The Beirut Bank Job (2017)

Post by texasbigdata » Sun, Feb 21, 2021, 3:05 PM UTC

coldtea wrote: post #29

Zenst wrote: post #10

Actually had similar experience pen-testing a large financial institution. Was plotted up in their training room and was circa late 90's and I had a boot floppy distro (TRINUX iirc) which had the tools I wanted (tcpdump, nmap...). So quickly turned a training PC into my terminal of choice and mapping the network out and came across an AS/400. Quickly dug out my notes upon such beasts and turned out that the shipping…

> We did the report and that whole aspect got swept under the carpet and I was never asked back to that clients site ever again. You should have pushed for the opposite, doing the ocassional pentest to the client for life, in exchange for being mum about it.

Post by [deleted] » Sun, Feb 21, 2021, 5:02 PM UTC

raesene9 wrote: post #17

It's quite possible in pentesting to end up hitting the wrong target unless you're careful. Not as extreme as this case but, I've had cases where customers gave me the wrong IP address range for external work in the past, or where the customer had been told they had a dedicated server, when their web hosting company had actually put them on a shared host.

Post by anonleb4 » Sun, Feb 21, 2021, 6:07 PM UTC

Post by coldtea » Sun, Feb 21, 2021, 6:40 PM UTC

texasbigdata wrote: post #31

coldtea wrote: post #29

Earlier quoted context omitted.

> We did the report and that whole aspect got swept under the carpet and I was never asked back to that clients site ever again. You should have pushed for the opposite, doing the ocassional pentest to the client for life, in exchange for being mum about it.

Here’s a contra view. If you had a back bone as a consultant your period 2 report would start with “unresolved issues from last time”, so you would very quickly have to resign due to your ethical baseline not being met. Therefore same outcome.

Post by saghm » Sun, Feb 21, 2021, 8:14 PM UTC

anonleb4 wrote: post #35

Much less impressive when you know the guy works for the cousin of the bank owner, which is part of a mafioso family. This was staged as a PR move for the security firm of the cousin of the bankowner.