14 ms·
Story of a failed pentest
- asaph 8y ago> I woke up, bloody, in an ergonomic office chair, my hands zipped tied behind me with the same zip ties they used to manage the server ethernet cables. I didn't realize this story was fiction until I got to this sentence. Update: The author confirmed on Twitter that other than the dramatization, this story is in fact true. > And, aside from the beating up and tying down, it was true![0] I can admit when I'm wrong. I stand corrected. [0]https://twitter.com/TinkerSec/status/1063781216128835584 https://twitter.com/TinkerSec/status/1063781216128835584
- icebraining 8y agoRead a bit further; the story is not fiction, only that specific incident.
- asaph 8y agoI read it all before posting here. I assume you're referring to this part: > The DFIR lead leaned down next to my ear and whispered, "No one in Accounts Payable ever runs Powershell..." > Alright... That last part had a bit of dramatization added to it. I interpretted the "last part" to mean the part where the DFIR whispers in his ear. I'm still not convinced this is real. It smells like fiction.
- fourthark 8y agoI read it to mean "next to last part".
- AnIdiotOnTheNet 8y agoI agree, quite a bit of this reads like fiction. The scenario itself suggests an uncommon level of competence, but assuming that's true then the rest is pretty believable for the same reason, if given to some dramatic license.
- blattimwind 8y ago> I'm still not convinced this is real. It smells like fiction. Right? What shop has that good security. Even CRI would be easier to hack, and they're not even on the net.
- jfolkins 8y agoDramatization === Fiction ? Storytelling as a knowledge share is fundamental to human culture. Drama and story refinement are required to make the knowledge easy to remember and spread. As for you being convinced, my personal experience is that this story is entirely believable. Many of us in security have stories we cannot share that would make this one look like a Saturday morning cartoon.
- asaph 8y ago> Dramatization === Fiction ? Certainly not. But at the very least, dramatization decreases the credibility of a story.
- brazzledazzle 8y agoI don’t think so. It’s not hard to distinguish the dramatization.
- jfolkins 8y agoDramatization has nothing to do with credibility. It is a memory facilitation technique. Because you the reader can remove the drama and distill the critical story elements for further inspection of credibility. Credibility is found in the citations, which here is only the story teller. As that is only one data point, I totally understand doubting its credibility because one needs more citations and voices for proof. Further, I never stated I found the story creditable. I was operating from a believability standpoint. Inferring one's experience to weight if the story could possibly be believed. You shared you found it hard to believe based on it's dramatization. Where I shared that I found it completely plausible based on my experience. And that is my main argument, that in this equation drama shouldn't be used as a weight. Positive or negative. Edit: For the folks down voting this. Please don't conflate dramatization with persuaion, propaganda, or fake news. Dramatization is a tool used in those techniques.
- Chazprime 8y agoIt’s dramatized, probably to make something most would see as mundane palatable. There are a lot of specifics for something that’s fictional.
- michaelt 8y agoI was hoping to find out what the blue team should have done in a real incident. Does the blue team tech guy tackle the red team guy and restrain him? Give chase and hope the guy exits through a door with a security guard? Let him leave and hope the cops will care?
- zeroxfe 8y agoThey're supposed to call in physical security. Many companies have security crews that are qualified and authorized to use force (and promptly call law enforcement.) Sometimes these crews are armed.
- deleted 8y ago[deleted]
- SilasX 8y ago<deleted>
- hodgesrm 8y agoI had a programming job in the military where the desktops were in a vault secured with a combination lock. When opening up in the morning you got 2 cracks to enter the combination to the vault correctly. After that people with M16s showed up. That actually happened at least once that I know of, fortunately not to me.
- megablast 8y agoIt is pretty clear that it is not fiction, he even says that.
- iscrewyou 8y agoThat was a good fun read. Especially where they zip tied him. Good change of pace.
- dstick 8y agoMeanwhile 4 put of 5 webshops we check have critical vulnerabilities and half the owners don’t care because “it just costs money to fix it and things have been fine so we’d rather spend more on Adwords” Security, no scratch that - the human psyche works in mysterious ways :) This company seems to run a tight ship though!
- tetha 8y agoWe're a SaaS Shop in europe targeting larger enterprise customers. While there is some funny business dealing with that kind of customers, security actually matters to them. We're currently being paid to implement TLS encryption for our offsite database replications, we might be able to create a customer project to setup tripwire systems. That's fun :)
- blattimwind 8y ago> We're currently being paid to implement TLS encryption for our offsite database replications Amazing. I guess... better late than never?
- AnIdiotOnTheNet 8y agoFrankly, that's an entirely appropriate way to deal with security. You can make the most secure product in the universe, but no one will use it if it takes forever to develop or is unnecessarily difficult to work with. Of course, how much security is enough is a multi-variable problem, but in general I find that "security people", who for obvious reasons want to sell you on security, way over-estimate its value.
- dstick 8y agoOh it absolutely is, and the most humbling thing was realising that I would probably do exactly the same thing in their situation ;-) However as a developer and business owner myself (as opposed to a security person), I genuinely thought more people would be more concerned about the security of their website. I had one person explain to me their XSS injection vuln was intentional because patching it would break some JS plugin.... You see not knowing is one thing, but knowing and being complacent is quite another. But we see that in more areas in life I guess :)
- crankylinuxuser 8y agoOk, wow. That story is pure gold. And when your shop is really on its toes, this is how you run Opsec.
- netsec_burn 8y agoDuring pentests most testers run the usual route of attacking the domain. In my opinion it's not realistic, because most attackers don't attack domains. They attack applications.
- bitexploder 8y agoTrue. Information security criticality migrated to applications a decade ago and never looked back. Internal networks are almost always easy to compromise. We have never failed on a 1000+ entity network. This implies, rather strongly, that you need to silo critical data and protect it at the application later, because the network is very hard for most organizations to secure.
- raesene9 8y agoThat is true but if you can get Domain Admin access, generally getting application access is pretty simple after that, and as getting DA is pretty simple if the domain hasn't been locked down (like the one in the post had), it's a reasonable place to go...
- bitexploder 8y agoThings like 2FA greatly limit the damage of a compromised domain and give defenders time to react.
- raesene9 8y agoI'm a great fan of 2FA for all administrative access. It's not a panacea for sure, but a definite good layer of defence
- flashman 8y agoIT Services mandated a pentest when we wanted to switch our corporate website to Drupal (as part of a battery of exercises intended to convince us to stay with Interwoven Teamsite, which they paid a million dollars a year for). When we agreed, they supplied an external penetration tester with the Drupal superuser password and said, "See? Unsafe!" when the pentester was able to log in and put the site into maintenance mode. I suppose in the strictest sense they were correct: trusting IT with credentials did turn out to be a security issue.
- deleted 8y ago[deleted]
- fulafel 8y ago> On most Internal Pentests, I generally get Domain Admin within a day or two. Enterprise Admin shortly thereafter. Sounds realistic, from how most Windows shops are run. Would it help to stop using AD to manage the IT infra, or have tiny domains (say, max 10 computers) without centralised control, and no company-internal workstation networks? Maybe throw in a rule that devices are recycled (to be wiped) frequently, say every 6 months.
- swiley 8y ago> Maybe throw in a rule that devices are recycled (to be wiped) frequently, say every 6 months. That would be doable if setting up devtools at most places didn't take an entire day.
- fulafel 8y agoThe first choice strategy obviously would be to automate this stuff. Because it's hard to mandate a flag day where everything must be automated, a transitional strategy might be: document each dev setup so well stepwise that you can outsource it to the IT dept or other internal support org. Maybe the dev team can provide a screencast of it, for example. The support org would then have an incentive to automate it to replace manual work, along with a measurable payoff for it.
- swiley 8y agoNO! now the automation has to be maintained and set up. The first choice strategy is to simplify the tools and application! Always with software people there is this tendency to add more abstraction and machinery when encountering complex abstractions and machinery. You only exacerbate the problem by doing this!
- spydum 8y agoContainers help solve this, no?
- Symbiote 8y agoIn a previous job I was asked to use a configuration management tool to automate setup and installation of a development environment. (Never did it though.) This would have been easy on a Linux desktop: installing Java, Maven, an IDE, and changing some settings files for the corporate proxy and artifact repository etc is very basic for Ansible, Puppet or Chef. It's probably achievable on Windows or OS X, although I'm not sufficiently familiar with them. Heavy customization of the IDE could be trickier; the configuration system doesn't necessarily stay very stable between releases. Maybe something that's part of a larger, well-designed system, like KDevelop, would be easiest.
- catacombs 8y agoReally? A Twitter thread? This could have been a blog post.
- progval 8y agoDisable Javascript, you won't even notice it's not a blog post. (After reading your comment I had to whitelist the website to realize it actually was a bunch of tweets)
- cs02rm0 8y agoI could've run "net accounts" on my workstation to query Active Directory directly & see their password policy, but decided to look elsewhere first. I didn't want to set off any alerts or logging. I know nothing about Windows, but I'd have thought checking password policies far less likely to alert than plugging in your own device on the network. Anyway, my favourite bit was that they didn't stop the people in Accounts running Powershell, they just raised an alert. I much prefer that approach to blocking people most likely just doing their job.
- crankylinuxuser 8y agoIf PowerShell and cmd logging is turned on (and I'm sure it is) then seeing net * commands run from a marketing machine is hella bad. Its similar to "HEY LOOK AT ME IM HACKED!" These logging things do get in the way of devs. They run PowerShell after ps... Its not uncommon for MB's a day of log per dev. So if you're wanting to run crap and get away with it, hack a dev machine and bury your commands in there.
- no-s 8y agoSo true. Just write an innocuous automation script that will fail on privs generating massive logs and then use debugging as an excuse when you try to systematically audit capabilities. Often helpful IT staff will open up vulns for ya to put an end to the noise. Of course in many orgs it’s necessary to do this in order to get legitimate work done too...
- asaph 8y agoThis story is also available as a series of tweets in case anyone prefers to consume it that way. https://twitter.com/TinkerSec/status/1063423110513418240 https://twitter.com/TinkerSec/status/1063423110513418240
- deleted 8y ago[deleted]
- dexterdog 8y agoDoes anybody prefer to consume it that way?
- asaph 8y agoIt's actually the original format in which the author published this content. It was auto-converted to the blog style format linked here on HN by https://twitter.com/threader_app https://twitter.com/threader_app. > Want to see some magic? See a thread. Mention @threader_app with the word "compile". Get a reply from our bot with the link to the thread[0] [0]https://twitter.com/threader_app/status/1041712862295666690 https://twitter.com/threader_app/status/1041712862295666690
- joshstrange 8y agoNo, twitter is a trash medium for sharing stories like this. That said a link to the twitter stream in this thread will be useful to future visitors to this HN thread is threader is no longer a thing and/or down.
- ndnxhs 8y agoI had to endure the horror of reading it that way yesterday. Twitter loads incredibly slowly and keeps showing full screen popups to sign up which if you aren't very careful will redirect you away from the page. Why on earth would anyone thing twitter is an appropriate blogging platform.
- megablast 8y agoOh, is that why every single paragraph links to a tweet? What a horrible way to write an awesome story.
- asaph 8y agoThe author confirmed on Twitter that "aside from the beating up and tying down" this is a true story[0]. [0]https://twitter.com/TinkerSec/status/1063781216128835584 https://twitter.com/TinkerSec/status/1063781216128835584
- abledon 8y agoI love reading factual hacker stories that read like fiction. very entertaining. A brutal 5-7 year on ramp of learning what computers actually do on the inside... but understanding what the story about is worth it.
- raesene9 8y agoNice story and a good illustration that a lot of good IT Security isn't buying fancy "next gen" products, it's doing the basics of managing your systems well. It costs more to run IT well, but there are good payoffs, like this.
- teilo 8y agoI would imagine that it was just one of these “next gen” products that identified the fact that Powershell was running on a machine that normally would not run Powershell.
- raesene9 8y agoWhy would you need anything "next gen" for that? Just log use of powershell then have your good old SIEM system alert when it's used by a group outside of the IT dept.
- tomohawk 8y agoThis doesn't seem at all realistic. Tight security and people are actually getting work done? Inconceivable!
- ju-st 8y agoAnd IT has time to check alarms, very unrealistic.
- neolefty 8y agoPlus, budget to hire a pen tester?!?
- Cursuviam 8y agoI mean its consistent with the fact that they actually had good security, thus they're probably not shorting the IT budget.
- marcofloriano 8y agoA bank!
- johann8384 8y agoNah, I've worked with some banks here and there. Amazing lack of security. Can't talk specifics, but yeah, just wow....
- wongarsu 8y agoI think you dropped an /s The security of banks is certainly not in their IT departments.
- kevan 8y agoDepends on the culture. I interned at a place that fell under the Critical Infrastructure Protection program. It was so strict you'd get a visit from security if you tried to badge through a door you didn't have access to.
- sharpshadow 8y agoWonderful:))
- nebulous1 8y ago> I had already tried various things to my own employee laptop, but I was not local admin and the disk was fully encrypted. Hang on, if he can boot his laptop does it not follow that he has the necessary information to decrypt the drive?
- medlazik 8y agoHe means he can't put the disk in another machine to get the good stuff
- viraptor 8y agoProbably standard bitlocker. You get decrypted drive automatically, windows can use it, but you only get access to your files, and you can't decrypt and not boot windows. You have to hack local admin for that.
- Buge 8y agoBecause of the TPM right? If you use bitlocker without a TPM you could boot to a live Linux USB and decrypt the bitlocker drive with dislocker.
- org3432 8y agoThe problem I have with pen tests is that they're not systematic and rely on the cleverness and knowledged of the tester. Even if they identify an issue, it's often hard or impossible to ensure it doesn't regress, and if it's an inhouse or custom software they've never seen before they likely won't be of much help without a lot of effort. I think one step forward would be also approaching security the same way epidemiologist track down causes of diseases. In that they take patient data and trace back the factors that caused it, just instead of patients we're talking about security vulnerabilities and breaches. Having a corpus of causal diagrams that then we can develop software to analyze risk factors that we can then systematically test for.
- dstick 8y agoI agree and from a purely rational standpoint you are correct. However in my experience the main benefit of a successful pentest is to achieve a change in culture and the perception of security of staff across the entire workforce where before it was deemed “taken care of” or non-important. In short, people won’t change before shit has hit the fan, and a pentest is the closest you can get to a controlled shit-hit-fan situation without it being a meaningless drill :) How, and what is uncovered is besides the point and merely secondary when viewed from that perspective.
- dmix 8y agoSo basically tracking "business-as-usual" attacks (probably 99% low-tier, low effort attacks that didn't go anywhere) or serious attack examples on other companies isn't going to change the culture. But a full blown, highly skilled attack, with a fully dedicate adversary, specifically targeted at your business and business value, with potentially devastating consequences - will do a better job of waking people up?
- jfolkins 8y agoI think it depends on what your objective is. Strictly helping quanitfy technical and personnel risk? Grey all the way. Getting the C-class to understand what a worst case scenario could be from a completely external threat. Black drops the most jaws. Ultimately the later is a cultural hack. The absolutely hardest hack of all in my opinion. A way to get the herd moving in a different direction. So it depends on what you are "hacking."
- gtsteve 8y agoGreat story, but I wouldn't call it "failed" because it showed that the company has really good security procedures. I don't know many companies that could have resisted this sort of internal threat. I've had pentests that found nothing before but I had logs full of attempts to compromise the app, including in some ways I'd never even heard of before. I didn't consider them to be failures either.
- stevewillows 8y agoThe author did find a weakness with Pam giving out her MFA token over the phone. It didn't yield anything beneficial in this scenario, but it was still a point of weakness. Also, while its good that they busted him based on the powershell use, I'm surprised that they didn't install the listener on an IT system, since he had a short window in their office. If the author disguised as a cleaner, they most likely could have talked their way out if they were caught. Years ago an office I was working in was 'broken into' by a former locksmith that had since taken a job with our main competitor. I knew something was fishy based on the specific towers that were stolen (yes, they stole complete hardware...) -- one from payroll, another from sales, etc. The systems were spread out across the office, so it wasn't a simple snatch and grab. At first glance it looked like the server room door had been picked or kicked, but looking at the damage itself, the damage was completely superficial, if not lazy. I even Hollywood kicked the door myself to see if it opened, and nothing. After checking some security footage, someone recognized the locksmith -- which later revealed that he quit a few weeks earlier and had been working for the competitor.
- marcofloriano 8y agoI'm very suprised they didn't have scurity cams at the IT office. When he breaked in, i thought that was the end of story.
- PhasmaFelis 8y agoMost security cameras aren't monitored 24/7. It's just not practical. I'm sure they would have gone back and checked the tapes eventually, but as it happens they caught him before reaching that point.
- deleted 8y ago[deleted]
- progval 8y agoI must be missing something; but why not plug keyloggers on IT's computers?
- _underflow_ 8y agoI believe the thing you're missing is known colloquially as 'antivirus'
- dlgeek 8y agoI think GP was referring to a hardware keylogger - antivirus wouldn't help.
- njharman 8y agoYou are missing "having read the article". #1 MFA, IT computers never left unattended/accessible, even IT accounts had minimal permissions, "IT like" behavior on non-IT computer caused alert (so even if they got past all the above they would have got caught when they used, like the OA did). Finally placing and retrieving physical devices/physically messing with machines is risky and luck based. It would be one of the last things you tried. As it was in the OA.
- Jolter 8y agoIf IT are using laptops, their USB ports will be quite visible to the user and a new dongle will stick out like a sore thumb.
- floatboth 8y ago> hauling armloads of old laptops from the IT shack to my cubicle, a small Leaning Tower of Pisa forming under my desk that sounds more unrealistic than properly protected Windows systems tbh. New marketing employee hauling lots of laptops, no one noticed? Like, people that work nearby might've noticed that?
- freeflight 8y agoIt was in the middle of the night after even the cleaning crew left. Tho, I don't know how he managed to carry 30 of them in one go, or what he did with them after he left. I guess the number is a bit dramatized.
- Jolter 8y agoI didn't see mention of doing it in one go. I presumed he went at least three times.
- Miredly 8y agoIt specifically mentions that he waited until late at night after everyone went home.
- jnwatson 8y agoIt was after hours...
- deleted 8y ago[deleted]
- T3RMINATED 8y agothat is why i always use a pencil, more durable than pens.
- nubb 8y agoAs a security student, reading his methodology was invaluable.
- sizzle 8y agoSo if he ran the powershell at midnight he could have potentially gone unnoticed until the IT guys got back in the office? What if this was a global Corp, would someone be monitoring this 24/7 across timezones? What kind of damage could he have done if he had, say, 1 hour of unfettered access?
- flerchin 8y agoSmells like a CISO suck-up job. Doesn't mention that the developers are paralyzed and unable to work.
- ascar 8y agoHe should've joined as a dev instead of marketing. Access to so much more systems to begin with.
- darkhorn 8y agoHis dev coworkers would ask him dev questions and look up his online identity.
- deleted 8y ago[deleted]
- purplething 8y agoObviously fake. It's set up in the US, and yet nobody gets shot.
- chmars 8y agoHow did they even notice Powershell?
- diminoten 8y agoEndpoint detection picks up stuff like this all the time.
- itomato 8y agoStory of a failed pentester, perhaps? Social engineered their way into an unlikely scenario bound to raise suspicion. Tests and methods were pretty successful, otherwise. Still, I cannot fathom why companies insist on the rickety tinkertoy that is Microsoft Windows.
- badrabbit 8y agoExcellent reading. In my experience,internal politics is the greatest threat against companies. Most of us here can walk into most companies and engineer end to end encrypted,least access,zero trust,mfa authenticated network using strictly foss tools and methodologies. Question: Who will let you? No joke,OP wasn't exaggerating about how easy most of his pentests are. Most companies throw money at it,do risk analysis and say "hmm,this is enough,a compromise is tolerable". IMO, when it rains,it pours. Risk analysis only tells you what the risk is based on known data. Unknown unknowns will be your doom. Best to build things right even without an incentive.
- nunb 8y agoIt would be interesting to see the MacOS version of this story, say hacking an office full of Macs, like a Digital Agency or something...
- quantum_state 8y agoNice story while educating people on security ... Thanks!