News for hackers. Stuff that matters.

A comment on Hackers ship their exploits directly to their target’s mailroom. Parent comment

Re:Hackers ship their exploits directly to their target’s ma... by hinkley on Wednesday August 07, 2019 @03:46PM (#20638160)
One of the first pen testers I ever read pointed out that companies do (sometimes excessive) background checks on their staff all the time and then they outsource the cleaning crew. When I'm there during the day, there's only so much I could do without other people noticing. But here's a group with full access to an empty building full of your equipment for 10 hours a day.

People are going to come at you from your blindside, if they can find it. And if you consider a certain class of people invisible, then that's what a hacker wants to be.

[ Parent | on HN ]
Re:Hackers ship their exploits directly to their target’s ma... by allana on Wednesday August 07, 2019 @04:05PM (#20638352)
Many companies treat the cleaning crew like trash. Unpredictable scheduling, no benefits, minimum wage pay combine to make it so a very small bribe would get an attacker into a building, where they could plant gear in the drop ceiling and more.

Doing right by your workers would go a long way towards plugging this vulnerability.

[ Parent | on HN ]
Re:Hackers ship their exploits directly to their target’s ma... by hinkley on Wednesday August 07, 2019 @04:44PM (#20638805)
While you should always treat your employees well, I'm not talking about creating a disgruntled employee leading to problems.

The example given was a route someone could use to be invited into the building. Nothing is stopping you from being a blue collar worker, especially if you're willing to fake a work history.

[ Parent | on HN ]
Re:Hackers ship their exploits directly to their target’s ma... by zcrackerz on Wednesday August 07, 2019 @04:20PM (#20638513)
I once stayed late and noticed a cleaner was wearing a polo from the company I used to work for. I asked him about it and it turned out he was an engineer and was filling in for his girlfriend who owned the cleaning business. Holy red flag! I made some noise and that cleaning company was let go.
[ Parent | on HN ]
Re:Hackers ship their exploits directly to their target’s ma... by arcboii92 on Wednesday August 07, 2019 @04:32PM (#20638655)
Pro-tip for anyone that finds themselves in this situation when trying to steal another company's data - say you bought the shirt for 50c at a second hand store. That, or don't wear your company polo on an espionage mission.
[ Parent | on HN ]
Re:Hackers ship their exploits directly to their target’s ma... by jandrese on Thursday August 08, 2019 @11:13AM (#20645302)
Or just wear a boring flat grey shirt like all of the rest of the cleaning staff.
[ Parent | on HN ]
Re:Hackers ship their exploits directly to their target’s ma... by PhasmaFelis on Wednesday August 07, 2019 @05:46PM (#20639481)
I'm not sure I see why the cleaning company was the problem.
[ Parent | on HN ]
Re:Hackers ship their exploits directly to their target’s ma... by michaelbuckbee on Wednesday August 07, 2019 @06:54PM (#20640057)
Presumably, because they swapped to a non-approved person on their schedule.
[ Parent | on HN ]
Re:Hackers ship their exploits directly to their target’s ma... by perl4ever on Wednesday August 07, 2019 @06:02PM (#20639623)
"his girlfriend who owned the cleaning business"

He wasn't just some guy.

[ Parent | on HN ]
Re:Hackers ship their exploits directly to their target’s ma... by PhasmaFelis on Wednesday August 07, 2019 @08:26PM (#20640674)
He was working for the cleaning business, though. If the company was letting in anyone who works for that cleaner without further investigation, that's their problem. That's the situation we were talking about upthread, so I assumed zcrackerz would have said something if it were different.
[ Parent | on HN ]
Re:Hackers ship their exploits directly to their target’s ma... by lazyasciiart on Thursday August 08, 2019 @03:00AM (#20642424)
Where I work, each cleaner gets a badge, just like the engineers. Presumably she gave her badge to a random other person, aka her boyfriend, so he could let himself in. Nothing stops me from doing that as an engineer either, but it would absolutely be a firing offence if caught.
[ Parent | on HN ]
Re:Hackers ship their exploits directly to their target’s ma... by Iv on Wednesday August 07, 2019 @08:13PM (#20640594)
Yeah, I never understood that. At the first half sensitive job I had, the cleaning crew had access to all the computer rooms, including the server one. I had thought of trying to push my boss into using encryption for our emails but abandoned after realizing that.

I still believe it was dangerous to use gmail for the company emails when Google was one of our competitors in our niche.

[ Parent | on HN ]
Re:Hackers ship their exploits directly to their target’s ma... by duncan-donuts on Wednesday August 07, 2019 @09:10PM (#20640931)
And I think your belief is justified. Look at how many niche products people built on AWS and Amazon caught wind of their success and rolled out a competitor!
[ Parent | on HN ]
Re:Hackers ship their exploits directly to their target’s ma... by lowdose on Thursday August 08, 2019 @08:04PM (#20650182)
But I think this is not as cut and clear with an enterprise gmail account. Who really competes with Google? Amazon on the other hand competes with every retailer out there.
[ Parent | on HN ]
Re:Hackers ship their exploits directly to their target’s ma... by nickpsecurity on Wednesday August 07, 2019 @08:50PM (#20640808)
To corroborate that, I once helped a family friend clean banks in the middle of the night. That was her job. Far as I can tell, she was just the lowest bidder on it with a consistent work ethic. We had access to almost everything. Could've gotten to most of the computers. I told her as much with her laughing that it was ridiculous.
[ Parent | on HN ]
Re:Hackers ship their exploits directly to their target’s ma... by swish_bob on Thursday August 08, 2019 @03:53AM (#20642650)
I left my iPod on the desk overnight once while working at a large international investment bank. It vanished, presumably lifted by the cleaners. Security were remarkably uninterested in this, refused to do anything whatsoever (including checking the CCTV) although they did ask me to give them the crime number if I reported it.
[ Parent | on HN ]
Re:Hackers ship their exploits directly to their target’s ma... by philpem on Thursday August 08, 2019 @06:37AM (#20643275)
That's easy enough to explain...

First off, lying to office security carries fewer repercussions than lying to the police to get a crime number. The office security guys won't want to be party to someone else's vendetta (would you?)

Secondly - if you care enough to waste hours of your time filing a police report, then you must give a damn about your shiny-thing. If not... well you clearly don't care enough and it's not a problem, so goodbye.

Read that how you will...

[ Parent | on HN ]
Re:Hackers ship their exploits directly to their target’s ma... by julian_t on Thursday August 08, 2019 @06:04AM (#20643119)
A small company I once worked for employed a new firm of cleaners. Very good and conscientious for several months, right up to the night they loaded all the computer gear they could find on the premises into their van and disappeared. (After, of course, doing the cleaning and making sure they locked up afterwards)
[ Parent | on HN ]