5 ms·
It doesn't tell you how they infiltrated to begin with so that they can sniff cookies and keystrokes. But my guess is they phished an employee. Edit: I missed
by badrabbit 7y ago
It doesn't tell you how they infiltrated to begin with so that they can sniff cookies and keystrokes. But my guess is they phished an employee.
Edit: I missed that part,sorry.
- pvitz 7y agoHe explicitly mentions how he exploited it and that at the same time, somebody else tried to phish...
- bowmessage 7y agoShe!
- deleted 7y ago[deleted]
- cookie_monsta 7y agoThis is not a hill that I am willing to die on, but when was gender decided? Everything I've read up until now has kept it ambiguous: https://mobile.twitter.com/DDoSecrets/status/1196216685038129153 https://mobile.twitter.com/DDoSecrets/status/119621668503812...
- bowmessage 7y agoSorry, didn't mean to turn this into a hill at all :) It was called out in the pastebin in the comment originating this chain.
- Lyrex 7y agoIf my memory serves correctly then she said something along the lines "I'm just a girl" in the writeup pastebin.
- cocochanel 7y agoStated in the readme file, "I was a girl raised by the internet."
- deleted 7y ago[deleted]
- _wzsf 7y agothey.
- badrabbit 7y agoXe?
- Krustopolis 7y agoMaybe. Or just good OpSec?
- phyzome 7y agoShe says she's a woman. We don't need to go into convoluted conspiracy theories to deny someone their reported gender.
- goatsi 7y agoI thought it was pretty clear. They had already developed a Sonic Wall VPN exploit. They used zmap to scan for vulnerable devices then grepped the hostnames for "bank". When they exploited the VPN it gave them the whole network. >In this case, on the other hand, it was the same Windows domain passwords that were used to authenticate against the VPN, so I could get a good user password, including that of the domain admin. Now I had full access to his network
- badrabbit 7y agoYou're right, I tried to skip the rest and find the technical part but missed it.
- tetha 7y agoTo me, the scary part about this is: After Equifax, this is another big hack... and practically, it's one layer of defense and that's it. Shellshock, one password, everything's fucked. And yes, expletives are appropriate there. The rest is largely access maintenance, keyloggers and execution. That's scary. Maybe I'll need to badger my boss about a serious pentest of everything.
- Avamander 7y agoPentesters don't drop 0-days though, but yes, it shouldn't be one layer of security to bypass.
- q3k 7y agoDepends who you hire and how much you pay them :).
- badrabbit 7y agoDude, forget a pentest, have a security architect look things over. Simple segmentation and endpoint firewall witha good edr might have stopped this. Everyone misses the basics, a lot of networks were pieced together 10+ years ago when people were not as security conscious as they are now.