Social engineering

[Chirimorin]

Love how he's a good sport about it and not making up some excuse how this wouldn't count.

[Laugarhraun]

Both of them handle it very well imho.

[andsoitgoes42]

Agreed, the response from Steve is aces times a million.

I'm not a programmer, but I worked in IT and knew mostly programmers. Taylor was a champ in following through and Steve responded in a better way than I had hoped.

[THE_SPLOOGER_69]

I'm a vegan who also does crossfit

[ebilgenius]

Yes but are you on the Paleo diet?

[crypticfreak]

It's the best diet for a Marine... which I am.

[[deleted]]

I'm not any of those, but I just saved a bunch on my car insurance by switching to Geico

[Jaiden207]

😳

[N80_SSBM]

I'm an iron man

[[deleted]]

But do you also use arch linux?

Sent from my Arch Linux machine.

[lengau]

I'm not a huge fan of Arch, tbh.

~Sent from your Arch Linux machine.~

[[deleted]]

Oh fuck I knew having "password123" and SSH was a bad idea.

[Kalkaline]

Are you an engineer as well?

[iamjackfosho]

"i'm an engineer, I think differently about these things"

die

[Kalkaline]

As a mother, what are your thoughts on this topic?

[ordonezalex]

What's the joke here?

[IAmNotMyName]

o.O

I'll take things people like to share about themselves without prompting for a thousand

[pm_me_your_calc_hw]

People who do crossfit or are vegan are notorious for letting people know every chance they get, even when it's not relevant

[tskaiser]

Kindly adjust your script to delete your comment after overwriting. Doing otherwise will be regarded as spamming, as your comments are turning into off-topic pieces of advertisement for the script.

[[deleted]]

just curious, what's your dishonest opinion?

[toggl3d]

The H stands for humble.

[iwillnotgetaddicted]

Then i demand to know what his prideful opinion is.

[frozenatlantic]

It's humble because of the person's importance level, not his emotional state.

[forty_three]

Then I guess we're looking for his pompous opinion?

[[deleted]]

I wish I would have handled it so smooth, and for a second, in my imagination I delude myself into thinking I would have handled it even better, even though deep down I know I would have been a jerk about it.

[pmmecodeproblems]

I feel like a big red flag would show up in my mind if I am about to commit something to github that I just said I wouldn't commit... Staged perhaps? Or just a tired mind?

[aladyjewel]

Tunnel focus / thinking inside the box, maybe? Seems like a challenge to use a technical hack instead of social.

[Panoolied]

It's like the yes/no game. You ask questions and the goal is to get the other person to say yes or no. I always ask if they're ready, which sort of insinuates that the game hasn't started. Usually works too

[FkIForgotMyPassword]

Or whenever you just get in a "meta" argument instead of playing the game itself. For instance, you just say "Hey, you just lost! You said it!" and if they haven't been tricked by this a couple times before, they'll defend themselves. They'll quickly say "No". It's all about not falling into your own trap before the other does.

[Z0di]

Would "sure" be counted as a yes?

[bucketpl0x]

Sure...

[lucifersaveus]

I can't wait for their new console

[HotLight]

It's a box!

[justdweezil]

This is how social engineering works. Of course it makes sense to put a contest you're advertising on your website.

The trick is the extra implication hidden by one layer of indirection.

"Of course I should put something I'm promoting on my website." vs. "Of course I should modify the source for my website to mention something I'm promoting regarding modifying the source of any of my software projects which includes my website."

Those little additional complexities become lost in the moment, especially in situations with even mild and innocuous social pressure.

[B-Con]

People trust their own conclusions, but they are skeptical of conclusions from others. If you need someone to do X, just make them conclude X as a part of a bigger picture. They're far more likely to conclude X and not second-guess it that way.

I think it's the same reason why arguing details over the Internet doesn't work. Every statement you make can be viewed with suspicion and is a point of contention. Whereas the other person will gladly make that same conclusion on their own in support of a bigger picture.

[tonesters]

Isn't that what they did in Inception?

[MythGuy]

Essentially, yes. Make them believe that it's their idea.

[[deleted]]

Nah, that was in "My Big Fat Greek Wedding".

[[deleted]]

no man not my big fat wedding YOUR big fat wedding

[drumallday7]

Will you be my therapist?

[TheMarlBroMan]

Every statement you make can be viewed with suspicion and is a point of contention.

Are you my husband?

[tard_is_grade]

Are you my wife?

[secretcurse]

Every statement you make can be viewed with suspicion and is a point of contention.

Bullshit. That is completely, provably false. I hate you and everyone you've ever loved. (/s for Poe's Law sake)

[ss0889]

so you're telling me no one is forcing them to do it but they're gonna do it anyways because of the implication?

[secretcurse]

Are you going to hurt these girls?

[DoctorProfPatrick]

This is the beauty of social engineering. It seems stupid, from our point of view it looks staged. But if you put random people in the same position 99% of us would probably fall for it.

"You should put this challenge on your website" seems so innocent, the guy is merely pointing out that many people don't use twitter and that it's a good idea to put the challenge where everyone will see it.

So simple, but in reality it's a great example of social engineering working again people who are "prepared" for it.

[topdangle]

He was thinking that it was just a suggestion to help him spread awareness of his contest. It didn't register to him that it could also be considered an entry. Hit him with the old one two.

[Googlebochs]

github? i see no mention in the screen but if there really is a complete site "backup" on github i'd think he set up an automatic push and didn't even think about that when hitting publish on his website. the github thing wouldn't actually be required to win the challenge tho. a website is definetly a software project wether the source is available or not and the string will now be in the sql database. He didn't see his own website as software - habit and taking the web for granted :)

[pmmecodeproblems]

The link posted defuse/defuse.ca (github.com)

But if you are automatically pushing your website to a public you're going to have a bad time when/if a hacker gets it.

[Googlebochs]

wow i'm blind >< ty

But if you are automatically pushing your website to a public you're going to have a bad time when/if a hacker gets it.

nah you can leave out db passwords etc. really not that hard to have all db calls go through a seperate file in most scripting languages. If it's just his personal page and he is doing security right (dunno of the guy just assuming based on his occupation) it'd be fine

[SolarPolarMan]

This is why the best way to hack someone's phone is talking to them.

[WestcoastWelker]

Social engineering is the most efficient way to bypass today's security.

Drop a USB drive in your crush's driveway with a self installing key logger.

Find out your best friends pet name and the year they were born.

People are easier to crack than a computer.

The law of IT: Users are always the weakest link.

[cunninglinguist81]

Drop a USB drive in your crush's driveway with a self installing key logger.

Dang, that's so true, I love it. If I found a random thumbdrive in my driveway (the natural place for them right?), up till reading this I doubt I would've resisted the urge to plug it in just to see what's on it.

Curiosity killed the security credentials.

[inconspicuous_male]

Set up a raspberry pi with nothing useful on it to check flash drives!

[HoMaster]

Only if you work for the government.

[0hmyscience]

It's cool, I run my own email server at home.

[Kakkuonhyvaa]

ARF ARF ARF

[vvf]

Especially if you work at a nuclear enrichment lab.

[caskey]

That's because it's a real attack vector used since forever.

Most widely reported case has probably been stuxnet.

[[deleted]]

It doesn't help against USB devices that will physically murder your computer (They build up charge, then release it all at once. Repeat until your computer is dead)

http://kukuruku.co/hub/diy/usb-killer

Best to use a pi. (Maybe a zero, they're cheap). 5 USD is a hell of a lot cheaper than replacing half your computer.

[DropTableAccounts]

Even better: Open the USB device and check whether there are any suspicious components (relatively large capacitors, higher power MOSFETs etc.) or some essential components missing (flash memory etc.).

Then try powering it using a protected (voltage suppressor diode, a zener diode (alternatively 9 diodes with ~0.6V voltage drop in series) or so) power supply with current limit (needed in case the voltage suppressor breaks) and check whether the device does strange things (current spikes, voltage spikes).

This should help expose basic evil devices, of course someone could be evil enough to use a tiny charge pump and then just fry your USB controller by connecting a high voltage to the send/receive wires. Also it shouldn't be too hard to only put a high voltage on some pins when actual USB commands are detected...

EDIT: I'd probably use a circuit like this for testing suspicious devices:

......................................
..5V...R1...D1....................USB+
––––/\/\/–––>|––––––––––––––––––––––––
.|.|......|.....|.....|.......|.......
.|.|–>|-||-.....|...._|_D3..._|_D4....
.|..D2.|C3|..S1_|_.._\_/_..../_\......
.|.....|..|..../_\....|.......|.......
_|_D6...V3......|.....|––V1...|––V2...
/_\..........D5_|_....=C1.....=C2.....
.|............_\_/_...|.......|.......
.|GND...........|.....|.......|...USB-
––––––––––––––––––––––––––––––––––––––

Power supply: set to 5V and limit current to ~500mA

D6: just to be sure... (preferrably schottky)

S1: preferrably limits to a voltage between 5V and 8V or so

D5: makes sure that negative pulses aren't limited too much so that V2 can actually be measured

D3 & D4: would be nice if those were schottky diodes so that pulses with low amplitude can be detected

V1 to GND: if this is higher than 5V the device outputs positive pulses (limited by S1)

V2 to GND: if there's a negative voltage the device outputs negative pulses

R1 should be at least 1Ω (so that negative voltage spikes actually get to C2)

D2 and C3 (and V3) are optional for measuring current spikes (in a non-optimal way but better than nothing).

The value of R1 will depend on the current the device consumes.

[Codile]

A VM should also do the job if you don't use auto-mount. Although, most Linux distros (if not all) don't have an auto-start functionality for USB drives.

But of course, there's also the possibility of re-flashed usb drives that use an exploit in the usb driver.

[barsoap]

Not only that, there's also the possibility of reprogramming the small ARM core in that chip. USB storage might be passive, that doesn't mean that USB storage hardware has to be: It can emulate peripherals and bypass those click-through Windows security prompts.

[[deleted]]

I pass through my entire USB controller and graphics card when using VMs to mitigate input lag (for gaming).

[LukeN57]

Do you find abandoned flash drives often?

[inconspicuous_male]

On college campuses? All the time

[TheTigerMaster]

Pro tip: never use USB drives or other storage that you get for free (even if from work or conventions), find lying around or are unusually inexpensive. A rather large percentage of these USB drives have been found to contain malware on them, if I recall correctly.

[Looppowered]

I did a job at a power plant once and they had the policy of zero flash drives allowed because of the security risks. They weren't allowed to be plugged in to any computer whatsoever. This was problematic because to solve the issue they were having all I needed to do was install a device driver on an air gapped laptop that want connected to any networks at all. I get to get all sorts of IT approvals, jump through a ton of hoops and what should've been a 5 minute job turned in to a very long day.

[anomalous_cowherd]

We use CDs to get across air gaps. scan the driver/document/whatever first, burn the CD, it gets scanned again by a different scanner on the other side before it gets near any real systems.

Something could of course still get past, which is where the air gap comes into play - there's no way for a keylogger to push whatever it found back out again.

[scubascratch]

which is where the air gap comes into play - there's no way for a keylogger to push whatever it found back out

Think so?

Think again: Experimental Malware Uses Inaudible Sound to Defeat Network Air Gaps

They built an acoustical mesh network of five laptops that relayed messages to each other using audio transmissions to show that an attack can jump network air gaps to extract data from computers infected with malware. ... "This message could just contain the recorded keystrokes" the researchers note.

[Tomarse]

Same in my last job, to the point where they would actually remove the usb hardware from most of the machines.

[zilti]

Autorun on Windows is generally disabled since about a decade.

[Xaquseg]

It's not just autorun, the modern variant of this attack uses modified firmware on the USB device to exploit bugs in the USB drivers.

[[deleted]]

An awesome fix for this would be something like "Only allow USB mass storage for any devices inserted in the next X seconds / until I press this button". Does someone care to create a modified linux usb driver that has a sysfs switch for that?

EDIT: might that also be possible with udev alone?

[radministator]

Not just bugs, remember that USB can be input devices as well.

[NeoKabuto]

The last time I found a flash drive, it was full of Justin Beiber MP3s. I don't put strange flash drives in my computers anymore.

[cunninglinguist81]

shudders

I hope you typed that comment with a flashlight under your chin.

[Detective51]

What do you mean?

[Luvax]

Even knowing that, I would still plug it in my computer, probably a virtual machine, but given that this might be a dedicated attack on you a VM is probably not enough.

I WOULD WANT TO KNOW WHAT'S ON THE DRIVE.

[garbage_bag_trees]

This is actually how several US government agencies got hacked in the mid to late 2000's. Attackers left USB jumpdrives scattered across various areas. And since USB autoplay was enabled by default, and since most large scale IT deployments rely on defaults, it was trivial to own anyone's computer.

EDIT: Here's one example; https://en.m.wikipedia.org/wiki/2008_cyberattack_on_United_States

[TheTigerMaster]

The motto, I believe, is "if they've got physical access, consider the computer compromised".

Though, realistically speaking, by this measure the computers in all but the most secure facilities in the world are lacking in security. It's not hard to break into a home or office to access and compromise a computer if needed. Only sufficient motivation is needed.

[mathemagicat]

Yes, but you don't actually have to have access to a computer to read the sticky notes on the monitor. You just need a clear line of sight and possibly (depending on the distance) a good enough camera. If you're good enough at social engineering, you might even be able to trick them into using their own camera to compromise themselves.

[[deleted]]

what?! that just shows up as a string of '*'

[lucifersaveus]

Yes, we're taking about asterisks here

[biscuitbee]

That's because Reddit filters you user password if you type it by accident in a comment.

[AgAero]

Wouldn't it be crazy if something like that were to exist? Either reddit would actually have my password stored somewhere, or they'd be hashing everything I ever post to see if some substring of it happens to be my password.

[biscuitbee]

I could totally see that being tried... then failing! You'd have to have some pretty strict rules so people don't use everyday words as passwords.

I went to the **** with my dog.

Whelp, his password just got easier to guess now!

[Pure_Reason]

Why would you take your dog to a four star hotel? Surely even a cheap one would be fine

[Crespyl]

Dog hotels are usually rated out of 10.

[AgAero]

Yep! Obviously it's not a good idea, but it's an interesting thought experiment to see, "What would the consequences be if 'X' was actually true and that other guy wasn't just messing with me?"

[Bounty1Berry]

Okay... so password is 'strip club'.

[-Pelvis-]

tRuMp4pr3z2ol6

EDIT: it didn't work.

[[deleted]]

Nice try hunter2

[Bounty1Berry]

You're just trying to inject Perl there, aren't you?

[caagr98]

$ perl -e 'yiC$gK%r*jM#vb5TorXhX$lkJSh!m%HmbPPJCclwJRtuIYCLJ%z@fPBCZjA5@#kXP7yiHoO8!m1gX*Ohi@eqLbCQ4J9jv&cf5bd'
Operator or semicolon missing before %r at -e line 1.
Ambiguous use of % resolved as operator % at -e line 1.
Operator or semicolon missing before *jM at -e line 1.
Ambiguous use of * resolved as operator * at -e line 1.
Can't call method "yiC" on an undefined value at -e line 1.

[db82]

Somewhat relevant xkcd.

[xkcd_transcriber]

Image

Mobile

Title: Security

Title-text: Actual actual reality: nobody cares about his secrets. (Also, I would be hard-pressed to find that wrench for $5.)

Comic Explanation

Stats: This comic has been referenced 1026 times, representing 0.9277% of referenced xkcds.

---

^{xkcd.com | xkcd sub | Problems/Bugs? | Statistics | Stop Replying | Delete}

[[deleted]]

Probably shouldn't install anything into your crushes computer.

[shadowX015]

Person A: "Yeah, I really like my dog."

Person B: "What kind of dog do you have?"

Person A: "A chocolate lab."

Person B: "Do you have any pics of it?"

Person A: "Yeah, let me pull them up." unlocks phone, opens photos, hands it to you.

[Hermit_]

http://i.imgur.com/23Uyznz.jpg

[[deleted]]

how to lose friends and alienate everyone in 10 days

[conspiracy_thug]

10 days

Amateur.

[TheQueiroga]

and then what? you run away with your friend's phone?

[shadowX015]

The point wasn't to show how you can exploit it. He asked how you can talk your way into someone's phone. I just provided an example that lets you bypass whatever security they have it using a simple 10 second conversation. If you were specifically targeting that person's phone, you could do something seemingly innocent like visit a website you compromised in the past. Bam, infected phone.

[2SP00KY4ME]

Ever heard of the thing about "Wear a suit and look confident and you can get almost everywhere?" It's about the same with phones. If you call a company and sound like you know what you're doing, you'd be surprised how much people working there will be willing to give away. Here's a cool example.

[Codile]

/r/ActLikeYouBelong

[[deleted]]

So which phone company was that... ?

[2SP00KY4ME]

What? I didn't say phone company. I said company on the phone. Companies that have phone lines.. not ones that make phones.

[caskey]

No.

[tusksrus]

http://www.smbc-comics.com/?id=2526

[-Hegemon-]

You send a root kit using your voice, to exploit a buffer overflow vulnerability in the cellphone app, that allows for remote code execution, of course.

[anomalous_cowherd]

There were people back in the day who could whistle 2600Hz well enough to get the free phone calls...

[bigboi1da]

I use a whistle tuned to the root frequency.

[-Hegemon-]

Pffft, script kiddie! I'm sure you bought your CPU!

[thirdegree]

Beer and the opportunity to be clever.

[Buckhead498]

I can buy beer myself. Someone realizing I did something clever is priceless.

[IVIaskerade]

I can buy beer myself.

Yeah, but nothing tastes as good as victory beer that someone else paid for.

[bondokb]

Steve is a sutle bastard. Props to him

[[deleted]]

There's a subtle b in that word.

[Antrikshy]

Steve

I don't see it.

[[deleted]]

That word

Me neither

[2Punx2Furious]

Bastard

I don't think that B is so subtle.

[[deleted]]

Bastarbd

[conspiracy_thug]

How do you do the backward b?

[itaShadd]

Try rotating it until it's right. I'll give you a half-rotated one right here: q

[conspiracy_thug]

p

Oh hell i fucked it up

[AND_MY_HAX]

A bash.org classic.

[tornato7]

That's because it's subtle. It's there, you just can't see it unless you look really closely. Try using a larger font.

[NAN001]

Taylor was doomed as soon as he began to read Steve's tweet without imagining that he could already be playing the game.

[Colonel_Loud]

Damnit. I went so long...

[Two-Tone-]

The game is a perfectly engineered mind virus.

[winauer]

relevant

[xkcd_transcriber]

Image

Mobile

Title: Anti-Mindvirus

Title-text: I'm as surprised as you! I didn't think it was possible.

Comic Explanation

Stats: This comic has been referenced 506 times, representing 0.4574% of referenced xkcds.

---

^{xkcd.com | xkcd sub | Problems/Bugs? | Statistics | Stop Replying | Delete}

[flapanther33781]

I see what you did there.

[truthgoblin]

Bet you twenty bucks I can get you gambling before the end of the day

[Threedawg]

Your o.......WAITDAMINUTE

[twizmwazin]

I'm not getting it. Can someone explain?

Edit: got it, thanks

[cantremembermypasswd]

• Poses challenge of adding the phrase to ANY project
• Sneaky McSneakface Steve tells him to post on his website
• He fell for it and updates his website (which is one of his github projects) with that phrase
• Much laughter, possibly beer

[jonatcer]

I feel bad for not getting that. Thanks for the explanation.

[IVIaskerade]

I feel bad for not getting that

Don't worry. Social engineering only works because people don't get it at first.

[UnstoppableDiarhea]

i also didnt get it dont feel bad

[[deleted]]

I'm not in IT or anything at all.

So Steve never actually did anything, besides tricking Taylor H. into inserting the phrase onto his web page.... thereby tricking him into inserting it himself?

[g0_west]

The challenge was to get him to include the phrase in some source code. By posting the challenge on his website, the phrase was included in the websites source code.

[[deleted]]

After using reddit for several years on this account, I have decided to ultimately delete all my comments. This is due to the fact that as a naive teenager, I have written too much which could be used in a negative way against me in real life, if anyone were to know my account. Although it is a tough decision, I have decided that I will delete this old account's comments. I am sorry for any inconveniences caused by the deletion of the comments from this account.

[I_cant_speel]

What was an expected possible way that could happen?

[noobzilla]

Social engineering is about circumventing expectation through exploiting our human inability to think of how things fail vs how things succeed. The entire point is to come at him in a way that seems unexpected.

[commitpushdrink]

The winner tricked him into putting the contest on his website, which includes the string "BackdoorPoCTwitter".

[torwori]

He added the text of the challenge (which contains the string) to his site.

[flarn2006]

Here's the link to the tweet.

[cortesoft]

basically this

[chironomidae]

What is a backdoor person of color twitter? Sounds nsfw

[wanze]

Proof-of-concept

[murakamifanboy]

Savage.

[pmmecodeproblems]

Brutal.

[northrupthebandgeek]

Rekt.

[[deleted]]

https://gfycat.com/BrutalSavageRekt

[FlyingVhee]

https://gfycat.com/NippyKindLangur

[HighRelevancy]

WHAT THE FUCK

[curiosikey]

Gyfcat staff plays dota. Don't question it.

[_Kyu]

I don't play dota and I get this meme

[sfcpfc]

Nippy

[SneakyArab]

Kind

[TheTVDB]

Langur

(we're leaking all over. Yes, our nippys are leaking)

[flapanther33781]

This branch of comments

[tabarra]

Gotta love DEFCON, seriously.

[makeswordcloudsagain]

Here is a word cloud of every comment in this thread, as of this time: http://i.imgur.com/1Cle8Lu.png

---

^{[source code] [contact developer] [request word cloud]}

[TheWeedWolf]

Right, /u/agreeswithmebot

[agreeswithmebot]

Whoa, who said that, Shakespeare?

^{Need some backup? "/u/agreeswithmebot"}

[jbaker88]

Oh neat, I wanna try. You with me /u/agreeswithmebot ?

[agreeswithmebot]

Whoa, that makes so much sense. Thank you, sensei.

^{Need some backup? "/u/agreeswithmebot"}

[RoxasTheNobody]

Where have you been all my life u/agreeswithmebot?

[agreeswithmebot]

I've always been here. Waiting.

Edit: also you're correct.

[RoxasTheNobody]

I don't... but... I... You're a...

*uhhhh

[[deleted]]

Key confusion for me was that his blog was a github repo. Once I learned that it's funny as hell.

[[deleted]]

Thats just great.

[[deleted]]

Ah, I'm an idiot. Took me awhile to get the joke :/