Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Pen Testers Who Got Arrested Doing Their Jobs Tell All
Newest First  |  Oldest First  |  Threaded View
User Rank: Apprentice
8/5/2020 | 2:21:45 PM
Pen Tester Who Got Arrested Doing Their Jobs Tell All
I may be wrong about this but I think because they were arrested they are now in the system and have an arrest record. This arrest record will show up in background checks, police stops, etc.
Kelly Jackson Higgins
Kelly Jackson Higgins,
User Rank: Strategist
8/5/2020 | 11:08:07 AM
Re: Everyone but infosec comes out badly in this.
It also shows that there's still a major disconnect and lack of understanding of what pen testers - especially physical pen testers - do and why their work is important. And yes, there were plenty of obvious and painful security weaknesses found in this engagement, which sadly is not surprising. 
User Rank: Moderator
8/5/2020 | 11:02:21 AM
Everyone but infosec comes out badly in this.
Even from the first couple of paragraphs, De Mercurio, Wynn and Coalfire apears to be on the right while everyone else involved looked terrible. Taking infosec out to task is like blaming a police office for pointing out your back door is unlocked and open. What kind of stupid logic is that? Everything could be handled quietly by making sure the backdoor is closed from now on. This blowup only shows yourself to be the moron that doesn't care the security of your institution as long as your pride is not injured.

Also what's with "ban after-hours access to courthouses and physical "break-ins" by pen testers"? Are we assuming the real bad actors would follow these bans, thieves only work during the day and therefore no protections on these fronts are necessary?

All of these prove one thing: Infosec personnel would always be able to identify weakness in systems and buildings, fixing them is quite another matter.


Attackers Leave Stolen Credentials Searchable on Google
Kelly Sheridan, Staff Editor, Dark Reading,  1/21/2021
How to Better Secure Your Microsoft 365 Environment
Kelly Sheridan, Staff Editor, Dark Reading,  1/25/2021
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: We need more votes, check the obituaries.
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-01-26
KLog Server through 2.4.1 allows authenticated command injection. async.php calls shell_exec() on the original value of the source parameter.
PUBLISHED: 2021-01-26
The ftpd gem 0.2.1 for Ruby allows remote attackers to execute arbitrary OS commands via shell metacharacters in a LIST or NLST command argument within FTP protocol traffic.
PUBLISHED: 2021-01-26
SmartAgent 3.1.0 allows a ViewOnly attacker to create a SuperUser account via the /#/CampaignManager/users URI.
PUBLISHED: 2021-01-26
NVIDIA Jetson AGX Xavier Series, Jetson Xavier NX, TX1, TX2, Nano and Nano 2GB, L4T versions prior to 32.5, contains a vulnerability in the apply_binaries.sh script used to install NVIDIA components into the root file system image, in which improper access control is applied, which may lead to an un...
PUBLISHED: 2021-01-26
NVIDIA Tegra kernel in Jetson AGX Xavier Series, Jetson Xavier NX, TX1, TX2, Nano and Nano 2GB, all L4T versions prior to r32.5, contains a vulnerability in the INA3221 driver in which improper access control may lead to unauthorized users gaining access to system power usage data, which may lead to...