Slashdot Mirror
The Spy in Your Server Room
CorinneI writes "Your business's private information may not be as safe as you think — especially when you take into account how many people pass through your office's revolving door on a daily basis. That's why many companies hire TraceSecurity employees to test the security of their systems — operations that usually involve TraceSecurity personnel talking their way into offices in order to gain access to server rooms and sensitive customer information. PC Magazine was invited along to cover a recent TraceSecurity operation."
Is this an ad or an article?
-- Prem
Aiming to tweet on a rice
This summary could have conveyed all the necessary information quite easily and been just as valid by replacing "TraceSecurity" with the more generic "penetration testing company". Enjoy your plug guys!
If you have trade secrets on your web server, the spy is the least of your problems.
OK, bad joke, I know we're talking about the file server here, but why would a spy be in the server room? Wouldn't he be a lot less notcable logging in from an empty office? Or better yet, an empty office whose owner has just left his machine for the rest room?
What do you mean, RTFA? This is slashdot, we don't need no FAs!
-mcgrew
mcgrew's razor: Never attribute to stupidity that which can be explained by greedy self-interest
Old con, it shows how trusting people can be, but shouldn't.
They managed to walk right into the front page of Slashdot with no resistance whatsoever.
No kidding!!! What do you say at this point?
Which is an anagram of Slashvertisement.
The article is ok... but the movie adaptation is a thrill ride!
I don't need large brains to have a good time.
This article was a complete waste of time. No details were layed out for us; my favorite was when they said they "could have" plugged in a wireless access point to the server rack. Without actually trying it, they didn't prove dick....for all we know their network may not have allowed unknown MAC addresses. It was all a bunch of "we could have" done this, or "could have" done that. Just do it for god's sake! Just walking into the server room and putting stickers on a server doesn't prove that you actually could have walked off with it. Just saying that you "could have" disabled the alarm system doesn't really mean that you wouldn't have caught someone's attention.
If you post as Anonymous Coward, don't expect a reply.
Penetration testers doing their job: Film at 11.
Seriously, while it's not an entirely bad article on a penetration test, this is nothing but a shameless plug.
Never attribute to malice what can as easily be the result of incompetence...
first server room access should be limited to a very short list. and nobody on that list should be so underpaid they would stupidly let someone in there without at least 2 sets of eyes on them.
All they prove is that IT departments are not only underpaid but under staffed.
the second thing they prove is that the security staff is also underpaid and understaffed. Sorry but my first shot is to ask what company they are from, then google it to find the phone number. I never call the number given by the person or on their badge or paperwork.
There are lots of other ways. also you don't need access to the server room to install a rogue AP and gain a wireless cracking point. one hidden nicely under the a desk on the 2nd floor corner office is a better place.
Do not look at laser with remaining good eye.
Come on people, if there is a lock on the door and you know the people with the key to the room the chances for needing a slashvertisment like that decrease and knowing who has physical access to your servers increase...
Ask not what you can do for your country. Ask what your country did to you
Editors: For the sake of credibility, please consider before you post. Unless you would consider my story about a bridge in Brooklyn I have for sale, then I might reconsider my position.
Enlightenment is a pipe dream. So where's the pipe?
Spy's sappin my dispenser!
When you say you refuse to allow advertising masquerading as articles, I believe that's your intention, but really - what else is this?
[FUCK BETA]
So by placing the CD-ROM in a computer, it will automatically hack what ever OS the computer is running and auto install your software? Or are you implying that this company left server consoles logged in as an admin user?
I call major bullshit on this article. There's some real iffy stuff here as pointed out by other
What about the low wage rent a cop or janitor who has keys to all of doors in the building and is the same jantor who sometimes unplugs the systems to clean the floor.
Also some the janitors are not even us citizens.
appleguru.org
Slashvertisement, in its most distilled form. I guess the "editorship" here wrenched their shoulders after patting themselves on the back during their tenth anniversary. So much for integrity.
Seriously, even though I know all too well how running something like slashdot is a lot harder than it looks, and how not everyone can be satisfied, and how quality sometimes has to come after candor, even after all that, I know deep down I actually could start something better than this dreck. But frankly, "social links" and blog aggregators are already out there, and I won't pour my money down the hole of recreating reddit, digg, or technorati.
This article shows precisely how slashdot is not only not journalism, it's not even a respectable blog. Slashdot occupies the medium precisely inbetween, known colloquially as "The Worst of Both Worlds." You should be ashamed . But I know you aren't.
Done with slashdot, done with nerds, getting a life.
Heaven forfend!
For most companies, physical penetration testing is next to useless. Why? Because management expects IT and employees to act as security guards. IT is the gatekeeper of your ditial information, not your physical hardware. If you want a physically secure facility, hire security personnel. Tailgating can be easily solved by having security guards present at each key card entrance, forcing each person to badge in. Otherwise, it is just a show put on by management to get funding for more security toys. David
Server rooms are now being built with really long corridors to prevent the spies from cloaking and getting in, pyros are stationed at various checkpoints, and all workers are usually given baseball bats to hit people trying to enter to see if they bleed.
I think it means that they modified their own companie's domain - in other words they changed the From: field in their email message so it looked internal. Not exactly high-tech but probably enough to fool the majority of users. Their incoming mail servers shouldn't allow those through, but I'm sure most of them do.
Comment removed based on user account deletion
I suspect what we're getting here is non-tech trying to explain what the tech told him. It's not unusual for companies to have an all.staff@companydomain.com address to send company-wide e-mails. I figured they just forged the from field to show boss@companydomain.com. Only problem with that tactic, of course, is that the person you are impersonating would also get the e-mail. It does make you wonder if they had some inside help on that part. Mind you, I would think you really would only need to send the e-mail to a couple lower level managers to get the effect you want.
got it all backwards, hoping someone can help
I'm in ur server roomz, spying your shitz.
Not entirely true for an institution where the public facing servers and administrative intranets are seperate from each other and from the production servers and networks.
If they are not US citizens then they must be terrorists.
Dariel...THE BEEF!
Advice: on VPS providers
> Also some the janitors are not even us citizens.
Nice to see that mastering the English language is no longer a barrier to entry though.
In England, we'd be very suspicious of an American janitor. Non-EU citizen in an unskilled job; you claim to have a work visa...?
What they probably meant is that they forged a return address from a modified variant of the company's domain.
e.g. sending an email from FIRSTUNI0N.COM to employees of FIRSTUNION.COM
retrorocket.o not found, launch anyway?
They used the company's name 42 times on the first page of the article.
Too bad. This could have been a great article - a non-fiction version of Sneakers - but instead it comes across as a poorly written paid advertisement.
A thrill ride? I thought it had too many secrets.
Leaving aside the rather "only in the U.S." comment about "citizens," the point is valid. Quite often the two groups that have complete access to a building - the security guards and the cleaners - are also the groups most likely to be subcontracted to the lowest and/or shadiest bidder.
I suspect that because these people only arrive after office hours no-one in charge ever thinks of them as existing, much less as a security risk.
Three Squirrels
I suspect that what this means is that instead of "exec@corporate.com" they sent it from "exec@corporateoffice.com" or other such silliness. Most people aren't particularly observant about that kind of stuff.
Especially if he was mild mannered and particularly hursuit.
There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter
These guys are like sleezy insurance con artists.
RTFA, dumbass.
The editor likely misunderstood what was happening. My guess is that TraceSecurity "spoofed the company's domain" on an email from the outside to make it look like it came from the inside. Its trivial to do and most people don't have the time or care to double check that the source is really who they say they are. The problem isn't that they fell for the faked email. It is because they fell for the email and a number of other social engineering tricks. Victim Xyz Inc. failed to a) notice that the email was a fake, b) ensure that the pest control was actually on the visitor list, c) verify that the two guys were really from the pest control company they claim to be from, and d) follow them around at all times to ensure that they do their job and nothing else.
Thats ok, we keep two engineers in the intelligence room to take care of spies. Just watch out for big guys with chain guns that are glowing red or blue.
Now, places who want a secure environment / systems have been doing this a long time. An insurance company where I did work in 70's and I was part of security, managing mainly systems and operations access security, we had a company once/twice a year making a check. And I can tell you, they found a lot of ways in, loose papers, open terminals, unlocked doors, whatever. Very useful. Haven't done that for a while but you should see the Swiss bank security or the France military security, scary. And these guys who did the work for us, they sometimes were even able to penetrate those, don't know to what level but even a small is bad. So, let's hope they do a good work before someone else does it. And they also did other security checks so don't talk too much business after a couple of beers, charming fellows!
They "modified the company's domain"? How, exactly, did they go about doing that? If they can get access to internal DNS/email servers/etc from the outside, then your company has bigger security problems than those presented by a social engineering exercise...
The reporter doesn't know how easy it is to fake an e-mail sender (or even receipient, but that's not very usefull in this case)