The wrong bank story is at 18:20 onwards in the podcast.
In the transcript, search for "A few years pass. Jason gets another call for another security awareness engagement" and read from there.
The Beirut Bank Job (2017)
11–20 of 44 posts
Re: The Beirut Bank Job (2017)
#12The full text transcript is here: https://darknetdiaries.com/transcript/6/
Re: The Beirut Bank Job (2017)
#13This is like gitlab devs deleting the prod DB thinking it's dev DB
Re: The Beirut Bank Job (2017)
#14Memorys, in my young year as an electrician, our boss told us to go to a bank. We would have to install a whole new telephone installation. So we went to the bank, the lady on the front desk said, "yes I heard something about new telephones" and opened the door for us. About one hour later, we already started to work, the boss from the bank came and told us what we are doing, because they did not decide until know, what company the work would do .. so we left and guess what .. our company did not got the contract for the work :-)
Re: The Beirut Bank Job (2017)
#15Blank page again.
Here too. Annoying how websites do not work at all if you have some basic tracking blocker enabled.
Re: The Beirut Bank Job (2017)
#16Actually had similar experience pen-testing a large financial institution. Was plotted up in their training room and was circa late 90's and I had a boot floppy distro (TRINUX iirc) which had the tools I wanted (tcpdump, nmap...). So quickly turned a training PC into my terminal of choice and mapping the network out and came across an AS/400. Quickly dug out my notes upon such beasts and turned out that the shipping…
>they would just need to engineer management to task you such a job.
I like the idea of social engineering management into hiring pen testers... How large a shadow organization could conceivably remain undetected on the payrolls of a large corporation, I wonder.
There's a short story in there somewhere, at the very least.
Re: The Beirut Bank Job (2017)
#17It's quite possible in pentesting to end up hitting the wrong target unless you're careful.
Not as extreme as this case but, I've had cases where customers gave me the wrong IP address range for external work in the past, or where the customer had been told they had a dedicated server, when their web hosting company had actually put them on a shared host.
Re: The Beirut Bank Job (2017)
#18Pen-testing BOGO special: Buy One; Get One FREE!
Re: The Beirut Bank Job (2017)
#19Actually had similar experience pen-testing a large financial institution. Was plotted up in their training room and was circa late 90's and I had a boot floppy distro (TRINUX iirc) which had the tools I wanted (tcpdump, nmap...). So quickly turned a training PC into my terminal of choice and mapping the network out and came across an AS/400. Quickly dug out my notes upon such beasts and turned out that the shipping…
>and I was never asked back to that clients site ever again.
Award for excellence in pentesting.
Re: The Beirut Bank Job (2017)
#20This is like gitlab devs deleting the prod DB thinking it's dev DB
Reminds me of the dev who deleted the production DB and all its backups thinking it was dev just to save space and lower the monthly spending.