Hacking the international RFQ Process killthebuzzwords

Procurement Vulnerability

Large corporate companies issue RFPs and RFQs for security services, often containing classified information like network diagrams and architectural designs.

Public Exposure

Companies issue public RFQs containing confidential and secret information that would typically require extensive enumeration or network access to discover. Information needed for attacks is publicly available through procurement processes.

Attack Surface

Targeting procurement processes exposes a largely unexplored attack surface. Information gathered from RFQs provides extensive confidential details supporting targeted attacks.

Practical Examples

The presentation demonstrates large international organizations failing at RFP/RFQ processes. Attackers often gain access to extensive organizational information supporting attacks likened to insider knowledge without extensive enumeration.