00:00 – A Compelling Price
11:47 – Social Engineering is the New Hotness
16:08 – Socially Engineered Data Breaches
18:22 – Social Engineering Cycle
22:35 – How to Engineer Your Dragon
27:57 – Symphony of Attack
29:21 – Gentlemen, Search Your Engines!
33:01 – Email Addresses
33:55 – Social Media
36:00 – Such a (useful) Tool
38:17 – Best Of Nextdoor and Other Communities
38:43 – Video Stars
38:53 – IP Addresses
40:56 – How to Change This
41:18 – OSINT Self-Assessment
42:01 – Never Trust & Always Verify — Teddy Rosevelt
----
People give little thought to the "scraps" of information that they leave scattered around the web. Even worse, when an attacker approaches them and uses these bits of information against them, they fall for it too often. In this talk, we teach how to use the internet and freely available information to craft perfect social engineering attacks. We have used these very tactics to compromise employees as high-level as corporate VPs with 2FA in place! After showing how to create these social engineering scenarios and dupe victims, we show how security professionals can train their clients to beware of the data they leave so that they are aware of attackers intents. After all, changing the tide is what it's all about. Attendees will take away: a better understanding of where and how to find intel for social engineering, tactics for creating scenarios that seem super legitimate, and tips for training their clients post-engagement how to not repeat the same mistakes.
William Price is a penetration tester and the founder of CyberX Cybersecurity Solutions. After performing countless penetration tests and seeing the immense budgets that organizations have for cybersecurity, he realized that SMBs are often overlooked. He decided to found CyberX to address the security needs of SMBs. While continuing consulting (pen testing) services, William also leads the CyberX team in helping SMBs manage their cybersecurity programs within their budgets. He has a B.S in Cybersecurity and Information Assurance.