3 ms·
The author is a well-known (on the twitter-sphere) pen-tester. Despite the childish gif memes and dramatic trimming, I don't think he made it up. But I agree,
by crispyambulance 8y ago
The author is a well-known (on the twitter-sphere) pen-tester. Despite the childish gif memes and dramatic trimming, I don't think he made it up.
But I agree, it seems strange that he didn't succeed.
When corporations hire pen-testers, the set-up is that their CIO/CSO has full knowledge of what is going down and when so that they're prepared to intervene in the unlikely scenario of the pen-tester getting caught.
Knowing the mentality that is common amongst c-level suits, however, it would not be surprising if the suit tipped-off his IT guy in advance. After all, wouldn't catching the well-paid pen-tester look better to the other suits than being utterly pwned and paying for privilege?
The CIO might have successfully "kobiashi-maru'd" the whole exercise. Not saying that happened here, but if large corporations are capable of horrific security breaches, I think they're also capable of trying game the system to avoid things going sideways.
- vharuck 8y agoIf "gaming the system" includes setting up MFA and sensible admin rights, then I'd call the test a good use of time.