Okay, so here it goes. I am the Red Team Lead, and as described earlier; not far (like about a week), I posted this. At the time, I was looking for a beautiful technical title which could match down my findings. I mentioned it as 'Weak Password Policy'. Since most of the penetration testers failed, I had to take the assignment and made through the entire thing successfully. Now, there is a little situation (in which the client had already mentioned the test had to be a black-box and not white-box in specific {we were not given any credentials}).

Now after patching up the identified vulnerabilities, we got exactly this reply from them (isn't it why you woudl sign a NDA for this at the first place if you had never trusted the company you push your black-box pentest into!?):

What was the intent ? backdoor?
It it ethical? Shouldn't we just let the party know that week password, instead of creating a secondary account(with fake name) and NOT informing US about it.  NOT ACCEPTABLE!
How do we trust that no data was downloaded and mis-used? 
How do we make sure there were not more accounts created with some malicious intention?

What happened here was, for testing purposes like more often in a black-box pentest, the tester requires to test additionally all the checks, if a priviledged account could had been achieved. There is this situation (afore-mentioned) which keeps bugging me, what would I say here? I need opinions and a great in-sight to reveal if what I did was wrong or they shuld had known what a 'black-box' assessment was for the first place (to reveal impacts!)

  • 2
    Did you disclose the secondary accounts to the customer as soon as you finish the pentest? If not, then it's your fault.
    – Adi
    Mar 4 '15 at 14:03
  • 2
    It's not clear what you're asking. Is the subject of your pentest complaining that, during the pentest, you created an account on their system? If so, were they notified? In a timely manner?
    – gowenfawr
    Mar 4 '15 at 14:03
  • 1
    Your test should have included coordination and agreement to "Rules of Engagement" beforehand. This would have delineated what sort of testing was in-scope, and what sort of activities and data collection you were authorized to perform. If you acted beyond that scope, then you could be in trouble. If you acted within that scope, and the customer isn't happy, the situation may require some delicate negotiations.
    – Iszi
    Mar 4 '15 at 18:23
  • Shritam - I see all of your questions have been closed so far. Please read and understand our How to Ask and tour pages. Also, look at the existing questions and answers. This will help you write posts that fit the site requirements.
    – Rory Alsop
    Mar 4 '15 at 23:15
  • I see it's put on hold since the question was un-clear. If it was, I doubt why people might just had answered the question asked. I appretiate and truly understand the site requirements are to be matched, but it is also required that the posters requirements match too. I hope you understand. Thanks. Mar 5 '15 at 7:20

ok so on any security assessment you must have a terms of engagement (which should largely spell out what is and is not in-scope of the review). Assuming you're doing what would traditionally be thought of as "red-team" style assessments, then on those generally "any action an attacker might take" is valid for the assessment. However there are many different definitions of red team (like there are many for penetration test) and that's why the scope and contract are so important (to make sure the customer and supplier are on the same page).

As the comment from @adnan mentions, at the end of the test you should tell the customer about any created accounts, so that they can remove them from the system (along with any data created). If you haven't done that, then a level of suspicion from the customer isn't too surprising.

However generally I would be inclined to respond that the account was created as part of the conduct of the test and as to data mis-use, this is governed by the NDA and contract that you have in place (again it's really important these are in place) which dictate what you can and cannot do with data retrieved during the conduct of the test.

  • This really helps me alot. We do have a normal web audit procedure which stated the summary of the scope of work along with the URL's. When asked, teh client promptly asked us to enumerate any additional URL's or vhosts which in the first place was to be a black-box assessment. Mar 4 '15 at 14:34

Not the answer you're looking for? Browse other questions tagged or ask your own question.