4 ms·

Actually had similar experience pen-testing a large financial institution. Was plotted up in their training room and was circa late 90's and I had a boot flopp

by Zenst 6y ago

Actually had similar experience pen-testing a large financial institution. Was plotted up in their training room and was circa late 90's and I had a boot floppy distro (TRINUX iirc) which had the tools I wanted (tcpdump, nmap...). So quickly turned a training PC into my terminal of choice and mapping the network out and came across an AS/400. Quickly dug out my notes upon such beasts and turned out that the shipping default accounts had not been disabled and was quickly in. Having a look about it turned out very quickly to be a financial system that had nothing to do with the client. Actually seemed to be a case of the system was sharing data and a college of mine soon pointed out that this stunk at not only a security level but more importantly the financial services regulation. We did the report and that whole aspect got swept under the carpet and I was never asked back to that clients site ever again. That's not the worst story of security within a financial service company/bank I've experienced but sure did start to open my eye's how interlocked some companies are with others who you would not expect for numerous reasons. I will say that if you do find yourself in places you wasn't expecting, you do notice and notice pretty quickly and raise questions, also you start to become more mindful - "how easy would it be to social engineer penetration testers to break into a bank for you", it's a thought and more so as they would just need to engineer management to task you such a job. Not aware of that happening, but can easily see how that could be orchestrated.

rebuilder 6y ago
>they would just need to engineer management to task you such a job. I like the idea of social engineering management into hiring pen testers... How large a shadow organization could conceivably remain undetected on the payrolls of a large corporation, I wonder. There's a short story in there somewhere, at the very least.
NullPrefix 6y ago
>and I was never asked back to that clients site ever again. Award for excellence in pentesting.
- Aachen 6y ago
  Some companies need to be tested for legal reasons or because the parent company requires it. It's often easy to tell when you're dealing with one of those from the details being incomplete or coming in late (like get the API docs 7 days into the 5-day test - so we basically didn't test, but we still have to bill the reserved time), but if it's unclear, being a little too happy with an empty report and inviting us to test another thing is another tell-tale. Well, the report is never empty but in general it's not as if you always hit jackpot, sometimes there's a very small attack surface in a black box test (or if it's a black box because your account credentials are still not arranged...), sometimes there's a mostly default install of something and that's secure by default because a lot of people already looked at the project, or sometimes they just did a good job. Not being invited back can be more than one thing. Embarrassing the company is one of the most effective way of losing clients, though. It also doesn't help get issues fixed because the manager will prioritize saving face over anything else, including protecting assets. If you enable them to protect assets without looking bad using good communication... that manager will want you for every test.
coldtea 6y ago
>We did the report and that whole aspect got swept under the carpet and I was never asked back to that clients site ever again. You should have pushed for the opposite, doing the ocassional pentest to the client for life, in exchange for being mum about it.
- texasbigdata 6y ago
  Here’s a contra view. If you had a back bone as a consultant your period 2 report would start with “unresolved issues from last time”, so you would very quickly have to resign due to your ethical baseline not being met. Therefore same outcome.
  - coldtea 6y ago
    >have to resign due to your ethical baseline not being met Huh? Your job is to point to issues, not to ensure they're resolved.

by Zenst 6y ago

rebuilder 6y ago

>they would just need to engineer management to task you such a job. I like the idea of social engineering management into hiring pen testers... How large a shadow organization could conceivably remain undetected on the payrolls of a large corporation, I wonder. There's a short story in there somewhere, at the very least.

NullPrefix 6y ago

>and I was never asked back to that clients site ever again. Award for excellence in pentesting.

Aachen 6y ago
Some companies need to be tested for legal reasons or because the parent company requires it. It's often easy to tell when you're dealing with one of those from the details being incomplete or coming in late (like get the API docs 7 days into the 5-day test - so we basically didn't test, but we still have to bill the reserved time), but if it's unclear, being a little too happy with an empty report and inviting us to test another thing is another tell-tale. Well, the report is never empty but in general it's not as if you always hit jackpot, sometimes there's a very small attack surface in a black box test (or if it's a black box because your account credentials are still not arranged...), sometimes there's a mostly default install of something and that's secure by default because a lot of people already looked at the project, or sometimes they just did a good job. Not being invited back can be more than one thing. Embarrassing the company is one of the most effective way of losing clients, though. It also doesn't help get issues fixed because the manager will prioritize saving face over anything else, including protecting assets. If you enable them to protect assets without looking bad using good communication... that manager will want you for every test.

coldtea 6y ago

>We did the report and that whole aspect got swept under the carpet and I was never asked back to that clients site ever again. You should have pushed for the opposite, doing the ocassional pentest to the client for life, in exchange for being mum about it.

texasbigdata 6y ago
Here’s a contra view. If you had a back bone as a consultant your period 2 report would start with “unresolved issues from last time”, so you would very quickly have to resign due to your ethical baseline not being met. Therefore same outcome.
- coldtea 6y ago
  >have to resign due to your ethical baseline not being met Huh? Your job is to point to issues, not to ensure they're resolved.