Hackers ship their exploits directly to their target’s mailroom

Post by the_seraphim » Thu, Aug 08, 2019, 5:58 PM UTC

julian_t wrote: post #154

hinkley wrote: post #99

Earlier quoted context omitted.

One of the first pen testers I ever read pointed out that companies do (sometimes excessive) background checks on their staff all the time and then they outsource the cleaning crew. When I'm there during the day, there's only so much I could do without other people noticing. But here's a group with full access to an empty building full of your equipment for 10 hours a day. People are going to come at you from your bl…

A small company I once worked for employed a new firm of cleaners. Very good and conscientious for several months, right up to the night they loaded all the computer gear they could find on the premises into their van and disappeared. (After, of course, doing the cleaning and making sure they locked up afterwards)

Post by tehwhale » Thu, Aug 08, 2019, 6:16 PM UTC

dwild wrote: post #118

fortran77 wrote: post #25

Find someone who's out on leave for a while (just look for who's having a baby on IG) and ship the package to him/her! They won't discover it for weeks and you'll have plenty of time for your package to sit in the mailroom or on someone's desk. The danger is when the package is opened, the company may realize they've been hacked. Or have it there permanently: Ship an executive a fancy illuminated globe or desk clock…

I'm always amaze at how many computer screens/keyboards are visible from windows. It would be so easy to plant a webcam with some good optics on an opposite building and just get the passwords of the victim quite easily. you could have easily a few dozens of victims on a single company with a single camera.

Post by dwild » Thu, Aug 08, 2019, 8:38 PM UTC

tehwhale wrote: post #163

dwild wrote: post #118

Earlier quoted context omitted.

I'm always amaze at how many computer screens/keyboards are visible from windows. It would be so easy to plant a webcam with some good optics on an opposite building and just get the passwords of the victim quite easily. you could have easily a few dozens of victims on a single company with a single camera.

Our company has extremely deeply tinted and reflective exterior windows that even at night (outside) with lights inside, you can barely see in if your face is 1" away from the glass.

Post by lowdose » Fri, Aug 09, 2019, 12:04 AM UTC

duncan-donuts wrote: post #137

Iv wrote: post #130

Earlier quoted context omitted.

Yeah, I never understood that. At the first half sensitive job I had, the cleaning crew had access to all the computer rooms, including the server one. I had thought of trying to push my boss into using encryption for our emails but abandoned after realizing that. I still believe it was dangerous to use gmail for the company emails when Google was one of our competitors in our niche.

And I think your belief is justified. Look at how many niche products people built on AWS and Amazon caught wind of their success and rolled out a competitor!

Post by hnick » Fri, Aug 09, 2019, 4:39 AM UTC

dwild wrote: post #157

hnick wrote: post #129

Earlier quoted context omitted.

I notice these things too, but at the end of the day the sad news is nothing so exotic is necessary. There are far easier ways to get what you need from a modern office with typical security hygiene.

> There are far easier ways to get what you need from a modern office with typical security hygiene. Far easier than looking through a window? I'm curious to know! I've seen banks where it would be possible! I expect most of their software to be internal and accessed through a VPN when outside but still.