In 2009 I gave a presentation entitled ‘Human 0-Days’ in which I made two very clear points:
- The inherent selfishness of humans is perhaps their most gaping, easily exploitable vulnerability.
- An organisations weakest point will always be it’s employees, due to the above.
To illustrate these two points I performed a demonstration of how a rogue wireless access point could be used to both extract confidential information from associated clients and infect them with malware. Whilst the latter task has remained consistently effective over the past few years, the widespread use of SSL/TLS and HTTP Strict Transport Security has made intercepting readable and usable information somewhat more difficult – at least until now…
