Phishing With Misfortune Cookies: Onsite Social Engineering & Exploiting Assumed Trust

Within physical social engineering, exploiting assumed trust is key. You need to dress the part, know the lingo, and make anyone who looks your way think you’re simply an employee from out of town or a trusted vendor. Over the past couple years, Lucas Zahorik and Tyler Aldous have compromised the physical security of banks, law firms, hospitals, and fortune 500 companies, all in the name of testing and improving security. This presentation will cover assumed trust and gaining entry to a site, illustrated with a war story of how they compromised a company utilizing fortune cookies left in their break room by combining physical entry techniques and advanced phishing.