1

In my company, the network administration team decided to make penetration testing, and used a freelancer IT for it.

During the process, he was able to reveal many usernames and passwords which weren't protected very much 'http urls, basic authentication proxy, ... etc.'

Is it okay to hand this information and any other user-related and private info to the admins, and what should I do as a normal user to avoid that kind of privacy violation.

P.S: maybe the whole penetration testing is for 'hacking' users privacy, which makes it much worse.

  • You seem to be concerned about the pentester, but your explanation does not provide insight in to your position and where the concern is. The company hired the pentester. Unless you are on the network team or a manager that is directly involved, it isn't your responsibility. – h4ckNinja Aug 21 '16 at 3:24
  • Actually, I am the pen tester, and I was asked to collect information about users, even hacking their social media if I was able. and I can refuse 'direct orders'. so I'm stuck. – Emadeddin Aug 21 '16 at 6:12
  • 3
    If you were asked to hack third-party sites (such as social media accounts), you must refuse. That would be a serious violation of Federal law. – David Schwartz Aug 21 '16 at 8:58
  • Are you involved in any way with credit card information, etc? – Mark Buffalo Aug 21 '16 at 15:18
  • Now this makes more sense. I'm with @DavidSchwartz on this. When it comes to the social media accounts, they are out of scope. Your legal contract is with the company, not social media companies. They can take criminal action against you as a result of not having a contract with them. – h4ckNinja Aug 21 '16 at 17:24
2

I believe it is okay to hand out user information as long as it is clearly related to the user's work in the company and to the company's security. I as an employer would like to know if there are employees which use weak passwords, etc. because this clearly affects the security of the corporate IT.

Social media accounts of users have clearly nothing to do with the user's work at the company. The fact that you work at company X doesn't authorize your manager at company X to hack your facebook account, pretty much like it doesn't authorize your manager to break into your appartment and see what you are doing there.

There is a grey area, though, which I believe is pretty relevant: If users use the same passwords for the business and their personal accounts then this can be relevant for the company's security and I as a responsible would want to know about that. Therefore I can understand why you were asked to also hack the social media accounts, even if it is more than obvious that this is not the correct way to address this problem.

  • That is a very grey area. I'm not a lawyer, but I don't think there's any legal way for a pentester to check if employees reuse passwords in their personal accounts, unless said pentester is authorized by each and every employee. – A. Darwin Aug 21 '16 at 19:10
0

Your admins probably already have access to these informations. They probably have root access to everything. You already have to trust them. If you don't, run.

  • Not for sure, they may have access, but they don't have time or experience to have this info listed and delivered on a golden plate like that! – Emadeddin Aug 20 '16 at 23:55
0

Well the main thing to worry about with pen testing is probably trust. You would't hire a lawyer you don't trust, you would't go to an hospital you don't trust and you shouldn't hire a pen tester you don't trust.

The pen tester has access to potentially harmful information and that's his job to get to try to retrieve that information from you system. And that's also his job to not use or share that information. That the same kind of professional secrets that a lawyer or a doctor would deal with. I don't think it's a good idea to limit access of the pen tester. The point of pen testing is to test the most important systems, with the most important secrets and guarantee that those important secrets are safe. So at one point they have test those systems and it's completely possible that they find a way to get access to it. It would be ridiculous to ask a pen tester to test only the part of the system that doesn't contain any secret or to test a separate system with fake data that wouldn't be 1:1 identical, because they wouldn't be able to test the mis-configurations of the real system.

You shouldn't worry about the kind of information they can get access to, you should be worry about whether or not you can trust your pen tester.

The hard part is to determine how to calculate this "trust". Reputation can help, but I believe that this is mostly opinion-based...


Complementary answer about admins:

It's of course really bad if you can't even trust your own admins since they basically have access to everything, or at least have full access to part of your system. (koff Snowden koff koff) But there is at least one thing you can do: For very sensitive data like bitcoins for exemple, hashicorp's vault (don't like to recommends product but I don't know any alternative) can allow access to some services only if multiple admins sign in. There is far less chances that multiple admins would coordinate to steal your data than a lone wolf. You can read on this and on more ultra-paranoid security set-up here: https://medium.com/the-coinbase-blog/how-coinbase-builds-secure-infrastructure-to-store-bitcoin-in-the-cloud-30a6504e40ba#.uzjtngr1x

You can also seperate your system in multiple sub-systems, limit access to each individual admin to the strict minimum.

You can also try to monitor everything for suspicious admin activities. (what does a suspicious admin work looks like?)

But at some point, whatever you do, your admins still have more power than most employees and you still have to trust them in some level.


Complementary answer about unskilled admins:

Expecting your admin to not have the skill to hack you is not a good protection. In your threat model you should consider what they have access to everything they can access whether or not this access can be difficult. You know hacking is hard, does it mean that you can let an extraordinary hard-to-exploit security bug unpatched? Of course not!

Considerate that your admin has easy access to whatever it has access to.

Is that a problem? Can you trust your admin to deal with that data?

Yes: no problem No: replace your admin, add supervision from a more trusted admin, double verification with Vault or whatever.

Your admin has more access than the pen tester, if you trust your pen tester more than your admins, there is something very wrong.

  • Half of my problem is to trust the pen tester, the other half is to trust my admins not to use or violate our hacked-proof data. – Emadeddin Aug 20 '16 at 23:37
  • @Emadeddin The company admins would otherwise have access to this information. Providing proof is part of the pentester's job. The fact that the pentester got access to this data is the problem. Part of the report should include how they got access so that those issues can be fixed. If the company hired the pentester, they should have vetted him or her first. – h4ckNinja Aug 20 '16 at 23:43
  • For example, what if he captured a private email or message, he would use it for hacking proof, but the admin may use it to blackmail this user, what os the right suggestion to solve this issue? – Emadeddin Aug 20 '16 at 23:49
  • The admin can probably read the private emails without the help of the pen tester. The admin has generally a wider access than the pen tester. The pen tester has to hack you to get that email. It depends on your setup but (at least one of) the admins can just log in into the email server and read the content of every single inbox. The only way to protect yourself from the admin would be to use end-to-end encryption. Also see my update about admins. – Matthieu Aug 21 '16 at 0:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.