Re: EXAMPLE: Why OOO is *BAD* [WAS: Re: OOO FLAME]

["R. DuFresne" <dufresne () sysinfo com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



Any company that allows a secretary such access to server /etc/shadow 
files has no security perspective what-so-ever.

Still let's say the threat from out of office e-mails is totally null. 
Still there are rules and processes that have been about for a long period 
of time.  society functions due to there being rules and procedures as 
well.  Rude is rude no matter the risk.  Internet lists have long had a 
policy that it is just plain rude to include them in company or even 
private out of office replies.  And ignoring repeated complaints from 
those that follow the rules and who are suffering from your ignorance 
demonstrates that you who continue to ignore such and subscribe and 
include in the silly out of office replies that you just do not belong 
involved in the internet community and the mailing lists that other 
professionals engage in.



Thanks,

Ron DuFresne


On Mon, 15 Sep 2008, Tim March wrote:

> A secretary with access to the '/etc/shadow' file... and the means to pull it 
> off of the machine and in to her email client... *giggles to self*
>
>
>
> T.
>
> Jon Kibler wrote:
> > -----BEGIN PGP SIGNED MESSAGE-----
> > Hash: SHA1
> >
> > Erin Carroll wrote:
> > > List,
> > >
> > > Let's take Ray's tangent and run with it. What (if any) ways are OOO
> > > messages useful from a pen-test perspective? How would you use the 
> > > knowledge
> > > that someone is away/on vacation in a pen-test? Would you alter your
> > > techniques or target those accounts specifically in the hopes that brute
> > > force or other account specific techniques might have a window to go
> > > unnoticed?
> > >
> > > I'm just trying to get a conversational ball rolling here. I know where I
> > > would modify my tactics but I'm curious to see what members say. I know 
> > > that
> > > one area many companies are historically weak is in logging of security
> > > events. Or rather, in having someone actually pay attention to all those
> > > alerts.
> >
> >
> > Okay, since I started this, you're on!
> >
> > Real world example...
> >
> > I was teaching a pen-test bootcamp several years ago. One of the
> > students (who I will call 'Joe') pooh-poohed the whole OOO message
> > issue. He even indicated that he used them all the time, that they were
> > harmless, and they saved him from getting calls to his cell phone at
> > roaming rates when he was out of town. (This was back in the days before
> > nationwide calling plans.)
> >
> > I then sent Joe a test email message at his work email address. I got
> > back an OOO message saying that he would be out of the office for two
> > weeks of training and would only have very limited email at night. His
> > signature line showed that he was the dep-CSO for his organization.
> >
> > I then displayed the email for the whole class to discuss. Next, I
> > proposed that we demonstrate why OOO messages are an issue.
> >
> > What I proposed was to social engineer the help desk into providing
> > sensitive information. Rather arrogantly, he said, "Sure, why not? Those
> > guys are well trained and would never fall for anything you could
> > contrive." We then got permission (in writing) from the CIO, the CSO,
> > and the organization's legal department to do the social engineering 
> > attack.
> >
> > Next, I wrote up a script for a secretary (who I will call 'Sue') at
> > that ed center to use to call the organization's help desk. It basically
> > went as follows:
> >
> >    Sue: "Hi, I'm Sue with abc training company. One of your employees,
> > Joe, is taking a security course from us and he forgot that he was
> > supposed to bring the /etc/shadow file from the user file store server.
> > He needs it to use in class to test password cracking. He asked that you
> > please gzip it and email it to him."
> >
> >    Help Desk: "Okay, but I will have to check with his manager first."
> >
> >    Sue: "Oh, Joe said that if you needed to verify that he was taking a
> > course from us, just send him an email and the OOO reply it will have
> > everything you need to know."
> >
> >    Help Desk: "Alright, give me a minute. (Pause) Okay, I guess this has
> > everything I need. But, it says that he has limited email access; does
> > he want it sent to his office email address?"
> >
> > (This just shows that help desks are trained to be helpful!!! Despite
> > continual security awareness training, the possibility that this might
> > be social engineering attack never even occurred to this guy!)
> >
> >    Sue: "No, I was just about to tell you that he asked to have you it
> > send to his Hotmail address, which is: joe.... () hotmail com."
> >
> >    Help Desk: "Okay, no problem, he should have it in about 5 minutes."
> >
> > Needless to say, we had just created the hotmail account a few minutes
> > prior to the phone call.
> >
> > In just a couple of minutes, we owned the shadow file from the file
> > server where all user accounts have their data stored. In other words,
> > we now pwned the passwords for every one of his users.
> >
> > After that b-slap with a clue-by-4, Joe started singing a different tune.
> >
> > Jon K.
> > - --
> > Jon R. Kibler
> > Chief Technical Officer
> > Advanced Systems Engineering Technology, Inc.
> > Charleston, SC  USA
> > o: 843-849-8214
> > c: 843-224-2494
> > s: 843-564-4224
> > http://www.linkedin.com/in/jonrkibler
> >
> > My PGP Fingerprint is:
> > BAA2 1F2C 5543 5D25 4636 A392 515C 5045 CF39 4253
> >
> >
> > -----BEGIN PGP SIGNATURE-----
> > Version: GnuPG v1.4.8 (Darwin)
> > Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
> >
> > iEYEARECAAYFAkjNccsACgkQUVxQRc85QlOwCwCgl54SNlQMmB6/USWoYaKXTGiz
> > 74kAoIuGzu3M2pYIcOuiQNiVewO478Rd
> > =BBer
> > -----END PGP SIGNATURE-----
> >
> >
> >
> >
> > ==================================================
> > Filtered by: TRUSTEM.COM's Email Filtering Service
> > http://www.trustem.com/
> > No Spam. No Viruses. Just Good Clean Email.
> >
> >
> >
> >
> > ------------------------------------------------------------------------
> >
> > ------------------------------------------------------------------------
> > This list is sponsored by: Cenzic
> >
> > Top 5 Common Mistakes in Securing Web Applications
> > Get 45 Min Video and PPT Slides
> >
> > www.cenzic.com/landing/securityfocus/hackinar
> > ------------------------------------------------------------------------

- -- 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        admin & senior security consultant:  sysinfo.com
                        http://sysinfo.com
Key fingerprint = 9401 4B13 B918 164C 647A  E838 B2DF AFCC 94B0 6629

...We waste time looking for the perfect lover
instead of creating the perfect love.

                -Tom Robbins <Still Life With Woodpecker>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)

iD8DBQFIzmAkst+vzJSwZikRAgF8AJ44Q3u8nqfx/LKIvmBi+4UDqyqKYACgxLUy
dwfwuphRZ24W5fHU6iKtzLw=
=Yjbk
-----END PGP SIGNATURE-----

------------------------------------------------------------------------
This list is sponsored by: Cenzic

Top 5 Common Mistakes in 
Securing Web Applications
Get 45 Min Video and PPT Slides

www.cenzic.com/landing/securityfocus/hackinar
------------------------------------------------------------------------