Penetration Testing...from the inside...

I find this thread intriguing. I also have occasion to bring certain flaws to the IT Manager's attention since I wear the security hat. My favorite was the one that let me create a PO and then gather all necessary approvals to order whatever I wanted all while bypassing the normal email notifications. His reaction was mixed. Partly wow, that's bad. I'd better fix it. And at the same time his comment was something like, "but nobody else here is as cunning as you so they'd probably never figure it out." It's a good thing I'm a trustworthy kind of person or I could have quite a shopping spree. :-)

Quote:

---

His reaction was mixed. Partly wow, that's bad. I'd better fix it. And at the same time his comment was something like, "but nobody else here is as cunning as you so they'd probably never figure it out." It's a good thing I'm a trustworthy kind of person or I could have quite a shopping spree. :-)

---

Yep... I know this too well too. Always something like:

"But who here is smart enough to figure that out?"

or

"We've never had any problems before... why would we now?"

What do they call that? Security through obsecurity...

Thats exactly what I say after I hear that...

I'll press on until its fixed though... But then again... I'm in a position where I can do that.

If we were to get some temp to come in and do that... it'd be a different situation.

Technically... they *shouldn't* have been poking around in the first place.
Regardless of if they were just trying to help out... it wasn't their place to do so.

You gotta love politics...

I'm having the same problem at the college I'm attending. By messing with the DHCP settings anyone can get past the firewall. Also like embro1001 said, by using a A HREF tag you can get to any part of the hardrive you want, thanks to notepad. Not to mention the available "jump to URL" in Internet Explorer's Help, letting anyone look where ever they want.

I have failed to mention these holes to the lead administrator here, for I think he would become quite angry(Judging by one of his speechs, he seems very cocky). I was going to use anonymous remailers to email him but I changed his mind.

Just makes me wonder if I'm the only one finding these holes and if not why no one else has discovered them and fixed them in the past. They are not that hard to find.

I'm staying anonymous till the end. No one knows I even like(or love) computers, and I want it to stay that way.

Cheers

Also:
"net stop Norton AntiVirus Auto Protect Service" always works like a charm.

Part 3:

Part three deals less with the third tier of my Company's system: the kiosks. This Part is less to do with the bypassing of the system, and more with the sensitivity of the information availible through these machines.

The informatio kiosks are basically Dells with a touch screen, slimmed-down keyboard, and credit card reader. The computer is set to autologin, and then start the kiosk program, which appears to be a combination of VB and flash.

The keyboard on the system is missing several vital keys: Control, Alt, Escape, etc. On top of this, any type if shift-click is disabled. These things are basically locked down.

Like the rest of the machines on the network, I assumed these guys would be running VNC. I was able to confirm this by first looking up the computers' names in My Network Places (easy naming scheme equals easy identification), and testing it by launching the VNC viewer.

The machines did in fact have have VNC running, and as the others, also used the same password. After logging in, I used VNC's "Send ctrl-alt-del" to kick the computer into the Windows Security/Logon information screen. The Task Manager, change password, etc were disabled, leaving only "Cancel" and "Shutdown". I chose Shutdown -> Log off. As the computer relogged in, I hit the Internet Explorer button on the Quick Launch, and kept clicking the Start Menu Bar to keep it in the foreground.

From here I was surprised to find that the kiosks had an active connection to the Internet. I could go anywhere I wanted. After watching some Homestarrunner, I decided to see what else was on the network (by now, I had gone out the physical machine, rather than continue my VNC session). After some prodding, I made my way to yet another Shared Folder...

It was a treasure trove.

This folder held all sorts of information: Upcoming releases, Accounting information, Phone Numbers w/Extensions, PBX numbers and corresponding names, etc. On top of all this, there was also a brief manual outlining the specifics of the kiosks, including all OTHER usernames and passwords, as well as logon information for the databases.

From then on, I no longer had to VNC to bypass the kiosk program; I could get on just fine using my new found passwords.

Sensitive information like this should not be stored on a server accessible to the general public via a public computer. Even though a person might not have access to VNC to initiate this process, I discovered that it was not needed.

Under the supervision of department manager, I demonstrated how easy it was to bypass the locks containing the actual computer. Inside the bottom compartment was a keyboard and mouse, ready for anyone's use.

All information was given to the proper people, although nothing has been done to rectify the situation.

Please, if anyone else has had similar experiences, I would be much pleased to hear them.

yes, vnc is like a good/hell too for sysprogs:

Guys start to use VNC to control servers, after start to set "standards" for passwords, and when we see, all systems security is gone....

When you show this kind of information to unprepared people, usually 2 things happens:

1) they do NOTHING to repair ("no one will do what you did")
2) They will try to cover the steps, starting to shoot the messenger (A.K.A. you)

When doing (with a group) an auditing that INCLUDES (on a contract) penetration tests, we were amazing that:

a) switches passwords (for administration) are equal vendor name (like "cisco")
2) Linux box permanently running "sniffers" tools, with root password easy to guess (like "admin")
3) device snmp managed with snmp password (r/w) as "public"
4) users on Windows AD that as "administrator" status on their machines ("they need....")

Guess that.

- With a regular user, we managed to configure switches to "port copy" to linux box (that guys with me got root access on 3rd. attempt) and run sniffer at network
- Sniffing windows packets told nothing about security at 1st time, but we didnt need: telnet for mainframe was in clear text and we got all password thru that :)
- and other "dumbass" configs leaded us to every place on intranet
- after report was presented:

[us] your system present some serious security issues that we advise to be promptly corret
[customer] such as?
[us] Like linux box running sniffer tools with weak security
[customer] but we need that
[us] for?
[customer-it guy] to verify potentially performance problems...
[us] (after some seconds to recovery...) but all the time?
[customer-it guy] yes, we cant deactivate them
[us]....
[us] and about snmp passwords?
[customer - i t guy] it inst a threat- noone cant do anything thru snmp
[us] wtf? (thinking, not speaking)
and so on
Customer didnt change anything and paid us for the audit services...

Arrggh. I just don't understand it. When presented with the opportunity to remedy a previously unknown problem, certain IT-peeps choose to ignore it. Is it because they are stuck up?

My answer - probably not.

The problem appears to stem from either ingorance, or the overall complexity of a system. I know for a fact that the people at my company do not think what I've revealed to them is a security risk, but at the same time, I'm not so sure they would react very quickly if they did.

Granted, they did solve the "superuser" exploit explained in Part 1 within the week, but that should not have taken more than a couple minutes to do.

The vulnerability presented in Part 2 could have been prevented entirely if they did not A) shared the serving folder, and B) give me write access to the drive.

Part 3 could have been avoided by not mounting the remote drive on my computer as a shared network drive.

Quote:

---

yes, vnc is like a good/hell too for sysprogs:

Guys start to use VNC to control servers, after start to set "standards" for passwords, and when we see, all systems security is gone....

---

I totally agree here. In almost every VNC setting involving more than a few computers, the passwords were either identical, or used a naming scheme based on the location of the computer. This is done mainly out of convenience. I mean, who want to create and control hundreds of individual VNC passwords?

You need to understand.... There are two levels in most companies.... Those who are _thought_ to know and those that rely upon them at a management level.....

Now, with respect to those that are _thought_ to know:-

1. They don't always know.
2. Sometimes they know they don't know, sometimes they don't.
3. If they know they don't know then they are actively deceiving those who rely on them.
4. If they don't know they get scared when it is presented to them because they know they don't understand the concepts.
5. Both have an interest in preserving their employment status.
6. Both will screw over anyone they can by lying to those that trust them to preserve said employment status.

With regard to those who rely upon those that are _thought_ to know:

1. They trust them.
2. Start talking technical to them and they go glassy eyed......
3. When glassy eyed they revert to 1. above.

'Nuff said...... :rolleyes:

If you report a risk there are three results.... They fix it because they know how... or they don't because they don't know how ... or fixing it means more work for them and they don't think that anyone else will come up with the "exploit".

Report it to their boss because it is _really_ a security risk and they run to the boss and nail your cute little rear to the table.....

Either way you either get nothing or a fresh chance at an employment opportunity.....

In bigger organizations you will find someone who cares in a position of power.... S/He's what you have to find... They have to have the "ears" of the directors and be trusted by them. If you can find them then you have a chance.... In many other organizations.... forget it.... they are too busy doing what they have to do to keep their job to care.... until it bites them.. you know where....... Unfortunately, by then your complaining has got you the spanking new employment opportunity and they wish you hadn't taken it....... :rolleyes:

It's called...... Life......

At the end of the day all a business's, any business. Is interested in, is making money.
So if they have to spend money, they look to see if they can recover that expenditure. If they can not, they will not spend it. End of story.

Have you heard of risk assesment? basic stuff. If it costs 250000000000 to impliment and jack **** to ignore, including litigation. Guess what, it ain't getting done.

Quote:

---

Originally posted here by jinxy
At the end of the day all a business's, any business. Is interested in, is making money.
So if they have to spend money, they look to see if they can recover that expenditure. If they can not, they will not spend it. End of story.

Have you heard of risk assesment? basic stuff. If it costs 250000000000 to impliment and jack **** to ignore, including litigation. Guess what, it ain't getting done.

---

True that. I suppose spending time to...say...disable write permissions from a folder that, in my opinion, has no business being shared in the first place would be too time consuming.

There is no reason that the root folder of the server hosting the corporate intranet site should be shared with computers having full permissions to change all (once again...in my opinion...which apparently does not mean much).

And as far as the VNC thing goes, I admit there is no fiscally feasable way to come up with several hundred individual passwords and keep them safe without storing themall in a centralized location (which pseudo-defeats the purpose of making them different). If you were to store all the passwords in a database or file, then once access was gained, all the computers would be vulnerable. The plus to this option is that, as it stands, if you know one password, you pretty much know them all, whereas randomizing them would prevent you from knowing any other's password but your own.

I dunno... part of me says that I should have just let them live in ignorance, and let them suffer the consequences, and another part of me wants to make sure they don't do the wrong thing, even though they very well might. I feel like a parent with a teenage son....holy crap. :eek:

This is an excerpt from my online journal... the conclusion to the story:

Well... today was the day. Today was the day I went public.

As many of you know, I'm a bit of a computer-person. Using my knowledge and inside information, I was able to gain partial access to the The Company network. And by partial, I mean... well... it was a lot.

So today I wandered into The Company with the intent of buying a magazine or something. I then walked over the kiosk, and decided to try something. Using methods I like to pretend that only I know, I managed to get access to the command line, and from there, I was on the network.

Now, The Company uses a cool little program that, when installed on a remote computer, allows someone else on the network to connect and use it as though he was right in front of it. Using miscellaneous passwords which I had acquired earlier, I gained access to a random computer, one which happened to belong to a higher-up person on the corporate food-chain (apparently the store's boss's boss). Well, I opened up Notepad and started typing to him.

I talked about the overall security of the network, as well as possible things which could happen if not protected. I was very careful to say what could happen, so that he didn't think I had actually done them, because in 90% of the cases, I didn't.

He asked where I was, and I didn't tell him, but I informed him that the POS (the programmers/system admins) could find me quite easily. He called them up, and informed me that he was doing so. He was actually a very nice guy - we talked about a number of things... it was funny to watch. He was trying to narrow down my location by asking me things about The Company which were only going on in the test markets. I was, for the most part, truthful with him. In every matter regarding the security of the system, I told him the truth the best I could without comprimising my identity. For the other questions (where I was, how I was doin this right now) I threw out random things. I figured he'd find me eventually, so I might as well buy myself some time.

After a good our of conversation, he informed me that POS was on the phone with him, and wished to ask some questions. I answered them the best that I could. Not 5 minutes later, the GSM on duty got a call from POS. Employee_1 informed me, and I promptly left the building.

I went and grabbed some food at Taco Bell. I went back, because I forgot to buy what I went there to get (I remembered it was CD-Rs). When I got there, all of the kiosks were down (shut down remotely) and Employee_1 and Employee_2 (two of the three associates who knew what I was doing) were in the back (presumeably filling out an incident report). I called Employee_1 later, and she informed me that she couldn't talk to me about it. Looks like someone is taking legal action.

I talked to Employee_3 later tonight, and gave him a rundown of what just happened. He called Employee_1, and informed me that Employee_1 can't talk to anyone about it, or she might be prosecuted. I tell you, friends, the **** has officially hit the fan.

Soooo... I might not be able to use computers for a while.... I might be going to federal pound-me-in-the-ass prison... or they may offer me a job. I don't really know. I'm guessing it's one of the first two. Or both.

Hopefully they'll wait until morning to get me. I'd rather be arrested at school than at home... more publicity.

So, friends, I'll keep you informed as best I can. I regret that I ever helped them, now.... especially if they're going to go all law-ish on me. I'd rather settle this out of court. IT'S BEEN GREAT KNOWING YOU ALL! I can safely say that if I don't write anything by 11:59 tomorrow night, I'm in jail.

I thought I'd give everyone an update...

Since my little escapade, a few things have happened.
1) I didn't go to jail.
2) Some guys from corporate flew up and had me re-explain how to fix everything.
3) The FBI pulled me from class and had me re-re-explain everything.
4) The Feds said I'd have a record, but it would be recorded as a "white-hat", since no damage was done, and I was extremely cooperative.
5) I got a job as a programmer for a web-dev company. Fun stuff.
6) I'm looking for a job as a real programmer (not web-based)... anyone with any info should give me a shoutout.

Cheers,
Mase

Hi

I won't call you an idiot! I don't think I have to!

If you had

1. Written to your manager along the lines of, I think there might be some security flaws on the system, can I investigate over the next two weeks?

and

2. YOur manager wrote back saying 'Yes'

then

3. YOur rear end would have been covered and

4. You would submit a formal report to your manager and having written it up as a blog as well

5. You could have leveraged your experience into getting a job a security firm regardless of whether your company took your advice or not and

6. You wouldn't have a record!

Perhaps you should practice your reading skills. If you'd actually looked over the posts, you'd see that I had written up formal reports (twice). The corporate guru's didn't respond. (Managers have no power over this nation-wide network.)

I have no excuse for my stupidity, and I won't try to say it was anything other than idiotic, but things don't fall into place like this beautiful dream situation of tenzenryu's.

I'm not particularly worried about my rear; I have enough character references and there were enough employees with me during the act that, if anything should happend, I could take half the store down with me.

I'm also not worried about "levereging my experience" to get into a security firm... I'm no pen-tester, just a programmer.

My record's worked to my benefit so far. The two FBI agents that visited my school suggested that I try to work for the FBI or NSA. While the level of my "hack" is nowhere on par with the skill required, they noted my persistence and curiosity (as well as lack of malicious intent), and said my record would in no way effect my getting a job there (at the FBI at least...).

Cheers.

You did exactly what I would have done......

Respect.....

Hi

I didn't say it would work, I said get permission first before doing anything. If you don't then you are just asking for it. You could even go for permission through ommission e.g

" Dear corporate zeebad,

Please find attached a formal report on some current security weaknesses I have come across by accident in your network. I consider that these represent a serious threat to our company's security. I wish to pursue the matter systematically to ensure that I have covered all the bases. I will take it that unless you reply to me by Friday, that this is Ok with you. My full report on the matter will be ready in 4 weeks time. I personally guarantee that I will not take an exploitative approach to any vulnerabilities I uncover but I will fully explore and document them.


Yours sincerely

etc"

If the guy doesn't pay attention to you, then he also doesn't have a leg to stand on.

I'll remember that for next time.

Quote:

---

I will take it that unless you reply to me by Friday, that this is Ok with you.

---

If this still turned into a legal issue this wording would prve to be useless. Taking action on something because of a negative situation, (no response), does not mean you have been permitted.

Much respect Embro. By being open with both the corporation and FBI, you proved you had no malicious intent - therefore no crime was committed. Sometimes top-end execs need a sound slap in the face to wake them up to underlying problems, most especially involving computer security.

Don't sweat either civil or criminal action against you - without malicious intent that bird won't fly.

I really wasn't to worried... the two agents that pulled me out of class assured me that the odds of anything happening were very slim (to quote: "Unless someone has a wild hair up their ass, in which case, we'll go in to bat for you"). One of the agents was head of cybercrime in my area, and he seemed to get a rise out of the level of insecurity of the company (he didn't justify my actions, but he was quick to agree that those security issues shouldn't have been there).

So all in all, I'm no worse for wear... I don't think I'd do the same thing twice, however. It was a fun (albeit reckless) learning experience, and from it, I carry away some new knowledge, and an FBI business card (as a keepsake).

[Edit]
Another thing that helped, I think:
During my "questioning" (interview?), they asked if I posted my methods online or shared the information with anyone. I had a chance to tell them about AntiOnline, the Online Security forum, where "experts (and others) from all over the world share their internet security experience" (not an exact quote, but it looks better that way). Having it available online, posted for discussion and debate (while trying to keep the Company anonymous) in a scholarly didn't hurt my situation.