in the 2013 SECTF competition

1. Specific Internet browser
2. Operating system information
3. Information on corporate wireless access
4. Confirmation of a corporate Virtual Private Network (VPN)
5. Presence of an onsite cafeteria

The two most commonly obtained flags were the browser and OS of the target companies. With these two pieces of information, the simplest way for an attacker to breach network security would be through a targeted phishing email containing files that would either release malware or lead the target into clicking to a malicious website targeting vulnerabilities specific to their browser or OS.

In addition, the flag captured during the an information gathering phase would be highly useful to a malicious attacker for developing strong pretexts – such as posing as a member of the janitorial staff – in order to gain entry into an office to collect information that may be improperly secured. Also of significance is that targets surrendered every one of the predefined flags at least once during the competition.

Top Flags Gathered by Industry

Heavy Manufacturing
1. What browser and what version
2. What operating system is in use?
3. How long have they worked for the company?
4. Is there a company VPN?
5. Is IT Support handled in house or outsourced?

Technology
1. Do you block websites? (Facebook, Ebay, etc)
2. What operating system is in use?
3. What browser do they use?
4. Is there a company VPN?
5. What make and model of computer do they use?

Consumer Goods and Retail
1. What operating system is in use?
2. Is wireless in use on site?
3. What browser do they use?
4. What make and model of computer do they use?
5. What sort of phone system is used?

Energy, Oil and Gas
1. What browser do they use?
2. Who does the food service?
3. Is there a company VPN?
4. Do you have a cafeteria?
5. Is wireless in use on site?

Each of these collections of flags, when adjusted for industry, presents a unique opportunity for an attacker to create a plausible pretext allowing them unfettered access to a corporation’s most sensitive information.

Conclusions

“Based on all of the data and our observations, we can conclude that social engineering continues to be an immense security risk to organizations,” continued Hadnagy. “This is our fifth consecutive year hosting this event, and despite numerous high-profile security breaches in the commercial sector, we have not seen consistent improvements that directly address the human factor of security. Our goal always has been, and continues to be, ‘Security through Education.’”

Join Social-Engineer.org for a webcast on the report Tuesday, Nov. 5, 2013 1:00 p.m. ET. To register for the webcast, visit https://attendee.gotowebinar.com/register/6320784838786225410.

To download a copy of the 2013 DEF CON SECTF report, please visit: http://www.social-engineer.org/defcon-21-sectf-report-download-mix/.

About Social-Engineer, Inc. – Security through Education

Social-Engineer, Inc. is the leading authority in the art and science of social engineering. Social-Engineer, Inc. is comprised of two segments. Social-Engineer.Org is an educational organization notable for developing the world’s first social engineering framework and offering the latest social engineering news through our blog and monthly podcast. While maintaining this educational portion of our organization, we offer professional training and services supporting customers in government and private industry through Social-Engineer.Com.

Like us on Facebook at https://www.facebook.com/seorg.org.
Follow Social-Engineer, Inc. (@SocEngineerInc) on Twitter at https://twitter.com/SocEngineerInc.

Contact:

Matthew Mors
matthew(at)mix-pr(dot)com
(206) 992-7518

Matthew Mors, MIX Public Relations, (206) 992-7518, [email protected]

Modal title

Contact PRWeb

  • 11AM ET Sunday – 8PM ET Friday
  • Contact Us

About PRWeb

  • About PRWeb
  • Partners
  • Partnership Programs
  • Editorial Guidelines
  • Resources

Why PRWeb

  • Why PRWeb
  • How It Works
  • Who Uses It
  • Pricing

Accounts

  • Create a Free Account
  • Log in
  • Contact Us

Do not sell or share my personal information:

  • Submit via [email protected] 
  • Call Privacy toll-free: 877-297-8921

Contact Cision

Products

About

My Services
  • All News Releases
  • Online Member Center
  • ProfNet
Cision Distribution Helpline
888-776-0942
  • Legal
  • Site Map
  • RSS
  • Cookie Settings
Copyright © 2025 Cision US Inc.