This post was originally published in French only. We translated it in 2026 so the archive reads the same in both languages. Read the original →
We're taking this opportunity to look back on the social engineering attempts that took place to get into Hackfest and during the evening contests.
There were two categories of social engineering. The first, to get free tickets; the second, to get “flags" for the contest.
In the first category, we became aware of three major attempts. The first was made by someone who impersonated our DJ, supposedly having lost his cell phone and therefore unable to get in touch with us. He built a site from scratch, heavily inspired by a real Hackfest DJ. We exchanged a few emails and he ended up finding out where I work and calling me there. He managed to find that information through what I've posted on the Internet, and he brute forced his way to my extension, an extension that isn't publicly known.
For those who think posting information on the Internet is harmless, it can indeed be used to mount a more sophisticated attack. Beyond preaching it (see A small demonstration of information leakage), I've been a “victim” of it.
The second case was a teacher from Edmundston who mounted a phishing attack. The victims were her students. The details are in the following presentation:
Finally, another person tried to get our phone numbers through the hotel. That attempt failed, but it's an interesting vector.
In the second category, several people tried to convince Martin to reveal information and “flags” by buying him drinks. Some came up with elaborate stories that deserve a mention. Others just stuck to buying drinks.
The conclusion? Seeing how people took part, we've come to think we may be a little too “motivated”. Still, these few cases let us have fun and reach our goals. Rest assured that social engineering will be back for 2012. However, we'll add a few constraints, both to guide the efforts and to keep things from going off the rails.