6 ms·

Great story, but I wouldn't call it "failed" because it showed that the company has really good security procedures. I don't know many companies that could have

Great story, but I wouldn't call it "failed" because it showed that the company has really good security procedures. I don't know many companies that could have resisted this sort of internal threat. I've had pentests that found nothing before but I had logs full of attempts to compromise the app, including in some ways I'd never even heard of before. I didn't consider them to be failures either.

stevewillows 8y ago
The author did find a weakness with Pam giving out her MFA token over the phone. It didn't yield anything beneficial in this scenario, but it was still a point of weakness. Also, while its good that they busted him based on the powershell use, I'm surprised that they didn't install the listener on an IT system, since he had a short window in their office. If the author disguised as a cleaner, they most likely could have talked their way out if they were caught. Years ago an office I was working in was 'broken into' by a former locksmith that had since taken a job with our main competitor. I knew something was fishy based on the specific towers that were stolen (yes, they stole complete hardware...) -- one from payroll, another from sales, etc. The systems were spread out across the office, so it wasn't a simple snatch and grab. At first glance it looked like the server room door had been picked or kicked, but looking at the damage itself, the damage was completely superficial, if not lazy. I even Hollywood kicked the door myself to see if it opened, and nothing. After checking some security footage, someone recognized the locksmith -- which later revealed that he quit a few weeks earlier and had been working for the competitor.
marcofloriano 8y ago
I'm very suprised they didn't have scurity cams at the IT office. When he breaked in, i thought that was the end of story.
- PhasmaFelis 8y ago
  Most security cameras aren't monitored 24/7. It's just not practical. I'm sure they would have gone back and checked the tapes eventually, but as it happens they caught him before reaching that point.
  - isostatic 8y ago
    Detect door opening, post the image to the slack channel. Or don't jam the door open in the first place.
    - askmike 8y ago
      Who would be watching that slack channel with a dozen of pictures per week? Or would the bot be spamming the pics in #general?
      - isostatic 8y ago
        “Visitors since we went to lunch” should be “none”
        PhasmaFelis 8y ago
        This is starting to sound more fiddly than is reasonable for inside security on a corporate office. The real failure here is just that someone left the door propped open. That's easily addressable, and as it turned out, they caught the attacker anyway.
    - njharman 8y ago
      I thought that was gonna be a trap/honeypot. They detected weird behavior so set that up to see if anyone would take bait.
  - chaostheory 8y ago
    They don’t need to be monitored by a person 24/7. All you need is a decent video analytics; most are even built-in IP cameras these days. A simple one that’s effective just detects motion within a zone during certain hours
wglb 8y ago
From the perspective of a onbtestee, if you didn’t get the goods it failed. There is little more frustrating than getting a gooose egg in a pentest. Blue team, not so much
baby 8y ago
Let's be honest. No company would have resisted this sort of internal threat. This is either fiction (which it sounds like it is) or this is just a lack of time. The difference between pentesters vs real hackers are that hackers have as much time as they want.
- corndoge 8y ago
  I agree this reads like fiction. Strange capitalization, and no technical person I know or know of would write this way; it all seems very cavalier and not the careful writing of someone who actually does this for a living. Not that I know better.
  - CPLX 8y ago
    It’s a twitter thread, it’s worth noting.
  - detaro 8y ago
    The style seems fairly normal for public stories from that type of work.
  - emmelaich 8y ago
    I found this odd: > spent some time hunting the Domain Controller The DC address(es) are trivial to find.
    - crankylinuxuser 8y ago
      They can be. But here's the problem: You have a GPO that turns on command and ps logging. Ok, so if you type those commands, you alert script logging engines. And then you search how to find the DC: https://serverfault.com/questions/78089/find-name-of-active-directory-domain-controller https://serverfault.com/questions/78089/find-name-of-active-... It's all PS or cmd. Trapped. You might find the DC listed in the registry if you look for key "DCname". However again, that's another thing you'd use app whitelisting for, and catch every invocation of regedit. A lot of unattended driveby attacks attempt to do bad things here, so you catch/trap them. Again, dead end. So, I'd love to see a good walkthrough how to find the DC if these avenues don't work.

stevewillows 8y ago

The author did find a weakness with Pam giving out her MFA token over the phone. It didn't yield anything beneficial in this scenario, but it was still a point of weakness. Also, while its good that they busted him based on the powershell use, I'm surprised that they didn't install the listener on an IT system, since he had a short window in their office. If the author disguised as a cleaner, they most likely could have talked their way out if they were caught. Years ago an office I was working in was 'broken into' by a former locksmith that had since taken a job with our main competitor. I knew something was fishy based on the specific towers that were stolen (yes, they stole complete hardware...) -- one from payroll, another from sales, etc. The systems were spread out across the office, so it wasn't a simple snatch and grab. At first glance it looked like the server room door had been picked or kicked, but looking at the damage itself, the damage was completely superficial, if not lazy. I even Hollywood kicked the door myself to see if it opened, and nothing. After checking some security footage, someone recognized the locksmith -- which later revealed that he quit a few weeks earlier and had been working for the competitor.

marcofloriano 8y ago

I'm very suprised they didn't have scurity cams at the IT office. When he breaked in, i thought that was the end of story.

PhasmaFelis 8y ago
Most security cameras aren't monitored 24/7. It's just not practical. I'm sure they would have gone back and checked the tapes eventually, but as it happens they caught him before reaching that point.
- isostatic 8y ago
  Detect door opening, post the image to the slack channel. Or don't jam the door open in the first place.
  - askmike 8y ago
    Who would be watching that slack channel with a dozen of pictures per week? Or would the bot be spamming the pics in #general?
    - isostatic 8y ago
      “Visitors since we went to lunch” should be “none”
      - PhasmaFelis 8y ago
        This is starting to sound more fiddly than is reasonable for inside security on a corporate office. The real failure here is just that someone left the door propped open. That's easily addressable, and as it turned out, they caught the attacker anyway.
  - njharman 8y ago
    I thought that was gonna be a trap/honeypot. They detected weird behavior so set that up to see if anyone would take bait.
- chaostheory 8y ago
  They don’t need to be monitored by a person 24/7. All you need is a decent video analytics; most are even built-in IP cameras these days. A simple one that’s effective just detects motion within a zone during certain hours

wglb 8y ago

From the perspective of a onbtestee, if you didn’t get the goods it failed. There is little more frustrating than getting a gooose egg in a pentest. Blue team, not so much

baby 8y ago

Let's be honest. No company would have resisted this sort of internal threat. This is either fiction (which it sounds like it is) or this is just a lack of time. The difference between pentesters vs real hackers are that hackers have as much time as they want.

corndoge 8y ago
I agree this reads like fiction. Strange capitalization, and no technical person I know or know of would write this way; it all seems very cavalier and not the careful writing of someone who actually does this for a living. Not that I know better.
- CPLX 8y ago
  It’s a twitter thread, it’s worth noting.
- detaro 8y ago
  The style seems fairly normal for public stories from that type of work.
- emmelaich 8y ago
  I found this odd: > spent some time hunting the Domain Controller The DC address(es) are trivial to find.
  - crankylinuxuser 8y ago
    They can be. But here's the problem: You have a GPO that turns on command and ps logging. Ok, so if you type those commands, you alert script logging engines. And then you search how to find the DC: https://serverfault.com/questions/78089/find-name-of-active-directory-domain-controller https://serverfault.com/questions/78089/find-name-of-active-... It's all PS or cmd. Trapped. You might find the DC listed in the registry if you look for key "DCname". However again, that's another thing you'd use app whitelisting for, and catch every invocation of regedit. A lot of unattended driveby attacks attempt to do bad things here, so you catch/trap them. Again, dead end. So, I'd love to see a good walkthrough how to find the DC if these avenues don't work.