Raising awareness of social engineering

Over the last few weeks I have been following the build up to the Social Engineer CTF contest which was held last weekend at Defcon in the USA.   While we now know who the winners were, the end results are still a few weeks away but some interesting bits of information have now emerged.

The aim of the contest was to demonstrate the power of social engineering and raise awareness, without actually doing anything illegal or causing harm to the target companies.  In the run up to the Defcon weekend there was a lot of negative press relating to the competition because there were concerns about contestants’ acting improperly, targeting personal information and causing negative publicity for the targeted companies and individuals etc. This resulted in some security companies sending out warning emails to their customers, so you could say it achieved its aim of raising awareness before it even started. Prior to the competition weekend each competitor was given a target company, they then had to use passive techniques to research their target before planning and submitting a plan of attack 1 week before Defcon.  They then had approx 20 minutes to perform the attack at Defcon gathering as much information as possible. Read more of this post