Christopher Hadnagy

Christopher James Hadnagy (born Summer of 1973) is an American security consultant, author, and professional social engineer. He is most well known for creating the world’s first framework for social engineering (SE) and authoring one of the first books in the field of social engineering, Social Engineering: The Art of Human Hacking.[1] He is the Chief Human Hacker of Social-Engineer, Inc., which performs security audits to uncover the weaknesses in an organization’s human network through real world social engineering penetration tests (pentests).

Hadnagy specializes in understanding how malicious attackers exploit human communication and trust to obtain access to information and resources through manipulation and deceit.[2] His goal is to secure companies by educating their employees on the methods used by attackers, identifying vulnerabilities, and mitigating issues through appropriate levels of awareness and security.[3]

Hadnagy is also the father of Amaya Hadnagy, the owner of Youtube Channel TeenyTinyTubers. His 12 year old daughter was also the SE Village Photographer during DefCon 24 .

Early life

Hadnagy moved around frequently in his early life, spending many years in New York, Pennsylvania and Florida.

While attending a college on the West-coast of Florida for a degree in programming, Hadnagy became interested in emerging Internet technology and wrote a simple script (now called War Dialers) that linked together two 9600 baud modems to call random numbers at the telephone company and play a tone; the experiment shut down the numbers. He later found that a number of phone lines in that county had been shut down for a short periods of time by this script. This experiment began Hadnagy’s interest in learning more about how computer technology and the Internet work.

He was also an internal negotiator for the purchase of stainless steel in the countries of China and India; during which time, he brokered a deal with one of China’s largest stainless steel mills that was the first of its kind in American history.

Professional SE career

The Social Engineering Infographic – An infographic by the team at Social-Engineer, Inc. all about Social Engineering Threats and Mitigations

Hadnagy began his technical career with his own business, AREESA Computers, making and repairing home and business computers under the tagline “Your computer company of the future.” After personal PC’s became significantly less expensive, he moved to doing more networking and vulnerability scanning services with his company, under the new name White Hat Defense. It was at this time, Hadnagy worked with the team that created BackTrack (now Kali) and the mastermind behind that, Mati, was a mentor and friend. Mati nurtured Hadnagy’s skill set in social engineering. Hadnagy commented, “I guess I was always an SE but never knew it…”[4]

While contracting with Offensive Security as their Operations Manager, Hadnagy saw a gap in the field of Information Security and started to write a five-day course that outlined the principles of how to be a social engineer. After determining that there was very little published information on SE geared to serious security professionals on the web, Hadnagy sought like-minded social-engineers in the InfoSec community. This resulted in a small band of people coming together to formulate the Social-Engineer Framework, which after nine months of hard work, was published at www.social-engineer.org. Along with the framework, the initial core team launched monthly newsletters, podcasts, and blog posts.

After the launch of the framework, Kevin Mitnick’s publisher contracted Hadnagy to write a formal “how-to” manual based on his framework for social engineering. In 2011, Social Engineering: The Art of Human Hacking was published by Wiley Publishing, Inc.

After Social Engineering was published, Hadnagy began to receive calls from companies wanting assistance with setting up SE pentests and training in SE. To accommodate the number of clients requesting these specialized services, Hadnagy launched his present company, Social-Engineer, Inc., with a focus on pentesting the human element of corporate security and presenting a 5-day performance-based social engineering training course. Social Engineering, Inc. employees a team of psychology and social-engineering professionals, as well as researchers and technical staff who focus on security of human networks.

As Hadnagy was establishing himself and his company in the field of social engineering, he developed a friendship with psychologist Dr. Paul Ekman. Ekman coached Hadnagy in reading and using microexpressions, which quickly turned into a passion for Hadnagy. This relationship and passion lead to the release of Hadnagy’s second book, Unmasking the Social Engineer: The Human Side of Security, which was overseen by Dr. Paul Ekman and his associate, Paul Kelly. This second book is a combination of Ekman’s life’s work with Hadnagy’s own; written to build an understanding of how humans are influenced by nonverbal communication.

Over the years Hadnagy has presented and trained at events such as RSA,[5] Black Hat,[6] ISSA[7] and given various presentations for corporate and government clients.

Hadnagy is a certified Expert Level graduate of Dr. Paul Ekman’s Micro Expressions courses, having made the study of non-verbal behaviors one of his specialties. In addition, he holds certifications as an Offensive Security Certified Professional (OSCP) and an Offensive Security Wireless Professional (OSWP).[8]

History with DEF CON

At DEF CON 17 Hadnagy was approached to help start a professional, while entertaining, Social Engineering contest for the popular hacking conference, DEF CON.

General Keith Alexander offers Chris Hadnagy the NSA Director’s Challenge Coin at DEF CON 20.

Hadnagy founded the Social Engineering Capture the Flag (SECTF) competition based on the challenge of creatively and legally raising awareness of the threat SE poses to security. Ethical conduct is strictly enforced and personal/financial information is not allowed to be targeted.[9] Both business leaders and government agencies initially raised concern regarding the type of information that would be gathered and the methods that would be employed to collect it, however, after four years this has diminished as organizations have seen the rules of the contest and its results.[10]

The contest is broken down into two sections: first, information gathering and planning attack vectors in the month before DEF CON and second, a public execution of a vishing attack in the SEVillage at DEF CON.[11] A detailed competition report is released each year which many businesses utilize to help improve their security awareness programs. The SECTF has also researched and reported on the topics of gender in the SE field (showing that women make just as good, if not better, SE’s than men), which industries are most susceptible to SE attacks, and improvements that have been seen in companies successfully targeted in previous years.

At DEF CON 18 Hadnagy and crew launched the first SECTF which broke 18 years of DEF CON history when it became the first contest to receive a black badge its first year. Each year the contest has grown in popularity and size.[12]

In 2011, Hadnagy developed SECTF4Kids for DEF CON 19, which is an event designed to help children learn to use critical thinking skills to solve puzzles, crack ciphers and race other teams against the clock. The SECTF4Kids was created with the intention of teaching younger generations that “social engineering skills can be used for good, that critical thinking is important, and that you can learn to influence others, read body language, pick locks and GET PAID to do it.”[13] The kids contest has a different theme each year but always includes lock picking, solving ciphers, and basic information gathering through the process of objective analysis of information presented. In 2014 the SECTF4Kids was made an official DEF CON event rather than one of the kid’s events.[14]

References

  1. ↑ Chereshnev, Evgeny. "The Best-Selling Books on Security from RSA 2014". KaperskyLab Daily. Retrieved February 2014. Check date values in: |access-date= (help)
  2. ↑ "Elaborate Iranian hacking scheme targets US lawmakers". ITnews. Retrieved May 30, 2014.
  3. ↑ "HR a Hot Target for Cybercriminals". eSecurity Planet. Retrieved June 3, 2014.
  4. ↑ "Reddit, IAmA with Chris Hadnagy". Reddit, subforum IAmA.
  5. ↑ RSA http://www.rsaconference.com/speakers/chris-hadnagy. Retrieved June 4, 2014. Missing or empty |title= (help)
  6. ↑ BlackHat https://www.blackhat.com/html/bh-us-12/training/courses/bh-us-12-training_social-engineering.html. Retrieved June 4, 2014. Missing or empty |title= (help)
  7. ↑ "8th Annual Charlotte ISSA Security Summit". ISSA Charlotte Metro. Retrieved 22 July 2014.
  8. ↑ "Social-Engineer, Inc. _About page". Social-Engineer, Inc. Retrieved 4 May 2015.
  9. ↑ "Social-Engineer.Org CTF Update – Awareness Abounds". Security through Education. July 21, 2010. Retrieved 25 July 2014.
  10. ↑ Jackson Higgins, K. (6/4/2010). "Defcon To Host 'Capture The Flag' Social Engineering Contest No unethical activities or 'damage' to targeted companies or people allowed". InformationWeek: DARKreading. Retrieved 25 July 2014. Check date values in: |date= (help)
  11. ↑ "The Social Engineering CTF – How Strong is Your Schmooze". Security through Education. Retrieved 25 July 2014.
  12. ↑ Smith, Mrs. "Social engineer tag teams to capture the flags at Def Con 22 contest". NetworkWorld. Retrieved 4 May 2015.
  13. ↑ "What the SECTF4Kids is All About". Security through Education. Retrieved 25 July 2014.
  14. ↑ "Kids To Hack Corporate Crime Caper Case At DEF CON". InformationWeekly: DARKreading. Retrieved 25 July 2014.

Bibliography

Books

Print/online articles

Audio/podcasts

External links

Print/online interviews

Audio/video interviews

Presentations/speeches

  1. ↑ "Asgent Announces "Evolving Targeted Attacks and the Reality Behind Human Hacking" Seminar - Learn about social engineering from leaders in the field -". Asgent, Inc. Retrieved 13 June 2014.
This article is issued from Wikipedia - version of the 11/12/2016. The text is available under the Creative Commons Attribution/Share Alike but additional terms may apply for the media files.