I've done exactly that, worked as a Red Team Lead, and the success rate is pretty disturbing. That, and vishing - calling people from the company you find on Linkedin from a spoofed number of their IT that they fucked something up and need to download and run this .exe to fix it before The Audit that's currently happening notices it.

Even if we do internal infrastructure tests where they let you in, switch AVs to "detect mode" instead of "block mode" and the goal is to find as many unpatched systems/vulnerabilities as you can (instead of, well, testing the AV solution), what we usually do is run a password spray for all domain accounts with a combinations (you can try like 3 to not lock the accounts) of "" we every single time got at least few accounts.

Fortunately this kind of tests are getting more popular, and passwords such as this should've definitely been caught in some kind of security test. But it is also pretty depressing, when you repeat the same test next year, and 80% of the passwords are still the same, and vulnerabilities are still not patched.

I've done quite a bit of freelance work and visited various office spaces with multiple companies in a single building. It was pretty common just to call to the building reception and tell them that I'm working for this-and-that-company upcoming weekend for their network stuff and I'd need access to network cabinets and whatnot and they'd have keys ready for me with very little (if any) verification if I'm actually doing what I'm supposed to or if I am who I claim to be. Some of the locations just handed me keys with access to practically everything, including shared server rooms hosting their CCTV setup, key managing servers and all.

So, just get a name tag with a local operator logo and clothes to match and ask nicely. You'll get access to a lot more than you think.

This reminds me of an excellent episode of Dark Net Diaries, "Jeremy from Marketing". https://pca.st/episode/52252c9e-e4a8-42f6-85f5-f162ec3f6b40

In marching band, I learned you can get pretty much everywhere with a white polo, black slacks, and (optionally) an instrument. The same usually holds true for a hi-vis vest and jeans.

I would really like to see companies held more accountable for their data security. If data gets leaked through some security breach, regardless of the criminality of the perpetrators of that breach, if it contains sensitive data like unhashed passwords, credit card or other personal data, and other potentially even more sensitive stuff (medical, financial), the company that was supposed to secure that data needs to be held liable too.

Any company that stores any of that kind of data, needs to have real security experts on board and listen to them. If you can't, don't store that kind of data.

Nice. Meanwhile at the place I work, they have mandated 15+ character passphrases that must have a capital letter and a symbol, that must be changed every 6 weeks, but banned the use of password managers. They also block yubikey and similar hardware tokens from corporate devices at the USB driver level, because "to stop the hackers!". The only 2nd factor auth they allow is Microsoft Authenticator, and Windows Hello. At least it's something I suppose.

Also, this was found by an audit years ago. Doesn't mean it was fixed, but doesn't mean it was still the same during or after the theft.

Usually, there’s a network for IP cameras, with a central server holding the video. There’s then, usually, a firewall to anything outside that, and frequently just a hardline to a monitoring system. (another computer with lots of monitors, typically.)

I hate to say it man, but this assumes someone is going above and beyond to lock down the cameras.

I used to have a milestone implementation where I work. There was a security PC in a security office that has the cameras on and always logged in but nobody shuts down requests for camera access for other users. The flimsiest of justification is all that is necessary for the highest level of leadership to give the go ahead. We do manufacturing and everyone thinks these low quality grainy security cameras are a replacement to going on the floor and actually watching how things are working so dozens of non-security people had access.

When I started everybody was using the same local account to log in. I migrated us to AD authentication (with exception of the security PC) but anybody could still technically reach the camera system from the network.

Absolutely anybody could just enter the IP of a camera on the network though and view what it sees. Every camera had default passwords. We even had some fun brands like Hikvision that were banned in 2022 by the FCC. We had a firewall from the outside world, but a guest network that was not isolated at all.

We've migrated to a different solution that cost hundreds of thousands of dollars and over a year of replacing cameras, but still probably a third of people in the org have access to the cameras for bullshit reasons and leadership doesn't care to shut it down. Thankfully none of them are admins and nobody but myself and a couple of others have any kind of admin level permissions now, but my point is that it's the wild west out there in terms of IT processes... and often Shadow IT from groups like a security team that isn't truly tech-savvy ends up running something like this.

If money didn't flow like water due to a total lack of purchasing controls and nobody complaining about expenditure at the time, we'd still be using the same old security cameras. I can't imagine the Lourve having much of a budget. museums are run like shitty nonprofits and are held together with string and bubblegum in the US.

You’ll also notice theyre not saying the security system was actually compromised- even if the cameras were pointed the right way, they’d still have gotten in and out because the windows were a point of vulnerability. They might have been able to respond faster, but they were in and out in ten minutes. a camera wouldn’t be able to stop that, if you account for normal human reaction times… if they’d even notice the ‘contractors’.

This, Camera are useless at stopping/preventing crime. Thanks to the Camera 5 persons have been charged and wait their trial in jail but camera won't prevent a jackasss to steal something in a museum

Or if it's really bad, then you might be able to reach it from the WiFi.

Or some employee might have dropped their own wifi access point onto the Lan for their own convenience.

I found 2 of those on the same floor during one sweep...

Ledrô even