Presented on Thursday 14th September 2023 at 44CON 2023
The pathway to initial access in 2023 is far from an easy one. This talk will lift the lid on all the recent techniques, tactics and procedures (TTPs) we have both been using to gain access and seeing clients targeted with.
The days of initial access being a case of sending a basic phishing email and get creds are long gone. With email filters so much more effective, end user training more frequent, corporate procedures enhanced, phishing is hard. We need to think differently, we need to be creative. That is what this talk is all about. Showing you the TTPs we have developed over the years to evade or even bypass corporate controls and trick staff into giving us access. We will reveal the TTPs that we have seen our clients targeted with in recent months and we have developed ourselves over time. This is much more than phishing, this is full scope social engineering initial access, showing the many ways of getting in and gaining initial access in 2023 and beyond.
Tony Gee:
Tony Gee, Social Engineer, OSINT & Intelligence Analyst, Pen Test Partners
For 15 years, Tony's job has been either trying to break technology or defend it from attack. This he has done everywhere from banks to mass transport systems. He specialises in open source intelligence and social engineering, providing intelligence and understanding, helping clients understand their exposure and providing insight and access for red and purple teams. He also speaks the world over at technology and cybersecurity events about how anything from children's toys to cars, planes and ships can be hacked. He has spoken at PCI events in Europe and Asia, at the ISC2 Congress, ISACA CSX Europe, SANS Awareness Conference, WIRED Smarter, technical conferences such as 44Con and BSides. Most notably, he has spoken to US Congress and the European Central Bank about how the underlying digital theories and systems which modern life relies on, are vulnerable to attack.
29 сен 2024
