Why usual pentests suck?

Martin Žember

May 21, 2019

usual pen-tests

network services publicly exposed
web application itself

Usual pen-tests cover only very limited area and do not bring much value. I am here to show you how it could be more useful.

assignment

an inquiry came to hello@rolken.cz, a very well written document:

“test for us the following:”

network from the outside
social engineering via e-mail
social engineering via phone calls
physical security

I helped my friends at Rolken (a company) with an engagement that I want to share with you. One day, they got a request from a customer who wanted to test:

they obviously knew how to fully test security.

owncloud

logins
- login names leaked via a 0-day
passwords
- too simple

do not mention this (will be funny later): result: planting malicious infections and sending links

phone calls

“Which brand of antivirus do you have installed on your computer?”
“I do not know, but our network administrator is at the end of the hall, I can ask her right away!”
If they said they do not know, we offered them a “tool” that will report to us, which one is it.
“I will upload you the file to owncloud, just run it!”

We talked shortly and asked some other questions and then came the important question:

“Which brand of antivirus do you have installed on your computer?”

“No, that’s ok!” :)

e-mail spear-phishing

job application
probably did not open

a password guessed

Summer2019
gained access to e-mail
intranet

e-mails

what did we find in the mailbox?

which flash drives are allowed
certainly not ours:

intranet

what did we find on the intranet?

security measures
building and network descriptions

how did it look outside

Maps

Wall

trash diving

Trash bin

how to get inside?

lock-picking useless here
guarded all the time, two people at the reception 24/7
cars: camera scanning licence plates + card + human
fence around

sidenote: a lock picture

We travelled with our whole team hundreds of kilometers to our customers building. It’s in the middle of a forest. Usually, there are no people. There is a computer that controls everything. He did not allow us to touch or test that main computer. We waited on some permission to test some optic fibre connection so I wanted to check out what kind of locks they to use the time. And the customer’s workers went out with us and locked us outside and asked: “Show us what you got!” So I prayed and opened it and that was all security – the doors inside are never locked and there was no other security besides this.

getting inside

even though we know so much now and have access to the internal network, the customer wants to know, what

an attacker with skills can achieve
an attacker without skills can achieve

without any information
with some information

what did we achieve

access to owncloud
access to end-user PCs
access to the building
a customer who is happy with the results

summary

customer knew what he wanted
he specified a wide scope of the test
he did not limit us to widen it more
a limited test is not a quality test

the end

nic: pri zmene slajdu zvysit hlas, duraz, dat pauzu, napit se vody, zmenit polohu foto tabule, tam to bude owncloud napisat Jozefovi na nejakem HDD ext. budou videa a fotky, USB flash dat si dolu bryle

Agenda

assignment
owncloud
phone calls
e-mail spear-phishing
a password guessed
e-mails
intranet
how does it look outside
trash diving
getting inside

Why usual pentests suck? Martin Žember May 21, 2019