{"id":39922,"date":"2017-07-28T13:23:40","date_gmt":"2017-07-28T20:23:40","guid":{"rendered":"http:\/\/world.edu\/?p=39922"},"modified":"2017-07-28T13:23:40","modified_gmt":"2017-07-28T20:23:40","slug":"everyone-falls-fake-emails-lessons-cybersecurity-summer-school","status":"publish","type":"post","link":"https:\/\/world.edu\/everyone-falls-fake-emails-lessons-cybersecurity-summer-school\/","title":{"rendered":"Everyone falls for fake emails: lessons from cybersecurity summer school"},"content":{"rendered":"

\"\"<\/p>\n

What do nuclear submarines, top secret military bases and private businesses have in common?<\/p>\n

They are all vulnerable to a simple slice of cheddar.<\/p>\n

This was the clear result of a \u201cpen testing\u201d exercise, otherwise known as penetration testing, at the annual Cyber Security Summer School<\/a> in Tallinn, Estonia in July.<\/p>\n

I attended, along with a contingent from Australia, to present research at the third annual Interdisciplinary Cyber Research workshop<\/a>. We also got the chance to visit companies such as Skype<\/a> and Funderbeam<\/a>, as well as the NATO Collaborative Cyber Defence Centre of Excellence<\/a>.<\/p>\n

The theme of this year\u2019s school was social engineering \u2013 the art of manipulating people to divulge critical information online without realising it. We focused on why social engineering works, how to prevent such attacks and how to gather digital evidence after an incident.<\/p>\n

The highlight of our visit was participation in a live fire capture the flag (CTF) cyber range exercise, where teams carried out social engineering attacks to pen test a real company.<\/p>\n

Pen testing and real world phishing<\/strong><\/p>\n

Pen testing is an authorised simulated attack on the security of a physical or digital system. It aims to find vulnerabilities that criminals may exploit.<\/p>\n

Such testing ranges from the digital, where the goal is accessing files and private data, to the physical, where researchers actually attempt to enter buildings or spaces within a company.<\/p>\n

During the summer school, we heard from professional hackers and pen testers from around the world. Stories were told about how physical entry to secure areas can be obtained using nothing more than a piece of cheese shaped like an ID card and confidence.<\/p>\n

We then put these lessons to practical use through several flags – goals that teams needed to achieve. Our challenge was to assess a contracted company to see how susceptible it was to social engineering attacks.<\/p>\n

Physical testing was specifically off limits during our exercises. Ethical boundaries were also set with the company to ensure we were acting as cyber security specialists and not criminals.<\/p>\n

OSINT: Open Source Intelligence<\/strong><\/p>\n

The first flag was to research the company.<\/p>\n

Rather than researching as you would for a job interview, we went looking for potential vulnerabilities within publicly available information. This is known as open source intelligence (OSINT). Such as:<\/p>\n