The World's Worst Penetration Test Report by #ScumbagPenTester
it.toolbox.com
it.toolbox.com
First, this article is on some linkbait site and it gets posted to HN.
Second, the author complains that these kinds of outfits haven't been "weeded out" of the industry. Anyone with half a mind in the security industry knows that it is filled with charlatans and snake oil. That the author finds this surprising seems to indicate they're a bit green. Nobody's been weeded out from existence. Thus, a little caution and common sense is required.
I suspect the author's associate probably did a Google search for "pentester" and stumbled upon this outfit. Or worse, he read the stunning Google reviews for this outfit.
Also, as a US company, don't use an Indian company for a task so sensitive, and where it's vital that language be precise. Maybe that's politically-incorrect, but its the truth. If you're an Indian company, by all means ignore this advice.
> Another almost good finding - but according to the appendix, this host is a RHEL 5.x box. Those sysadmins - finding ways to run IIS on linux!! Brilliant!
I used to see crap like this all the time coming out of PCI compliance audits. The hosts I dealt with ran Apache on RHEL, too. We'd point this out, and they'd "accept" that "fix."
For some reason when I examine our logs after each test I see attempts at access to /usr etc.
It does make me wonder if all so called pen-test companies are just one massive scam.
Since the automated scanners are... stupid, they'll then gleefully go off and check for Linux vulnerabilities too.
The guys doing the analysis should of course catch all that, but if no one is doing any analysis and just parroting what the tools tell them, it ends up in the report.
The issue arrises when someone takes what pops out of the scanner as gospel instead of investigating if it is true or a false positive.
A pen tester can't know what infrastructure changes you've made, and should work from scratch each time, IMO. It might not have even been your company which made the change, hoster might have made change to the environment etc etc.
If it doesn't cost you any more to have them to try and scan /usr, ../../../../../../etc/passwd and so on, why not?
When I did pentests, we encountered a customer who, via a misconfigured puppet manifest, installed WordPress on a public facing server with a known-vulnerable plugin, which we found by always scanning /wp-admin/ even though the customer was a strictly RoR shop.
If OS detection is wrong (and its not a precise science), reporting on these is reasonable.
Also, you've not seen cut-n-paste, search-and-replace garbage until you've had to sift through the mountain of responses to a public sector RFP.
My best theory is that there are a large number of companies which simply shotgun shoveled together lowball responses to every posting. The lowball number virtually guarantees consideration and people who either don't really understand what they're procuring or don't actually read the responses let the stuff slip through.
I always made a point of requesting that the companies which submitted crap like that be banned from future solicitations - it never worked.
That so many companies manage to screw this up so badly, and still stay in business, indicates that all you need to succeed is some business acumen, the basest level of technical competency, and a little luck! :)
Well, there you go.
"Penetration test" is a term that means wildly different things depending on who you talk to.
The kind of test discussed in this post is the most common kind. People in the field call them "network penetration tests". These are the projects where someone runs nmap and Nessus and Metasploit against your network, dumps the Nessus results into a Word document, and calls it a day.
I'm not wild about these kinds of projects, and even less wild about the firms that specialize in them. They may find things on your network that you need to know. But they generally involve people just running some tools and interpreting the results, and then, if they find something blatant, spending the balance of their time using that finding to pry their way into the rest of your network.
The latter part of the project --- the part where they get to your database, dump your hashes, pivot from machine to machine, &c --- is not a great use of your security dollars. It's generally always going to be the case that if someone finds a way to run code (or SQL) on one of your servers, you're done for. The important finding is the flaw that gets attackers into your network. The findings that come after that look scary, but since there's not a whole lot you're going to be able to do to reliably lock down your internal servers, they aren't very useful to you; the next team that finds some other way onto your servers will embarrass you just as badly even after you "fix" the internal flaws from the first team.
You can get a license to run Nessus pretty cheaply. You can download nmap and Metasploit yourself. If you can build a product, you're more than qualified to run them yourself. If you don't have the bandwidth to do that, don't pay too much to have someone else do it. Also, demand that the team that does the netpen breaks out the findings that actually get them into your network, versus the less valuable findings like "older version of OpenSSL detected that we don't actually know how to exploit" or "customer records recovered after we took control of your database", and make sure the team concentrates on finding new ways into your network, rather than on extending their access into your network once they do find a way.
You'll need to ride netpen people not to waste time extending access, because the Fortune 500 companies that are the bread-and-butter clients for network penetration testers actually do want people to spend time extending access and finding "shock and awe" internal findings --- they're doing these tests for a different reason (to justify security budget), not for the reason you're doing them (to make sure it isn't easy to break into your servers).
There's a large number of people running those tools and doing exactly as you describe. I call them, 'the competition'. They bid low and ship a canned report with little to no analysis or follow-up. I highly recommend everyone scan themselves regularly. None of the tools you mentioned are too scary. I do tend to find the severity ratings to be out of whack with the real world impacts a lot of times, so if you see a bunch of red in the report don't panic. Read the text and figure out what it means to your network. The Metasploit Framework has a bit of a learning curve, but nothing too daunting and really it's not necessary for a maintenance scan. You can always invest in a licensed version if the Framework scares you.
Those tools don't provide meaningful coverage of web applications but they would give you a decent idea of the security posture of your network perimeter.
Many situations require the disinterested third party to perform the assessment or audit though. Sometimes customers/partners want to see your last report if you're dealing B2B and then there are the compliance requirements (PCI, health or personal information).
The one thing about that report that really bothered me was the remediation price tags. I know a lot of companies do similar things but we never offer remediation services since it would put us in a conflict of interest. I turn down security product installs regularly on our assessment and penetration testing customers because I don't want us in a position where we're auditing our own work. It's a point of contention sometimes but its an audit independence requirement and I won't budge on the issue.
This was on retail eCommerce websites.
This kind of fraud happens with outsourced manufacturing in China all the time. Not limited to china but it's just the first thing that came to my mind.