"Developers - The Lucrative Target for Social Engineers" - Stuart Peck (@cybersecstu)
Channel: OWASP London
Date: 2019-04-15

Developers are a lucrative target for attackers, especially those with public profiles, active on social media, and working on either high profile application and open source projects. The recent attack against an NPM package with malicious code that targeted a popular Bitcoin wallet was subject to a social engineering attack, where the attacker was able to trick the maintainer to hand over ownership, is one of the many examples this is an ever increasing vector This talk looks to explore how exposed some developers are and the impacts this can have either through the supply chain and/or directly to organisations. During this talk will we will demonstrate and discuss: Open Source Intelligence- recon techniques; Profiling targets, repos, developer backgrounds, coding style, digital footprint; Pretext creation – building trust and establishing legitimacy; Example Vishing calls, phishing emails, and case studies; What developers can do to challenge and reduce the impact of Social Engineering


Speaker Bio: 
Stuart Peck (@cybersecstu)

From a background of threat intelligence, social engineering and incident response, Stuart Peck heads up Cyber Security Strategy for ZeroDayLab and co-founder and podcast host of The Many Hats Club, a large information security community. Stuart is passionate about educating organisations on the latest threat actor techniques and how to combat them. In addition, he has won awards for his education and training programs delivered to throughout the Europe and USA. As a practicing social engineer he managed large scale engagements in banking, gambling/gaming, retail, software, insurance etc. Stuart's key areas of expertise include: the dark and deep web, social engineering, incident response management, threat hunting, OSINT, OPSEC, and cyber-crime. He has also led investigations in many major security incidents, including global ransomware outbreaks. Stuart is a regular contributor on Social Engineering to many leading blogs including Security Affairs, Bleeping Computers, The State of Security and is published in many leading Journals including the ISSA and quoted in mainstream media.

This talk was presented at the OWASP London Chapter Meeting on the 13th February 2019 at Amazon London offices.