3 ms·

More of a b2b context. However, we've had an unannounced pentester achieve RCE on our systems. Not a fun situation. At that point, we were forced by our contra

by tetha 6y ago

More of a b2b context. However, we've had an unannounced pentester achieve RCE on our systems. Not a fun situation. At that point, we were forced by our contracts, and data protection laws, and a CEO aware of all of these, to shut the affected productive system down. We stopped all services, set the firewalls of our hoster to only accept traffic from our office and that's it, while figuring out wtf happened. Those measures overall reduce the situation to a known situation again. If someone in our office is hostile.. that's another issue. After a bit of analysis, we figured out the IPs attacking us and we blacklisted those on the firewall of the other production systems. Eventually things cleared up to be a pentest no one told us about. If the attack had moved into these other systems, we'd have to extend the nuclear solution to those systems too. At that point, we'd have to lockout some 30k+ FTE users. I think we'd be able to make national news with that for our customers. Except.. not good news.

htrp 6y ago
When you say unannounced pentester, how the hell did that happen? Usually, isn't someone in the escalation chain aware of these types of things?
- tetha 6y ago
  A manager at a customer told a pentester to take our system without telling anyone. As simple as that. The pentester did. We axed their system. This was elevated in ridiculousness, because said manager was backpedaling really, really hard after we contacted the pen-testing company as well as the customers senior management. However, all attempts at re-instating the system were swiftly blocked by the customers security policies and security teams. So, the system stayed down for a solid amount of time. After all, the customer insisted on us participating in their security workflows for that system under their security teams control. And from their companies point of view, this was an external hostile attack -- since the manager didn't tell anyone.

by tetha 6y ago

htrp 6y ago

When you say unannounced pentester, how the hell did that happen? Usually, isn't someone in the escalation chain aware of these types of things?

tetha 6y ago
A manager at a customer told a pentester to take our system without telling anyone. As simple as that. The pentester did. We axed their system. This was elevated in ridiculousness, because said manager was backpedaling really, really hard after we contacted the pen-testing company as well as the customers senior management. However, all attempts at re-instating the system were swiftly blocked by the customers security policies and security teams. So, the system stayed down for a solid amount of time. After all, the customer insisted on us participating in their security workflows for that system under their security teams control. And from their companies point of view, this was an external hostile attack -- since the manager didn't tell anyone.