Please Pick Up: Crafting and Executing Successful Vishing Attacks

Please Pick Up: Crafting and Executing Successful Vishing Attacks

Speakers: Jason Puglisi

Conference: BSidesSF 2024

YouTube: https://www.youtube.com/watch?v=ggZWy5jw1yE

Overview

This talk, "Please Pick Up: Crafting and Executing Successful Vishing Attacks," delivered by Jason Puglisi at BSidesSF 2024, delves into the art and science of vishing, or voice phishing. Vishing, a form of social engineering, involves using phone calls to manipulate individuals into divulging sensitive information or performing actions that compromise security. While often associated with malicious scams, Puglisi highlights its critical role in ethical hacking and security awareness initiatives, demonstrating how organizations can leverage these techniques to identify vulnerabilities and strengthen their human security posture.

Jason Puglisi, primarily an application security engineer with a deep passion for human security, shares his journey from knowing nothing about social engineering to becoming a top competitor in the Defcon Social Engineering Village. His insights are grounded in practical experience, having secured second place in the 2022 competition and first place in 2023. The presentation serves as a comprehensive guide, covering everything from meticulous open-source intelligence (OSINT) gathering to the psychological principles behind crafting effective pretexts, all while emphasizing the ethical boundaries that distinguish legitimate security assessments from malicious attacks.

The talk underscores the pervasive vulnerability of individuals to social engineering, arguing that traditional security awareness training often falls short. Puglisi advocates for a multi-faceted approach that combines robust technical controls with enhanced human engagement and communication. By understanding the methodologies of vishing, organizations can proactively implement stronger defenses, foster a more security-conscious culture, and ultimately reduce their susceptibility to these increasingly sophisticated voice-based attacks.

Background

▶ Watch: Introduction to Vishing and its ethical application for awareness. (0:00)

Jason Puglisi's foray into the world of social engineering began serendipitously at the Defcon Social Engineering Village. Witnessing competitors extract sensitive corporate information—ranging from VPN software details and antivirus solutions to badge designs and visitor check-in procedures—through mere phone calls, he perceived it as "magic." This experience ignited a passion to understand and replicate these techniques, despite his primary background being in application security. His journey culminated in significant achievements, securing second place in the 2022 Defcon competition and subsequently winning first place in 2023, having meticulously prepared over 100 pages of reports on open-source intelligence (OSINT) and pretexting.

The problem that vishing addresses, and exploits, is the inherent human element in security. While technical safeguards are crucial, the human factor remains a significant vulnerability. Traditional security awareness training, as Puglisi points out, often proves insufficient. Even individuals who regularly complete such training can still fall victim to well-crafted social engineering attempts. This isn't a failure of the individual, but rather an indication that everyone is susceptible under the right circumstances—finding "the right person at the right time in the right mindset."

Puglisi's work is rooted in the understanding that social engineering, when conducted ethically, can be a powerful tool for raising awareness and testing an organization's resilience. Unlike malicious attackers who often resort to fear and threats, ethical vishing engagements aim to demonstrate vulnerabilities in a controlled manner, fostering a culture of security without causing harm. This approach helps organizations understand where their human defenses are weakest and how to implement more effective technical and procedural controls to mitigate risks that traditional training alone cannot address.

Key Findings

▶ Watch: Advanced Google Dorking techniques for internal documents. (4:00)

Jason Puglisi's presentation distills several critical findings regarding the execution and defense against vishing attacks:

• OSINT is the Bedrock of Vishing: The success of any social engineering campaign, particularly vishing, hinges on comprehensive open-source intelligence (OSINT). This involves gathering freely available data from diverse sources like search engines, social media, public data brokers, corporate websites, and even mapping services. This information provides the necessary details to craft believable pretexts and establish rapport.
• Simplicity is Key in Pretexting: Effective pretexts are not complex narratives but rather simple, believable stories that minimize opportunities for doubt. The goal is to quickly establish trust, create a sense of urgency, and maintain momentum throughout the call. Overly elaborate stories increase the chance of inconsistencies and suspicion.
• Ethical Boundaries are Paramount: When conducting vishing for security awareness, it is crucial to operate within ethical guidelines. This means avoiding the use of fear, threats, or blackmail, which are tactics employed by malicious actors. The objective of ethical hacking is to educate and improve security, not to exploit or harm.
• Security Awareness Training Alone is Insufficient: A recurring theme is that while training is important, it is not a complete solution. Individuals who have undergone security awareness training can still be successfully vished. This highlights the need for a multi-layered defense that goes beyond mere education.
• Technical Controls are Essential for Human Security: To truly mitigate vishing risks, organizations must implement robust technical controls. This includes strong, phishing-resistant authentication mechanisms like hardware security tokens and Passkeys, enforcing the principle of least privilege, and establishing comprehensive auditing and alerting for unusual activities.
• Building Trust and Communication is Vital: Fostering an environment of trust, transparency, and open communication between security teams and employees is crucial. Engaging employees through programs like Security Champions and relating security concepts to their personal lives can significantly increase their engagement and vigilance.
• Internal Vishing Engagements are Highly Beneficial: Conducting internal vishing simulations, whether successful or not, provides invaluable learning opportunities. These engagements generate real-world stories that can be used to spread awareness, educate employees, and refine defensive strategies. Even "failures" can offer significant insights into what works and what doesn't.

Technical Deep Dive

▶ Watch: Leveraging technical OSINT tools like Wigle, DNS Dumpster, and Shodan. (9:00)

The technical core of successful vishing, as detailed by Jason Puglisi, lies in meticulous open-source intelligence (OSINT) gathering and the strategic crafting of pretexts. These two elements combine to create a believable and effective social engineering attack.

Open-Source Intelligence (OSINT) Techniques

Puglisi emphasizes that OSINT is all about leveraging free, publicly available data. This information forms the foundation for understanding the target, identifying potential vulnerabilities, and building a convincing narrative.

1. Search Engines (Google, DuckDuckGo):

• Targeted Queries: Start by narrowing searches to a specific domain using site:example.com.
• Document Discovery: Utilize filetype:pdf or filetype:doc to uncover internal documents that might be inadvertently indexed. These often include marketing materials, but crucially, can also reveal employee handbooks, benefit information, and other sensitive internal data not properly locked down.
• URL and Text Analysis: Once interesting documents or web pages are found, analyze common URL paths or headers/footers. Use inurl: to search for specific URL segments and intext: to find keywords within document or web page bodies. This iterative process allows for deeper dives into specific types of content.
• Contact Information: Search engines are excellent for finding email addresses and phone numbers. While Google might drop special characters like the '@' symbol, it often leads to pages containing legitimate contact details. Searching for area codes associated with a company's headquarters can also yield employee contact information, providing insights into time zones for calling.

1. Social Media (YouTube, LinkedIn):

• Visual Reconnaissance: "Day in the Life" videos or office tours on YouTube, whether from the company or enthusiastic employees, can reveal critical visual information. This includes software running on computer screens, reception desk layouts, and details of badge reader systems (e.g., black rectangles with red bars indicating HID badge readers).
• Employee Badges: While companies advise against posting badges, group photos from events or first days often inadvertently display employee badges. Even if the exact technology isn't discernible, the general format can inform the creation of counterfeit look-alikes.
• Technology Stacks: LinkedIn is a goldmine for identifying specific technologies, vendors, and tools used by a company. Employees often list these details in their job descriptions, providing valuable keywords to drop during a vishing call to establish credibility. Puglisi humorously notes that this is often the "only productive use" of LinkedIn.

1. Maps (Google Maps, Bing Maps):

• Physical Layout: Satellite images and street view can reveal building entrances, loading docks, potential reception desk locations, and security guard posts.
• Vendor Identification: By examining parking lots, attackers might spot vehicles or vans with logos of external vendors, providing names of third-party companies that could be leveraged in a pretext.
• Historical Data: Many mapping services offer historical captures, allowing attackers to "go back in time" to find information that might no longer be present in current views.

1. Technical Sources:

• Wigle: A physical location-based Wi-Fi search engine. Users contribute data by scanning for networks, and the service provides Wi-Fi networks in a given area. It offers free credits for initial use.
• DNS Dumpster: By inputting a website, this tool pulls up DNS records, including subdomains. This can reveal hidden infrastructure or other interesting domains to investigate further, informing subsequent Google or social media searches.
• Shodan: A broader web search engine that looks for keywords in server responses and web pages. It can uncover domains previously unknown or hidden content not typically indexed by standard search engines.

Pretext Development

With a wealth of OSINT, the next step is to craft a compelling pretext. Puglisi's top advice is to keep it simple, minimizing opportunities for doubt or confusion.

1. Establish Trust:

• This is the initial hook. It could involve claiming a specific job title (e.g., "corporate IT") or, with extreme caution, using the name of a real person found through OSINT. Using a job title is generally safer to avoid direct confrontation with someone who might know the named individual.
• Dropping hints about known software, vendors, or tools gathered during OSINT adds significant credibility and context.

1. Establish Urgency:

• Provide a clear, immediate reason for the target to engage. Puglisi has successfully used the narrative of "trying to complete a report" and needing a few minutes of assistance.
• While not explicitly recommended for ethical hacking, background noises (e.g., a crying baby) can also create a sense of urgency in real-world scams.

1. Maintain Momentum:

• Keep the conversation flowing and the target engaged and cooperative.
• Express gratitude and friendliness: People generally want to be helpful, and leveraging this innate desire is a core social engineering tactic. Being polite and appreciative makes the target less likely to question the caller or hang up.

1. Example Pretext (Defcon Competition):

• Puglisi shared his successful pretext: claiming to be from "corporate IT," needing to "wrap up this week's report," and seeking "feedback on cybersecurity initiatives."
• The genius of this pretext lies in its simplicity and its appeal to common frustrations. By asking for feedback on "annoying slideshow trainings," "antivirus," and "VPN software," the caller taps into a shared sense of complaint, fostering immediate rapport and sympathy. This "bonding over complaints" makes the target more willing to engage and share information.

Demo / Proof of Concept

▶ Watch: Principles of crafting simple, effective pretexts for Vishing. (11:00)

During the talk, Jason Puglisi conducted a live demonstration of his OSINT techniques, using Disney as a target company. This practical walkthrough illustrated how quickly and effectively publicly available information can be gathered to inform a vishing attack.

1. Google Search for PDFs:

• Puglisi started with a Google search for site:disney.com filetype:pdf.
• Initial results included "sweepstake stuff" and other marketing materials.
• Crucially, he quickly identified PDFs related to "dorms" and "human resource management."
• Within these documents, he immediately found a legitimate telephone number and an email address associated with the "Disney college program" and a scholarship application. He noted that this contact information could be used to craft a pretext, such as pretending to be an applicant for one of these programs. This demonstrated how easily real contact details for employees or program administrators can be unearthed.

1. DNS Dumpster for Subdomains:

• Next, Puglisi used DNS Dumpster to explore disney.com for interesting subdomains.
• While TXT records were public and not particularly revealing, the host records provided a list of subdomains, including "mail servers," "VPN proxy," and "FileMakerCorp."
• He chose to investigate FileMakerCorp, speculating it might host files. Although browsing to the subdomain revealed a "test page" that didn't appear to be an active site, it was still "interesting that it's out there," indicating potential forgotten or misconfigured infrastructure. This highlights how even seemingly inactive subdomains can provide clues or potential entry points.

1. Google Maps for Physical Reconnaissance:

• Puglisi then attempted to use Google Maps to locate Disney's headquarters in Burbank.
• His goal was to use Street View to look for building entrances, loading docks, and potential security setups.
• However, he noted that direct Street View access onto the Disney campus was not available, though one could potentially view the buildings from surrounding roads. This illustrated a common limitation but also the persistence an attacker might employ by checking various angles and historical map data.

The demonstration, though brief, effectively showcased how a combination of common OSINT tools can rapidly yield valuable information—contact details, internal program specifics, and infrastructure clues—that are directly applicable to crafting and executing a vishing attack. Puglisi concluded that it was a "decent start of showing off some kind of Open Source intelligence we can do," reinforcing the idea that even basic searches can be highly fruitful.

Defensive Implications

▶ Watch: Discussing phishing-resistant authentication for BYOD environments. (25:00)

Jason Puglisi strongly argues that traditional security awareness training, while having its place, is not a complete solution to the threat of vishing. He emphasizes that "everyone is vulnerable," and effective defense requires a multi-pronged approach focusing on technical controls, auditing, and fostering a robust security culture.

1. Prioritize Technical Controls:

• Stronger Authentication: The most critical defense against vishing, especially in a Bring Your Own Device (BYOD) environment, is implementing phishing-resistant authentication. This includes Hardware Security Tokens and Passkeys. These methods ensure that even if an individual falls for a vishing attempt and provides credentials, the attacker cannot bypass the authentication mechanism without physical access to the token or device.
• Least Privilege: Companies must ensure that employees only have access to the absolute minimum data and actions required to perform their job functions. This limits the potential damage an attacker can inflict even if they successfully compromise an account.
• Auditing and Alerts: Robust logging and alerting systems are essential to detect unusual activities or access patterns. Surfacing these anomalies allows security teams to quickly identify and respond to potential compromises before significant damage occurs.

1. Enhance Human-Centric Security:

• Build Trust and Transparency: Security teams should actively work to build trust and open communication with employees. This involves moving beyond a purely enforcement role to one of partnership and support.
• Security Champions Programs: Engaging employees through initiatives like Security Champions programs can empower them to become advocates for security within their own teams, fostering a more proactive security posture across the organization.
• Relate Security to Personal Life: To increase engagement, security education should connect to employees' personal lives. People are often more motivated to protect their own data, friends, and family. By teaching techniques that apply both professionally and personally, organizations can cultivate a deeper understanding and commitment to security.

1. Conduct Internal Vishing Engagements:

• Proactive Testing: Security teams should regularly conduct internal vishing simulations. These ethical hacking exercises provide real-world insights into an organization's vulnerabilities and the effectiveness of its existing controls.
• Learning from Successes and Failures: Both successful and unsuccessful engagements offer valuable lessons. Sharing these experiences, including what worked and what didn't, helps spread awareness and educates employees about the tactics used by attackers. This storytelling approach makes the threat more tangible and relatable than abstract training modules.
• Continuous Improvement: The insights gained from internal vishing should inform continuous improvements to technical controls, policies, and awareness programs.

1. Mitigating BYOD Risks (from Q&A):

• For companies that don't issue company mobile devices, mitigating vishing and smishing on personal devices is challenging due to limited control.
• Encourage Reporting: The primary defense is to encourage employees to report any suspicious vishing or smishing attempts they encounter on their personal devices. This helps security teams track threats and provide timely guidance.
• Focus on Phishing-Resistant Authentication: As mentioned, strong authentication like hardware tokens remains the most effective control, as it prevents attackers from gaining access even if a user is tricked into providing credentials via a personal device.

In essence, Puglisi advocates for a shift from solely relying on human vigilance to building a resilient security architecture where technical controls act as a safety net, making it "impossible for the human to mess up or give away company secrets in the first place."

Key Takeaways

• OSINT is the Foundation of Vishing: Successful vishing attacks are built upon extensive open-source intelligence gathering from search engines, social media, maps, and specialized tools like Wigle, DNS Dumpster, and Shodan. This information is crucial for crafting believable pretexts.
• Simplicity and Psychology Drive Pretexts: Effective vishing pretexts are simple, establish trust (e.g., "corporate IT"), create urgency (e.g., "wrapping up a report"), and maintain momentum by leveraging human nature, such as the desire to help or bond over shared complaints.
• Traditional Training is Insufficient: Standard security awareness training alone does not adequately prepare individuals to resist sophisticated vishing attacks. Everyone is vulnerable under the right circumstances, necessitating a multi-layered defense.
• Technical Controls are Paramount: To truly defend against vishing, organizations must implement robust technical controls, including phishing-resistant authentication (e.g., hardware security tokens, Passkeys), strict adherence to the principle of least privilege, and comprehensive auditing with proactive alerts.
• Foster a Culture of Trust and Communication: Building strong relationships between security teams and employees, promoting transparency, and engaging staff through programs like Security Champions can significantly enhance an organization's overall human security posture.
• Internal Vishing Engagements are Invaluable: Conducting ethical internal vishing simulations provides practical insights into vulnerabilities, generates relatable stories for awareness campaigns, and helps refine defensive strategies, regardless of whether the engagement is a "success" or a "failure."

About the Speaker(s)

Jason Puglisi is primarily an application security engineer with a profound passion for human security. His interests span security culture, awareness, and ethics. He has extensive experience running security Champions programs and Bug Bounty programs, which he views as crucial for building strong relationships with external researchers. Puglisi's journey into social engineering began a few years ago when he stumbled upon the Defcon Social Engineering Village. Despite having no prior experience in the field, he quickly excelled, securing second place in the competition in 2022 and achieving first place in 2023. He is driven by challenge and is dedicated to sharing his knowledge to raise awareness about social engineering tactics. Jason also maintains a Medium blog where he documents his experiences from the Defcon competitions.