Hot answers tagged

110

It depends on the scope of the engagement. If the customer wants you to focus on one specific task (e.g. bypassing locks, social engineering, etc.), then that's all you're authorized to do and all you are legally allowed to do. If the customer wants you to use "anything that's legal", in order to best simulate a real attacker, them you can indeed present a ...


82

First take screenshots of what you find. For the data that is yours, you should catalogue that. Personally, I would download it so you have a reference. You should take screenshots of your own data and avoid data that is not yours. Make sure you include the URLs. Document those in a way that a lawyer can understand. This is likely to become a legal ...


35

Unless your engagement is with the police, they are out of scope and you are not allowed to test them. If someone called the police, you already lost, actually. You should stop them right before they do that (friends of mine who do this kind of stuff work in England, where the emergency number is 999 and their principle is that they give up when someone ...


25

You typically want to contact the hosting company to take it down and hold all data and logs under a legal hold. You could also contact the other companies affected. Legally, you will need to contact a lawyer and the law enforcement in your jurisdition.


19

It should go without saying, but make sure that those login credentials are not working on your system. If they weren't deactivated when he left your organization (when they should have been), you'll want to audit your access logs to make sure they haven't been used since he left -- if they were on a public website where anyone could find them, you should ...


17

If you are a regular member of staff at the company, your correct escalation should be through the Infosec team, and fall back to the Legal and IT departments if your company isn't big enough to have a dedicated Infosec team. I would also copy HR on any communication. This is an extremely serious scenario. If you don't know what to do (and the fact that ...


7

For getting it taken down, you could have a US lawyer issue a DMCA takedown notice to the hosting provider, asserting that you own the content and have not consented to it being distributed - this should get an immediate reaction if the hosting provider honours DMCA notices, to which the contractor can respond.


5

There are several comments on here regarding false positives (which are a valid concern) and the question rules out a rouge officer mis-using the technology for personal reasons, but even if the technology is perfect there are other avenues of abuse. Perfect facial recognition for example could be used to identify participants of political rallies and used ...


4

Your proposal seems to be a device-specific key which is somehow placed on the device with the intention that only "authorized" law agencies can read. Only, this does not actually solve the problem since it is not that much a technical problem in the first place. It is easy to create a backdoor nobody can access. The problem starts then to make sure that ...


3

Broadly speaking, using a VPN does not eliminate all risk, it is about shifting the risk (perceived or real) from your ISP to the VPN. People have different reasons for using a VPN like: evading government surveillance becoming more 'anonymous' accessing geographically restricted content (streaming, movies) protecting themselves against rogue access points ...


3

Why would a web application try to connect to a port on localhost? A simple explanation that doesn't involve malicious acting is developmental tasks. Depending on the environment, some developers may install a local, lightweight copy of the backend API on their development machine. This would allow the frontend code to try and connect to localhost and do ...


2

I have been in a similar situation. I contacted my boss and the owner immediately (we only had 25 people). The owner handled everything, but he asked me to be available for a phone call. Since this involved a DOD contractor in the US, it was a DOD responsibility. We were never told the outcome. Let the owner/COO/corporate counsel contact law enforcement. ...


2

There’s a bunch of discussion embedded in your question. Personally I would never trust Geek Squad, but most people don’t have a viable option. First of all, make sure you understand that you are handing over everything currently on your machine, most things recently deleted from your drive, and many back versions of things on your drive. Do you trust this ...


2

An obvious... no. You cannot break into private property and/or steal any form of belongings unless authorized to do so. Authorized, that is, by the owner(s) of the property. This includes non-invasive/non-damaging methods. Your local laws regarding the protection of property apply to the employees as much as to the stranger on the street. The company ...


2

I believe false negatives are a major concern. Even with 0.1% false negative ratio, it means hundreds of thousands of people would be miscategorized as suspect on the US alone. Facial Recognition (and all AI tools usually sold together) are far, far from perfect. Coupled with data correlation (that can be flawed too) and incorrect understanding of the tools,...


2

Who guarantees that facial recognition works fine? What would happen on a false positive? Imagine the provider of the facial recognition software would guarantee that their system is 99.99% accurate. That sounds decent enough, right? For the entire US population, this would mean roughly 32.000 people who would be accused wrongly. Of course, real-life face ...


2

For legal question please use Law. But from a technical point: it does not matter if a redirect happens and where it points to. The visitor first hits the .com domain and whoever has control over this domain decides what happens next. And control over this domain means that the owner can make the DNS resolve the .com domain to an IP address controlled by ...


2

Asymmetric encryption was only introduced to AWS KMS in 2019. Prior to that, only symmetric encryption was available regardless of which region you were using. Even when AWS made the official announcement for asymmetric keys on KMS, many regions did not get the functionality on day 1. Also, the two regions in China are somewhat special, in that they're ...


1

As the linked article states, is appears the server farm was compromised rather than encryption being broken: They eventually discovered that EncroChat was operating from servers based in France and were eventually able "to put a technical device in place" which allowed them to access the encrypted messages sent over the company's network. ...


1

Could the VPN provider supply manipulated websites to the user? Yes, since it is effectively a man in the middle. Would HTTPS protect from this? Yes, but only if the client really makes sure that HTTPS is actually used and that it is actually the expected site. The VPN provider could use mechanism similar to sslstrip to rewrite plain HTTP traffic so ...


1

In general, you use a protection mechanism when there is a threat that you want to counter. So, if there is a threat within a cluster or between RAM and mounted volumes, then, yes, you should consider encryption.


1

This is an addition to the other answer from the top (currently). I understand it's been 3 days already and we won't see an answer from OP, but I strongly suggest to anyone that will have this happen to them to consider the following. Understand how data leaks usually happen: third party contractors are targeted first. I will tell you that even the lowest, ...


Only top voted, non community-wiki answers of a minimum length are eligible