FBI Warning: Rising Social Engineering Threats Targeting Personal and Corporate Accounts

This is a timely article I put together for internal distribution as part of a Security Awareness program. Feel free to grab and use as part of your Security Awareness program.

Link: https://www.ic3.gov/Media/Y2024/PSA240411  

The Federal Bureau of Investigation (FBI) has issued an alert regarding an increase in social engineering attacks that cybercriminals are using to compromise personal and corporate accounts. The techniques identified include impersonating employees, SIM swap attacks, call forwarding, simultaneous ringing, and phishing—each designed to manipulate victims into divulging sensitive information. 

Social Engineering Techniques: 

• Employee Impersonation: Cybercriminals pose as company employees to trick IT or helpdesk staff into granting them network access. 

• SIM Swapping: Attackers deceive mobile carriers to transfer a victim’s phone number to a device they control, potentially bypassing multi-factor authentication to access financial and other secure accounts. 

• Call Forwarding and Simultaneous Ring: This method involves forwarding a victim’s calls to the attacker’s number, again potentially circumventing multi-factor authentication. 

• Phishing: Phishing emails mimic legitimate institutions to solicit sensitive information, such as login credentials and personal identification numbers. 

Protection Recommendations: 

• Personal Security Measures: 

• Avoid responding to unsolicited requests for personal information. 

• Set unique passwords for voicemail and mobile accounts. 

• Contact your mobile carrier to block unauthorized SIM changes and call forwarding. 

• Regularly check your account activity for any unauthorized changes. 

• Use complex passwords and avoid posting personal data online. 

• Corporate Security Measures: 

• Pay attention to email banners for messages coming from external sources. 

• Use non-email based multi-factor authentication. 

• Report any phishing and social engineering attempts. 

Reporting and Additional Actions:

If you believe you are a victim of a social engineering attack: 

• Contact your service providers to secure your accounts. 

• Report the incident to the FBI’s Internet Crime Complaint Center at www.ic3.gov for further investigation. 

• Reach out to [INSERT SECURITY INBOX] if you suspect any of these social engineering techniques are being used at work. 

This alert underscores the need for heightened vigilance and proactive measures to safeguard against sophisticated social engineering tactics that are increasingly prevalent in today’s digital landscape. We thank you for helping keep [COMPANY] secure.  

Security Awareness Newsletter March 2024

This is a security newsletter I’ve put together as part of our security awareness program. This leans more towards healthcare and news items that are more general in nature. I’ll have a more technical focused newsletter later this week that’s targeted at security teams. Feel free to take this newsletter and use it internally as part of your security awareness program.

The Great Zoom-Skype-Google Masquerade: Beware of digital doppelgängers. Fake Zoom, Skype, and Google Meet sites are the latest traps set by cyber tricksters.  These spoofed meetings can trick users into downloading harmful software that compromises their computer. Ensure you’re clicking on the real deal to keep those malware masqueraders at bay. Beware of QR codes that will try to steal credentials as part of this type of attack. 

Beware of fake websites mimicking popular brands!: Typosquatting attacks are surging, and cybercriminals are exploiting user mistakes to steal login credentials and spread malware. Typosquatting is where an attacker registers a similar domain to one a person is familiar with. This increases the chance a malicious link will be clicked. 

Small Businesses Hit Hard by Cybercrime: Some social engineering techniques highlighted in the article include: malicious ads; attackers starting a conversation before trying to get the person to take an action; and the move to PDF attachments. These types of attacks help launch ransomware against small businesses. 

Beware of AI-Driven Voice Cloning in Vishing Scams: The Better Business Bureau (BBB) has issued a warning about the rise of voice phishing (vishing) scams utilizing AI-driven voice cloning technology. Scammers can now mimic voices convincingly with just a small audio sample, leading to fraudulent requests for money transfers or sensitive information. Tips to Stay Safe: 

• Pause Before Acting: Resist the urge to act immediately on unexpected requests, even if they seem to come from a familiar voice. 

• Verify Directly: Contact the supposed caller using a known, saved number—not the one provided in the suspicious call. 

• Question the Caller: Ask specific questions that an impostor would struggle to answer correctly. 

• Secure Your Accounts: Implement multi-factor authentication and verify any changes in information or payment requests. 

Update on Change Healthcare Cyberattack Recovery: Change Healthcare is on track to bring its systems back online by mid-March following a cyberattack that has caused widespread disruption since February 21. The cyberattack has significantly affected healthcare operations nationwide, with providers facing difficulties in payment processing, insurance verification, and clinical data exchange. This highlights why security awareness is so important. Identifying and reporting security threats to the organization is the responsibility of everyone. 

Beware of Tax Season Scams Targeting SMBs and Self-Employed Individuals: As tax season unfolds, a new scam has surfaced targeting small business owners and self-employed individuals. Scammers are using emails to lure victims to a fraudulent site, claiming to offer IRS EIN/Federal tax ID number applications. However, this service is free through the IRS, and the scam site is designed to steal personal information, including social security numbers, creating a significant risk for identity theft and fraud. A Microsoft report identifies green card holders, small business owners, new taxpayers under 25, and older taxpayers over 60 as prime targets for these scams. Check Point has some example phishes in their tax scam article. 

Apple Users Beware: "MFA Bombing" Phishing Attacks on the Rise: Leveraging Apple's password reset system attackers can bombard users with password reset prompts. If a person clicks "allow" on one of the prompts, the attackers can gain access to the user's account. The attackers may also call the person pretending to be Apple support. Some ways to protect yourself from this attack include not clicking on any of the prompts and contacting Apple directly if you receive a suspicious call. 

Tips to help build strong relationships inside and outside of work

I love the saying from Manager Tools.

“There are three types of power? Technical power, role power, and relationship power. Relationship power is 75% of the power in an organization”

I quote it a lot to people when I’m having discussions about organizations.

Building relationships with people internally is what has allowed me to be successful in my career. We cannot do it all on our own. The techniques for building relationships apply both internally to a company as well as outside of the company at networking events. Her are some of the things I have done to build strong relationships inside and outside an organization.

How to build relationships

Ask questions

The number one thing I use to build relationships is ask questions. Then I follow that up by actively listening to the answer and asking more questions.

People’s favorite subject is themselves. Getting them to talk about themselves makes them feel good. If you are asking the questions you are the reason for that feeling. People will pick up if you’re being inauthentic, so it really helps if the questions are coming from a genuine curiosity. Look at them and hear what they’re saying and ask follow up questions to what they have just said.

When I first started doing this it was pretty hard. I liked to interject my own commentary. As I worked on it it eventually became easier. It is okay to interject here and there but talking less and listening more overall will help endear you to people quicker.

This was the tool I found most effective working with developers. Code is a developer’s baby. They create it. They nurture it. They get frustrated when it doesn’t pass tests. They may have dropped it once or twice. It’s their baby though and coming in and calling it ugly (even if it is ugly) isn’t going to make many friends.

This is where questions help. Developers lit up when you show an interest in their code (baby) and they will tell you everything about it. This helped me understand the code better. Why it was written the way it was written and allowed me to have tough conversations with them when it was causing problems. I had built that trust and they knew I was only trying to help them make the best code possible.

Spend time together

When you spend time together there’s a bonding that occurs. This builds trust and allows for people to get to know each other better. I’ll go to lunch with people if asked or I’ll ask others if they are interested in going to lunch. It’s a great way to just have a normal conversation outside of work. Asking questions gives insight into the person.

If money is tight, this can be done at work. If there’s an open spot a table ask to join (asking questions again ;). If it isn’t often people will tell you to pull up a chair and join them anyway. Worst case look for someone else to sit with. People that are sitting by themselves usually won’t mind company.

stay in touch

Make sure to stay in contact with people. This became harder with the pandemic and everyone working from home. Often I would reach out to them if we hadn’t chatted in a while and I was in a meeting with them. I’d shoot them a quick IM saying hi and asking how they were doing.

The Allen Curve is a study from the 1970s that described as distance increased between engineers communication became less frequent. If you are wondering why CEOs want people in the office it’s because of The Allen Curve (a future blog post).

Image courtesy Clutch.co

I’m surprised at how many people are not familiar with this idea. Regardless, as distance increase communication decreases. It makes sense. When you were in school you stayed in contact with your classmates more often. As people moved the communication between people became less frequent. You may have experienced this during the pandemic with coworkers. The person you got coffee with every morning and chatted about work or real world events you no longer communicate with on a regular basis. I’ve seen this apply with people just switching floors or moving to a different part of the building. The distance doesn’t need to be far for communication to drastically decrease.

If you are back in the office walking around can be a good way to stay in touch, as well as get a little exercise and a break from the computer. Working remotely is tougher. That’s why I set up reminders to connect with people every so often. This can be a week, month, months, or several months.

Reciprocity

Give without expecting something in return. First, this is a great feeling to just give without expecting something in return. Letting go of the return also helps with any frustration or anger that might occur from not getting something back. This can feel difficult because we all would like to think people will return the favor but it is something that can be practiced. Most people will want to return the favor. It might not be immediate but it will come at some point. Some people won’t return the favor. Either way we learn something about that person. Be careful to identify what people consider a favor because we’ll all have different ideas.

The five love languages is a great resource to read and understand. Some people just want help with their work. Others will want gifts or money compensation. Others will want praise. Understanding what drives people will help better understand what they may give in return.

I enjoy helping others and would rather someone help me than give me a gift. I would often look into help desk tickets for others and try to push them along if I could. This was a small effort for me but paid off when I needed something from these same people. Often, because I had helped them they would return the favor.

Be yourself

Be genuine and authentic. People can tell if you’re just there to get something out of them. If someone determines another person has or is trying to manipulate them the relationship is toast. Be who you are and don’t try to be someone else. You can work to make positive changes in your behavior and habits but ultimately we’re all who we are. I’ve struggled with being myself. I want everyone to like me but that just isn’t possible. I’ve tried being someone else for people and it doesn’t work. I have improved how I interact with people but ultimately I have to still be true to myself and accept that I won’t connect with everyone.

Easy to start habits

Two techniques I like to tell people to start with is using people’s name and saying thank you. Again, people are their favorite subject and hearing there name is a good feeling. You’ll have to identify what and how people liked to be called. Don’t just shorten people’s names because some people like being called by their first name. Some people like using their middle name or nickname. It is also a great way to start a conversation.

Say, “Thank you!” This is so easy to do and one of the least used techniques in the workplace. Say thank you to people for their work. Say thank you for getting you something. Say thank you for sharing their insights. It’s so easy to do and something people don’t hear enough.

Summary

Relationships are a very powerful thing. They can help advance a career and they can help get a job. To build a strong relationship, make it about the other person. Ask questions and spend time with them. Give without expecting something in return. This can feel very difficult because we are very transactional and want to get what’s rightfully ours. Most people will return the favor. The ones that don’t you will still learning something about them.

Finally, Be yourself and start small. Be who you are but realize you can make improvements to your behavior and habits. One of those can be by using people’s name and saying “Thank you!” for something they’ve done. Gratitude is a powerful thing and makes you and the other person feel good.

How do you go about building good relationships with people? Leave a comment below.

Resources

If you want to learn more about social engineering check out my GitHub page, Social Engineering for the Blue Team. You can also click on Social Engineering page or reach out to me directly with any questions you may have.

Social Engineering - Deep Dive

Contact

This blog post first appeared on Exploring Information Security.

Social Engineering is making a come back

History always seems to repeat itself.

History of social engineering

Ransomware has been around since the late 1980s. Social engineering has technically been around since the advent of human communication. In the context of technology security it’s been around since phreaking techniques were used in the 1960s and 1970s as a way to take advantage of phone systems. Today it’s phishing, vishing, smishing, and much more. It’s been around but not the main technique used to get into an organization, well until now.

It seems as vulnerability management and incident response improves attackers are switching to social engineering via phone. I recently heard from a friend about another friend who got all their work logins compromised via an attacker calling into the help desk and resetting his password and MFA. This comes on the heels of the MGM and Okta breaches.

MGM

Like the movie Ocean’s 11 attackers used social engineering techniques to obtain access into MGM system by impersonating an employee and calling into the help desk to have their credentials reset. This resulted in ransomware being deployed in their environment and costing the casino hundreds of millions of dollars.

Okta

The compromise of access tokens via the Okta’s customer support unit is probably even scarier because Okta holds the keys to a lot of other organizations. This breach gives attackers information to pivot into other organizations.

What’s next for social engineering

When attacks like the two examples above are successful and result in lots of money and infamy others start copying the techniques used. I would expect us to continue to see attacks like these going forward which means more focus will be needed on security awareness. Groups like Scattered Spider are already starting to pop up and their focus is on social engineering their way into organizations. Then with that access ransomware gangs begin deploying ransomware. This highlights a need for good detection procedures and technologies. We’ll probably also see more difficult controls put in place to protect accounts. This will degrade our account access user experience as a side effect.

Resources for Social Engineering

Social-Engineer: This is a company started by Chris Hadnagy focused on social engineering. They provide resources and also assessments for an organization that focus on social engineering. He’s written several books as well on the topic that I highly recommend.

One of those books:

"Social Engineering: The Art of Human Hacking" by Christopher Hadnagy: This book delves into the psychology and techniques of social engineering.

Krebs on Security is a great blog to follow in general. He covers a variety of topics mostly around breaches.

This blog post first appear on Exploring Information Security

Social Engineering for the Blue Team: My Story

This is an ongoing blog series, which touches on my upcoming speaking and workshops on Social Engineering for the Blue Team. My current schedule is as follows: BSides Indy, March 20, 2018; I am an alternate at BSides Nashville April 14, 2018; and I will be doing a workshop on the topic at Converge and BSides Detroit, May 10-12, 2018. I hope to see you there.

"You're a Rockstar."

These were the words uttered to me after turning in my two-week notice at a previous place of employment. I know infosec rockstars are looked down upon in social media circles. I took this as a compliment. These were words from our CIO. He followed that up with, "Everyone seems to like you." Which I took as another compliment. Both compliments made me feel extremely good, because compliments are few and far in between in our industry. That's a topic for another blog post. For this blog post the compliments started me down a path of self discovery.

I always seemed to have a knack for getting along with others. I never knew why, though, and I definitely didn't feel like I was doing anything special. My early years of life were filled with a lot of happiness and joy. I loved school up until about the fourth grade. I was good at it, but I also had a lot of fun with my classmates. It wasn't until I moved midway through fourth grade that I started to realize the mean side of kids. We moved to New Jersey.

My dad served in the Army for 20 years. I moved a lot. I averaged two and a half years in places. Thankfully, after fourth grade we moved again. This time to Kansas. I had a much better time in Kansas. Middle school was pretty good. I had friends. I also had some enemies that used to be friends. We moved back to New Jersey for eighth grade and half of high school. This is considered some of my darkest years. I had friends, but I was also picked on. A lot.

My pants were to tight. My glasses were too big. All I wanted to do was fit in. My mom bought me baggier pants and scheduled an eye appointment to get contacts. My grades slipped in an effort to be part of the in-crowd.  I moved my junior year of high school to Minnesota. I was picked on there for my baggy pants (remember JNCO jeans). I had girl friends, but in general I found talking to the opposite sex intimidating at first. While I missed out on the academic side of school, I was learning about human interaction.

I failed a lot at human interaction. That, eventually, led to me picking up David Deangelo's Double Your Dating series. This was after a six-month period in which: my girlfriend dumped me; my roommate bailed on me and left me with paying for a two-bedroom apartment; and a captain's mast for showing up an hour late to duty. Technically, I was supposed to go to captain's mast after three write ups. Being late was my first one and something everyone did when they only had a few weeks left at a duty station. In this case I was being made an example of by the new commanding officer. Still I had failed, because I wasn't viewed as a good sailor. Something need to change.

Studying Deangelo's content I realized that I wasn't just learning interaction with women, but people in general. I was getting self-improvement tips and techniques. I picked up (on the recommendation of Deangelo) Feel The Fear And Do It Anyway by Dr. Susan Jeffers. This was the turning point. I started honing my soft skills. I did this for life quality reasons. After I was told I was a rockstar and people seemed to like me, I started to understand how. This was just a few years ago. Last year I read Social Engineering: The Art of Human Hacking by Chris Hadnagy and it opened my eyes to the how.

I've excelled at my roles party due to my technical prowess, but mostly due to my ability to build strong relationships with people. I see that as the key to my success in building security programs, processes, and improving the security culture of an organization. My current role has me sitting with developers. I am successful there because of the relationships I've built. Leadership wants to hire me away from the security team. The developers are making good security decisions without my input.

We talk about the talent shortage quite a bit in our field. A lot of solutions start with improving security programs in school and mentoring juniors in our field. I think those are good solutions. It will take time for those solutions to be fully realized in our industry. I also, don't have much influence there. Where I do have influence is in the better relationship realm. I think if we can interact better with other departments we can make strong improvements in security.

That's why I've put together this content. I'm really excited about the idea. I've had a lot of success with it and I think others will too. More to come.

This blog post first appear on Exploring Information Security.

Social Engineering for the Blue Team

I am happy to announce that I will be doing a workshop at Converge and BSides Detroit this year. The conference is May 10-12 in Detroit, Michigan, at Cobo Hall. Tickets are currently available for this event. It's a great conference with some really great trainers and speakers. I am humbled to be a part of the experience again this year.

I decided I wanted to do the training on this topic, because I think it's something our industry needs. Building relationships is very important for security. It's what allows us to get buy in from leadership, probably the most important factor in setting the tone for security at an organization. It's also what allows us to more easily get security implemented from a compliance and technical stand point.

I tried submitting this idea to some conferences (DerbyCon) at the end of the year last year. I wanted to avoid the use of the term social engineering, because I saw it as a sexy word. Something the red team only did. I didn't get any traction on the idea. I had a really long title. Something like, "Building relationships to get more security blah blah blah (boring!)."

After I read, Chris Hadnagy's book, Social Engineering: The Art of Human Hacking I realized that it's more than just a red team activity. In fact Wikipedia has multiple entries on the topic. It's not just security focused. It's also political. Reading the book it's even more than that. Sales and marketing people use social engineering. In fact, we all do it, to varying degrees. Some better than others. The book is focused on red teaming for social engineering. A lot of those concepts, though, I could easily apply and even provide examples of doing on a day-to-day basis.

Maybe I should backup for a moment and explain what I do. I sit with a development team. I don't sit with the security team. I am their security resource. I liaison security needs to them and development needs to security. The role has expanded to working with multiple teams and multiple departments. A large part of that is because I seem to have a knack for getting along with people. And that's because I apply a lot of social engineering techniques that red teamers us to breaking into a building or network. I never truly understood why until I started studying social engineering.

That has resulted in me not only understanding the why, but also how I can be even better at what I do. I would like to share that with the infosec community. I think we can all be better at interacting with other departments. I think using these techniques we can get even more done. We can reduce frustration and stress. We can have more opportunity to talk about security and influence others into a more secure mindset.

I've submitted this topic to multiple conferences. I was accepted as an alternate for BSides Nashville (tickets go on sale February 14.2018). I'm waiting to hear back on others. In the interim, I've started working on my slides and training. I plan to use the podcast and this blog as an opportunity to get my ideas and thoughts out of my head. Feedback is encouraged either in the comment section below, on Twitter, or email (timothy[dot]deblock[at]gmail[dot]com).

This blog post first appear on Exploring Information Security.

My Social Engineering Village (DEFCON) experience

This was my second time going to DEFCON. I was previously at DEFCON in the early 2000s. At the time information security was not my sole focus. I was serving in the Navy as an Electronics Technician. I did a little bit of everything.

Being stationed in San Diego, California, allowed me the opportunity to be dragged out to Las Vegas in August by a first class petty officer. At the time I had no idea what I was getting into. I just knew I was going to Vegas (baby!). I attended some talks and was fascinated by the capture the flag competition. The weirdest thing that happened to me was crashing at a hotel with on of the speakers my friend knew. I expected them to show up at some point in the wee hours. After waking up, I realized no one had come back to the hotel room we just stayed in. Odd.

You might think this sparked my desire to get into the field. Nope, I was more interested in playing black jack, hitting some slot machines, and taking in the complimentary drinks. It would be another eight years before I knew I wanted to get into infosec. After I got in I had no desire to go to BlackHat (too vendory) or back to DEFCON (been there done that). Instead I started hitting the smaller cons like BSides, CircleCityCon, ShowMeCon, and DerbyCon. Those conferences (much more affordable) satisfied my desire to contribute and network in the community.

That all changed in early May. While attending Converge and BSides Detroit my friend Dan asked if I wanted to go to DEFCON and volunteer at the Social Engineering Village. I was interested, but needed to check the logistics. After getting approval from my wife and manager, I started working on hotel and transportation. Last Tuesday I found myself in Las Vegas for the first time in over a decade. The TL;DR version is that I had a blast.

The crew running the Social Engineering Village (SE Village) are some of the most friendly people I've met in infosec. I not only got to know Chris Hadnagy and Michelle FIncher, but I also got to know their wonderful family and friends. They couldn't have been any more welcoming to a new person (I'm tearing up a little bit). I spent the entirety of DEFCON in the SE Village (HallCon was not an issue for me).

On Wednesday we grabbed a truck and loaded it up with everything needed for the village. We then started setting up and didn't finish until well into the evening. For dinner I had my first taste of Thai food (ever!). The next day Mission SE Impossible began.

Mission SE Impossible involved contestants picking their way out of hand and leg cuffs. Then they had to pick a door lock. After that they had to make their way through a laser field. The first dude (looked like military) literally jumped through the big hole we left at the top of the field. The hole was easily 4-5 feet off the ground. Unfortunately, he hit a laser and it didn't count. It was still cool to see him do it. Then they had to run through a micro-expression exercise. Finally, they picked another lock. They had 15 minutes to complete all these tasks. The guy that won did it in just over three minutes.

Friday and Saturday the village had the capture the flag (CTF) during the day and talks in the evening. I was exhausted by the end of both days. I showed up around 9 a.m. and didn't finish at the village until 9:30 p.m. that night. Most of that was on my feet helping with crowd control. Which by the way, if you're reading this and you were at the SE Village and you complied with any of our requests to move seats or move out of doorways, thank you. Most people complied with our request to push people around, which I appreciated.

Want to hear the @humanhacker talk about his favorite SE stories? Head to the #SEVillage. Emperors ballroom @defcon pic.twitter.com/OpBtYtDbrG

— Social-Engineer, Inc (@SocEngineerInc) July 27, 2017

The village was packed practically all weekend. DEFCON really needs to try and get them a bigger room next year. The first two days we had people packed into every seat and standable space and still had a line outside the door. Saturday was a different experience, because it came down that anyone in the room had to have a seat (did I mention they needed a bigger room). This moved any fire hazard from the room into the hallway, where people were lining up down to the end of the hall. A goon came in and asked if I could estimate wait time. I told him an hour plus, for anyone near the end of the line. Side note, the goons were very friendly and nothing like the jerks I had heard stories about the last few years. They were absolutely fantastic to work with. 

Half the time I didn't know what was going on the room, because anyone that left we had to fill their spot in the room. This meant either pushing people down or directing someone to the vacated seat. What I did catch was awesome. The talks were talks. I don't have many takeaways, because I usually only got to listen to bits and pieces. Things did start winding down when talks got started and I was thankfully to be sitting down. The calls were easily the most interesting part of the village (and the most popular).

The SECTF (calls) consisted of contestants calling various video game companies. They would try to get points by getting the person on the phone to divulge bits of information. These were basic things like browser or third-party software information (think Flash version). The success of contestants seemed to hinge on how well they did their research. Leading up to the competition each contestant was given a target and about two weeks time to find as much information as they could. This allowed them to collect numbers to call and pretexts to put together. The ones who did better research got live people on the phone. The CTF was on a Friday and Saturday, which meant the contestants had to get creative with their numbers.

Here is the list of flags for the #SEVillage CTF pic.twitter.com/52YDMEsNZF

— Dylan Hailey (@TibitXimer) July 28, 2017

For about half of the contest we had the pleasure of listening to ringtones and voicemails. The other half varied. Some companies were very good about not divulging information. While others were more helpful. The winner of the competition, Chris Kirsch, got a couple people on the line who provided him with almost every flag. Each call started a new set of flags, so contestants could rack up points with multiple calls. He had individuals going to thismachine.info and had them reading from the website, which just allowed him to rack up point after point. We didn't have many people leaving the room during his calls. Our biggest challenge was keeping the laughter down from all the information he was getting (yes, there was potential for the other person on the line to hear the room). I walked up and down the aisle trying to help shush the room. I watched as the look of humor turned to anguish as Chris raked up points. It was epic. At the end he got a standing ovation from the room. The dude straight crushed the competition. During Q&A he mentioned that he spend 40-60 hours doing research, in a two week period. This was the highlight of the competition.

On Sunday, Chris and Michelle recorded a podcast with Tim Larkin. I didn't get to listen to it all. What I did get the opportunity to listen to was fantastic. Tim talked a lot about situational awareness. After that we packed up and I headed to the airport. I took with me a bunch of new swag and hugs from everyone who worked the SE Village. The experience is one of the highlights of my infosec career. I can't wait for next year!

This blog post first appeared on Exploring Information Security.

Catching up update: CircleCityCon, BSides Augusta, and a 360 music video

I've got all the pictures processed for CircleCityCon and sent to DrBearSec for him to do with what he will. In total I processed about 360 pictures. I have two GIF ideas left to put together and then I'll be done with my venture. Look for a post about CircleCityCon and a gallery of some of my favorite pictures from that event.

In the mean time, here is InfoSystir AKA Amanda social engineering here way onto the stage at Dick's Last Resort in Indianapolis for a bachelorette dance off.

My talk, "The Blue Team Starter Kit" has been accepted by the CFP committee at BSides Augusta and I will be presenting there September 12, 2015. This will be my first time presenting at a security conference and I'm very excited about it.

Finally, this is just a really cool music video from Mike Shinoda's project, Fort Minor. Check out the website for a controllable 360 view.

This post first appeared on Exploring Information Security.

Fun infosec links August 21, 2014

How To Protect Your Personal Information Online - The Onion

A fun list of ways to keep your personal information safe online.

Special Note: for those unfamiliar with The Onion, it is a satirical site and not meant to be taken seriously.

Social Engineering a Telemarketer - Bruce Schneier - Schneier on Security

Telemarketer gets owned and it's wonderful. 

How to Use Your Cat to Hack Your Neighbor's WiFi - Andy Greenberg - Wired

Welcome to the infosec community my feline friend.

This post first appeared on Exploring Information Security.