that sounds like a royal fuck up... cleaning house is... unusual right... for an entire security department?
Instead of trying to figure out who the bad actors were and who could still be trusted, the directors simply fired everybody in the team.
I was brought in as an outsider on the Friday evening to reverse engineer their passwords and basic network info so that they could continue to operate on Monday morning.
Those same directors are part of the same organization and are responsible for the actions of everyone under them. That responsibility is supposedly WHY they get to enjoy those big paychecks.
But somehow "everyone involved has to go" still doesn't include them...
My point was about someone higher up applying standards to everyone under them but not even considering having those same standards applied to themselves.
Should the head of IT be in the kill group? Why? It might have just been a couple of their team and they had no idea.
The board obviously says "your team your responsibility and plus we don't know you're not in on it"
Ok but then the owner or the stockholders should be able to apply EXACTLY that same reasoning to that same director or the entire board. If I'm a stock holder, I don't know they're not in on it and "your team your responsibility", applies all the way to the owner/ceo.
It's almost like there should be some other less stupid way to resolve problems...
Everyone else has all the cool stories meanwhile here I am aspiring to live Homer Simpson's lifestyle. Oh well.
This was an legal firm with something like 100-200 staff. The vague memory I have of the incident that triggered the whole thing was that a drug gang bribed someone in IT to get inside information about a rival gang's case.
We got dragged in on Friday mere hours after the entire IT staff (not just SecOps) was walked out the door, with several people apparently escorted by police.
The non-IT staff had no passwords other than to their own normal staff accounts, and there was no accessible hardcopy of any documentation.
I found a plain-text password in SYSVOL with some "server admin" rights, used that to find a plain-text domain admin password in a scheduled task, which we then used to dump out the Active Directory hashes. I have a vivid memory of a nice fancy lunch in a central business district on a quiet Saturday with my colleague while my laptop GPU was making turbine noises back at the customer site running hashcat.
By the time lunch had finished we had about 80% of all passwords, including more than half of all admin and service accounts. The only credential we couldn't obtain by Monday morning was the Cisco firewall appliance root password. We found some documentation and reverse-engineered the rest.
It was an eye-opening experience to see just how fast the security of a network can fall against an "attacker" with LAN access and just some basic tools you can download from GitHub, nothing fancy.
There was another similar incident where an sole IT admin had a rapidly deteriorating mental illness. Similarly he was walked on a Friday to prevent him "salting the Earth behind him", which apparently he had threatened. That network was reverse engineered in a similar timeframe with little effort...
I do general IT consulting, and all that was required was some "general security knowledge".
There's like a couple of tricks that will crack open any large-ish network in seconds given nothing much more than a command-line.
If you want to get fancy, Deathstar[1] will break open the vast majority of Active Directory networks in minutes. In some talk about it I saw on YouTube, one of the authors quipped that it'll grant you "Domain Admin in under 5 minutes, or your money back."
We didn't have to run it. I just used one of the initial attack vectors (scanning SYSVOL for passwords) and went from there.
This "one trick"[2] will get you an admin account password on something like 50% of all Active Directory networks:
dir \\domainname\SYSVOL -Recurse | Select-String 'password'
Reversing password hashes on Windows networks is now hilariously simple, because the NT hash is very old and weak. For compatibility reasons it's almost never replaced with something stronger. Any Windows password that is shorter than about 9 characters should be considered trivially reversible, to the point that it should be treated as "plain text" for security purposes.[3]
[1] https://github.com/byt3bl33d3r/DeathStar
[2] https://adsecurity.org/?p=2288
[3] https://www.tomsguide.com/us/8-character-password-dead,news-...
Elaborate?
- E-mail aliasing and password resets
- Resetting root accounts directly in on prem systems
- Cooperative employees
- When you are the CFO paying the bills, you can usually work with cloud providers to recover access to SaaS solutions (password managers aside)
- Terminals left powered on and unlocked
I used 'hashcat', which is an open-source tool available on GitHub.
A few hours of GPU time will reverse about 50-80% of typical NT-hashed passwords, and 90% or more given a few days or weeks.
Once you have passwords of admin users or service accounts, you can use those to "trawl through" servers looking for plain-text passwords in scripts, scheduled tasks, documentation, source code, etc...
Unless it is the fuck ups of all fuckups, companies that fire security teams for a security gap that got hacked will never be able to hire a security team again that’s competent. They’ll get people trying to break into the industry, but not capable vets.
Behind 99% of security incidents is a lack of funding, staffing, or “no we have to deploy to prod soon, sorry.” The very large sprawl that Series B -> pre-IPO sec teams have to address is staggering. Pre-IPO is usually the latest point that funding, staffing, support shows up.
The thing about slowly firing your security people is that they're high risk; fire them one at a time with long notice periods and you could have a situation on your hands. Fire them all at once (hopefully with generous severance packages) and you avoid that problem altogether.