How can an attacker convince an employee of a large company to voluntarily give him secret information or access to the computer network? He calls the company, tells a story and asks for help.
Yes, it works…
The attackers claim to work in IT support and urgently need information about the VPN being used to troubleshoot a network problem.
These scams are called vishing, and unlike classic phishing, there are almost no examples of attacks. There are no YouTube videos. Nothing!
Why
Because it's illegal in the US and Europe to record a phone call without the consent of both parties. Anything that isn't recorded can't end up on YouTube.
However, to understand and protect yourself from vishing attacks, it is essential to listen to such phone calls. This is the only way to understand how attackers use recorded background noises (keyboarding, switchboard noise, airport announcements, a child crying) to create an atmosphere in which a call seems credible and urgent. As a result, those who answer may blurt out things that should actually remain confidential.
Once a year, there's a solution to this problem: the Vishing Competition at the Social Engineering Village at the Def Con hacker conference in Las Vegas. In early August, America's elite social engineering consultants put on a "show" and their phone calls could be heard live.
The competition takes place in different phases. Participating teams register months in advance and are assigned a goal (this year it was Fortune 500 companies with many branches).
They should analyze their target using Open Source Intelligence ( OSINT ) and collect available information.
The teams' work in OSINT is evaluated by a three-member jury of the competition using a scoring system. These points are included in the final score and determine the order of the competition. Calls to private mobile phones are prohibited according to the Code of Ethics of the competition. The use of pressure or fear as a method is also prohibited and this is where the competition deviates significantly from reality.
Participants make calls in soundproof rooms. The discussion is broadcast live via loudspeakers to the approximately 300 guests in the room. Strict measures are taken to ensure that no conversation is recorded.
The competition is very popular with Def-Con attendees. Before entering, the line stretches the entire third floor of the Las Vegas Convention Center West Hall. If you need to use the restroom during the day, you have a problem: if you leave the hall, you lose your seat and have to line up again outside.
Although the press releases will range from very select to rare, I said I'd pass...because sometimes the editors hide.
