Fake femme fatale dupes IT guys at US government agency

http://nakedsecurity.sophos.com/2013/11/03/fake-femme-fatale-dupes-it-guys-at-us-government-agency/

by timw6n • 13 years ago

180 92 13 years ago

nakedsecurity.sophos.com

judk• 13 years ago

The real security fail here is letting company devices run java applets.

smsm422• 13 years ago

So the head of IT sec uses unpatched browser, un-updated Java and allows applets from sites he sees first time in his life? Well, good enough for government work, I guess.

magic_haze2• 13 years ago

I thought that article said they used a zero day jvm bug, but your point stands: why would you execute something unknown, especially from a greeting card site? (Then again, it's a honey pot... I'm not sure I would be thinking straight in that situation either.)

smsm422• 13 years ago

They used zero-days perviously, but not this time, according to the article:

The agency's name was not revealed, but Lakhani said it was a very secure one that specializes in offensive cybersecurity and protecting secrets and for which they had to use zero-day attacks in previous tests in order to bypass its strong defenses.

It implies this time they didn't have to because christmas card from cure facebook profile was enough.

Thinking straight should not be required, that's why policies are around. If the policy is "no Java on work browsers, ever, for any reason" and "updates are installed same week they are released by vendor", the chance for somebody opening Christmas card from cute girl and getting national security compromised would be much lower.

dguido• 13 years ago

If clicking one link leads to your company losing all of its intellectual property, then you have a technology problem. Lazy security "professionals" who can't design good solutions are far too quick to blame users.

yeukhon• 13 years ago

What kind of security mitigation do you propose?

zhemao• 13 years ago

Well, disabling Java applets in everyone's web browsers would probably be a good start.

atmosx2• 13 years ago

Yeah I don't get this one-click phishing either. Does everybody out there have a 0-day javascript exploit, which will happen to run on a Windows XP SP1 machine running internet exploder?

I mean, WTF all these security experts running out-of-date machines or the 0days are more than we can count.

gaius7• 13 years ago

I like it, proper old-skool James Bond-esque spy antics, none of this modern NSA nonsense.

stfu• 13 years ago

I have to agree. Sounds actually quite a lot of fun to sit around and think about outsmarting human behavior. Almost like a professional troll-baiting service.

qznc• 13 years ago

And then you get to use the 5$ wrench. ;)

http://xkcd.com/538/

walshemj2• 13 years ago

I just hope they keep an eye on the games workshop stores in cheltnam and the ones near the NSA in maryland just in case Natasha with the large "sisters of battle army" is not who she seems :-)

Amadou2• 13 years ago

There was a comment in the story that I think is misleading - Attractive women can open locked doors in the male-dominated IT industry. Attractive women can do that in any industry, it doesn't need to be male dominated. Men are stupid that way (if we weren't stupid that way birth rates would probably be 1/100th of what they are now), you only need a handful of men to have a good probability of finding at least one who is thinking with more than one brain.

beachstartup4• 13 years ago

(if we weren't stupid that way birth rates would probably be 1/100th of what they are now)

uh, no. very attractive women don't have kids with the legions of dorks that give them unearned help throughout their life. in any industry.

women aren't stupid. they're actually very smart.

dopamean• 13 years ago

You're ruining the dream bud.

Amadou2• 13 years ago

Your assumption does not follow from what I wrote, in fact it is practically the reverse since my point was that any industry is vulnerable.

It isn't just "dorks" who give even marginally attractive women special treatment - there are very few categories of men who don't (primarily gay men). Try this experiment out in real life - any time you see a man helping a female stranger with anything consider if he would do the same for a male stranger. The number of times a straight guy will go out of his way for another man who isn't a friend is practically zero.

women aren't stupid. they're actually very smart.

The idea that women deliberately take advantage of "dorks" sounds vaguely bitter and misogynistic.

gaius7• 13 years ago

Women are people. Some are very smart, some are stupid, in the same proportions as men. For every male IT worker who's been duped by an attractive women, there's a female secretary who thinks her boss is really going to leave his wife for her.

_bfhp• 13 years ago

I think the point was that _because_ men dominate the computer industry, you will have an easier time targeting IT systems for exploitation with this method.

marquis2• 13 years ago

Instead of bringing the conversation down to a question of pretty-woman-duped-the-gullible-man, which isn't productive for anyone, I'm sure this could have been achieved many other ways, e.g 'Leaked new Tesla car' or "Cupcakes downstairs now!". The issue at hand is the security failure, not how the person in question was duped.

ivix• 13 years ago

If you find this topic beneath you, why did you read it? The article is precisely about a specific type of social engineering, which is a worthy topic of interest even if you find it insufficiently cerebral.

nether• 13 years ago

I doubt a pretty girl would have so many employees bending over backward to help her if they were all women. You're kidding yourself if you think a female-dominated industry wouldn't have handled her more appropriately.

fleitz• 13 years ago

Yes, likely the opposite would occur.

I can't comment how how commonplace it is, but having worked in an office with many women there seemed to be a lot of animosity towards the more attractive women from the less attractive women. Could have just been that office.

Another friend who ran a support department told me she refused to hire a quite attractive candidate because she felt that the attractive woman would 'distract the men'. My personal feelings were that she liked being the only woman in the department. To be fair she also refused to hire candidates based on their age. We stopped talking shortly after that conversation.

atmosx2• 13 years ago

Her? Sure. What if instead of her you put Alain Delon or the next beautiful, skilled, attractive in multiple ways male on the frame. See how women start acting stupidly just to get into his pants... It's human nature.

That said, there's no remedy for stupidity.

enraged_camel2• 13 years ago

Forget about attractive women. The focus should be on the fact that in any system or process that needs to be secure, humans are by far the weakest link. The legendary/infamous hacker Kevin Mitnick wrote about his social engineering practices in his book Art of Deception. Everyone here should give it a read.

reneherse• 13 years ago

For an entertaining dramatization of social engineered IT infiltration (that does include tradecraft by femmes fatale), there is 2003's Battlestar Galactica.

Theodores• 13 years ago

In the outlined scenario there is some basement-dwelling-geek tricked into giving away the keys to the castle by some allegedly mega-fit-babe who is outside the company. This is not the only scenario where this can go horribly wrong.

A few years ago I worked at some company where the computers were well and truly locked down. No facebook, no YouTuBe, no nothing. If it could not be accessed on Internet Explorer 6 for the strict purposes of getting the job done then you was not having it.

However, a charming young lady in some admin department was able to work her charms on the IT department. Somehow it became imperative that, unique in the company, she was able to access all the tedious sites of the internets. It only took a week or two before her computer was well and truly soiled with viruses, e-coli, everything. She did her own 'social engineering' to wreck her computer, however, someone on the outside, had they known that her computer was the weak one, could have social engineered her to install whatever.

Times have moved on since IE6. Nowadays everyone has a smartphone in their pocket and they can do whatever they need to do on that. We also now know that computers are vulnerable. People understand this, they did not back then (IE6 days).

So maybe it is time for offices where confidential stuff gets done to tighten up the firewalls, block the websites and make the office internet access a bit more locked down, with no need to pander to people who 'need' Facebook access at work. Reasons can be provided as to why this has to be and people can be encouraged to use their gadgets for anything social-network-y.

gaius7• 13 years ago

Agree 100%. In an era where every office worker probably has a smartphone or a tablet, work machines can be locked down for work and work only and no-one's lifestyle needs suffer.

I'd be interested if there are any stories of attractive men working their charms on the HR department, I bet it happens more than anyone suspects.

pstuart• 13 years ago

In short, internal networks should be treated as "the internet with a guest list"

daemin2• 13 years ago

I read the article as saying that she worked at the secure (target) agency, hence the fake profile was for someone that already worked at the agency. It was just using a photo of the waitress.

So there's some assumption on the part of the employees that she is already employed by the company, and hence she's been vetted somehow. That would also explain the job offers since other companies would want to poach employees.

Though my take away from this is that there are a lot of men that think that niceness at work is a way into a hot girl's pants.

xerophtye5• 13 years ago

a lot of men that think that niceness at work is a way into a hot girl's pants.

I am tempted to ask, if niceness isn't, what is?

jloughry• 13 years ago

There was a similar story a few years ago (2010). The "Robin Sage" profile was constructed as a honeypot across a number of social networks. Ultimately, the problem was the originators couldn't spoof the MIT alumni network:

http://www.computerworld.com/s/article/9179507/Fake_i_femme_...

http://en.wikipedia.org/wiki/Robin_Sage

RexRollman• 13 years ago

That was mentioned in the article.

dcJoker• 13 years ago

For what it's worth, if she duped them, she wasn't a fake femme fatale. She was a real one.

jpatokal• 13 years ago

Did you read the story? The pen test team created a completely fake female profile and used it to hack their target.

nakkiel• 13 years ago

I think he was being ironical on the meaning of the French word "fatale": fatal. Doesn't really matter anyway :)

001sky• 13 years ago

Here's how popular Emily Williams proved within just 24 hours of her birth:

    She had 60 Facebook connections.
    She garnered 55 LinkedIn connections with employees from
    the targeted organization and its contractors.
    She had three job offers from other companies.

The 3x job offers seems a bit rich...wtf

sb23• 13 years ago

A related anecdote: I've got both my long-term jobs because of my feminine sounding, unusual name. They've decided a female on staff would be a change of pace, then I guess my interviews were good enough to change their minds.

gaius7• 13 years ago

By "job offer" they probably mean "contacted by a recruiter" which is not unusual, that's what LI is for.

justinmk2• 13 years ago

How do you solve a problem like overly friendly, helpful employees?
... training employees to: Question suspicious behavior and report it to the human relations department.
Refrain from sharing work-related details on social networks.
Not use work devices for personal activities.

This reminds me of something Cory Doctorow[1] said regarding the NSA. Paraphrasing: the more locked-down an organization becomes, the more ineffective it becomes. When you can't trust your employees to the point that it becomes actual institutional policy to discourage information-sharing (communication), you are guaranteed to be dysfunctional.

There is a parallel, of course, regarding the red tape surrounding procurement for large government projects in order to mitigate corruption.

Addressing symptoms, not causes, is the theme.

---

[1] correction, Julian Assange: "the more secretive or unjust an organization is, the more leaks induce fear and paranoia in its leadership and planning coterie". Which isn't precisely applicable to my comments above, so I guess that's my own conjecture.

elsurudo• 13 years ago

AFAIK, that was Julian Assange.

justinmk2• 13 years ago

I was hoping someone would correct; thank you.

rbanffy• 13 years ago

I offer this discussion two movie/TV quotes:

"Silly little planet. Anyone could take over the place with the right set of mammary glands."

"I always thought the opposable thumb was... overrated"

I don't think much more needs to be said.

xerophtye5• 13 years ago

Spot on with the first one! Though i don't get the second's relevance...

verteu2• 13 years ago

It's interesting that the fake female profile received multiple job offers, while the male one did not. Doesn't this contradict the popular opinion that tech giants discriminate against women when hiring?

Crake• 13 years ago

It does. Popular opinion is wrong. Only feminists believe that stuff, and their propaganda is everywhere, so a lot of normal people end up believing it too because the other side completely lacks political clout.

Women are vastly more attractive applicants than men, due to sex based discrimination policies, higher college graduation rates, gender roles for men that demand they treat women better than men, and also just general curiosity garnered by an atypical applicant. Women stand out from the crowd in IT because there are so few of them. As a result, it's far easier to be noticed.

im3w1l• 13 years ago

I think there are quite a lot of studies showing that discrimination is indeed occurring. But if I allow myself to speculate, maybe that is for the average man vs the average woman. This was presumably a highly attractive woman.

mherkender2• 13 years ago

I doubt it's actual job offers. More like recruiter spam. But even if it was true, I doubt the enthusiasm towards offering a job to a woman they've never and know little to nothing about could be considered positive. Hitting on job candidates isn't good for women's perception of the tech industry.

But if it was recruiters? I work in tech and get spammed by recruiters all the time. I don't really think it counts for a lot, since I didn't get any until I was already in tech.

verteu2• 13 years ago

If the male candidate got several job offers and the female got none, would you consider this evidence of gender discrimination? Bayes' Law says you cannot rationally hold both beliefs simultaneously.

mattdeboard• 13 years ago

Missed a shot at a golden headline: "Fake femme fatale fools feds"

jokoon• 13 years ago

Yeah, compare a java vulnerability with a sexy chick, that's totally it.

If the trick worked, it was because java had vulnerabilities and because they were male, so how should it be fixed ?

DUH

Paul123455342• 13 years ago

Isolate activities in virtual machines. Ideally use something like Qubes OS. At the very least, fire up Virtualbox. My password safe runs in my Virtualbox host OS. Nothing else unnecessary runs there. I do my browsing and daily work in various virtual machines.

Paul123455342• 13 years ago

(Not ideal/feasible for every employee, but if you do have important access/credentials... at least they aren't getting those by owning your browser in a throwaway VM)

sp3322• 13 years ago

10 year experience at age 28 is maybe unusual but not unheard-of. I'm 27 and I have 13 years professional programming experience.

gotrecruit• 13 years ago

how do you define "professional programming experience"?

tzury• 13 years ago

I guess, getting paid for a programming job, and doing so vast majority (or all) of the time can be considered as professional programming

sp3322• 13 years ago

Getting paid :) Especially for a full-time position with the job title "Software Engineer". I am fudging a bit on the time though, since in high school I was mostly doing troubleshooting IT crap and only got large software projects in the summers.

Bulkington• 13 years ago

Seriously, I get a kick out of weekend HN. Not that there's anything wrong with that.

AndrewKemendo• 13 years ago

As someone who has worked in the security field the desire to want to help people is still overwhelming. I love PenTests and have had successful ones run on me even when I was vigilant and in the testers faces.

The key reason why I think most confidence penetrations work is because in most cases the "system" doesn't work smoothly enough to not have usability issues. So when you know of credible people who are vetted but are still not "in the system" that becomes an instance of the "system" not working.

Then, inevitably in the few boundary cases where it doesn't work, you get to the point that you know how it will break and will wave over anyone in that specific sitution. If someone knows of these specific "breaks" then by definition they will exploit those knowing that it is a common issue.

If however you stick to the "I don't care what you say, you aren't in the system" then you are now "the inflexible security nazi." Security really is an ethos and it takes only a few pinpricks to make it crumble.

PhasmaFelis• 13 years ago

People are trusting and want to help others. How do you solve a problem like overly friendly, helpful employees?

Ah, I'm so glad I don't work in security. In the library field, you seldom hear people say "Our employees are decent human beings. How can we fix this?" with a straight face.

xerophtye5• 13 years ago

So my take is, the industry is heavily male dominated, and thus that becomes a vulnerability. So we need to counter this. How do we do this? Get more Hot chicks recruited!! If there's enough of them to be commonplace, this wouldn't be a problem right?

TwoBit• 13 years ago

Well that Java exploit wouldn't work on me because I have Java uninstalled and disabled on all my computers.

That's not to say I an confident I wouldn't screw up in some other way, but Java should not be on the computers of anybody who cares about security.

monksy• 13 years ago

That sounds like a duplicate of what Jordan Harbenger did: http://www.securitytube.net/video/5825

Fake femme fatale dupes IT guys at US government agency

Related Stories