Remember that security probe that ended with a sheriff cuffing the pen testers? The contract is now public so you can decide who screwed up The infosec duo cuffed during an IT penetration test that went south last week are out of jail, though not necessarily out of the woods. Both Florida man Justin Wynn, 29, and Gary Demercurio, 43, of Seattle, are out on bond following their arrest in the small hours of last Wednesday on burglary allegations. If you need a …
... the "rules" said 6AM to 6PM, and there was no change order or addendum to allow the midnight excursion (verbal agreement with a party who has been mum up until now?), then the pen testers are guilty of breaking and entering.
However, the facts show that they had no intention of causing harm, quite the opposite in fact, which mitigates the situation.
There was quite literally no harm done, and all parties learned something from their transgression.
Slap 'em on the behind and send 'em to bed without supper and be done with it.
It’s slightly odd to have a 6am to 6pm restriction in the first place. Do they expect real hackers / attackers to operate to the same rules? How nice of them!
This certainly seems to have been blown out of all proportion.
Besides, assuming that the pair found some flaws, do prosecutors really expect their systems to be able to process all this, or will their IT mysteriously crumble into a steaming heap of charges are actually levelled?
That's probably to protect them from a company that charges by the hour telling them "we were working all night long from our hotel rooms" when they send them a huge bill. They want to insure all or almost all work is done on site when the daytime staff is around (with a little extra before and after the workday for stuff that might interfere with the normal workday)
It is pretty common for a contract to specify what day/hours you can work. Requiring all work be performed on site is not unusual, especially when doing government work.
"That's probably to protect them from a company that charges by the hour..."
My experience is only of fixed price contracts for pen testing i.e. they look at the scale of the testing, the number of servers, etc. and give a price for the whole thing, including the report at the end.
@Doug
"It is pretty common for a contract to specify what day/hours you can work. Requiring all work be performed on site is not unusual, especially when doing government work."
Why not get them to sign an acceptable use policy and adhere to that too... You know like an actual hacker would.
Putting restrictions like this on a red team engagement pretty much invalidates the whole thing.
If they wanted to test physical security of the building (and they clearly did) then they need to allow this to happen over the full 24 hours or its pointless.
It makes perfect sense: most places will have different measures in place during the day versus during the night, both of which are worth testing. But, more importantly, this is also a matter of safety: if the police aren't informed of the test, you invite a confrontation in poor lighting - and potentially fatal misunderstandings.
"It makes perfect sense: most places will have different measures in place during the day versus during the night, both of which are worth testing. But, more importantly, this is also a matter of safety: if the police aren't informed of the test, you invite a confrontation in poor lighting - and potentially fatal misunderstandings."
Which is obviously why no physical testing takes place at night.. ever.. Yeah?
Good job real hackers only operate 9-5 on week days.
"Would it not be to assure that any detection of their activities could be handled by the client's staff during their normal daily business, avoiding expensive and distracting call outs?"
The pen test includes the testing of procedures i.e. it is no use having firewalls and and intrusion detection system if these are ignored at weekends. I have often seen attempts started on Friday evenings, by hackers who had clearly given some thought as to when systems were likely to have the least supervision.
The rules of engagement document says all pen testing had to be performed between 6AM to 6PM, in a way that suggests that Coalfire would want extra pay for working out of hours, and that would require a Change Order.
The same document, in the physical pen testing section, says that work will be performed in "afternoons or evenings". That's contradictory: 5:59pm isn't really "evening", it's more "afternoon".
I think the most reasonable way to read that document is that physical pen testing can be performed in afternoons and evenings, but Coalfire won't get extra money for working out of hours unless there's a Change Order. So I believe the pen testing was in scope.
However, it's clear that this isn't really a dispute between Coalfire and the state organization that hired them. It's a dispute between the state organization that authorized the break-in and the county organization that owns the building and arrested them.
What should really happen is the county should release the pen-testers since there was no intent to break the law - they genuinely believed they had permission. Then they county could try to arrest the state people who signed the contract for conspiracy to break-and-enter since they authorised the break-in (although we all know that won't happen).
"That's contradictory: 5:59pm isn't really "evening", it's more "afternoon"."
5:59 sounds squarely like "evening" to me.
I think maybe there's a region difference here? "Evening" is a loose, subjective term for most people, so I did a little searching. All I found was that as used colloquially, "evening" is a loose, subjective term, but is most commonly considered to begin at 6pm.
Interestingly, the term is slightly more precise among the astronomically inclined -- in that crowd, "evening" begins at twilight and ends at the start of astronomical night.
clearly, the contracted pentest-testers did their work.
the arresting officer has issue with the authority that authorised the pentesting.
thats between the police and the law makers to decide.
the duo are vindicated. i wouldn't be surprised if they sued for loss of earnings and defamation of charater!
Like the Iowa courthouse officer performed his job admirably. He caught them, refused to co-operate with what could have been a spoofed authority, and handed the matter over to the justice department to deal with. I hope Justin and Gary are well paid; in many a jurisdiction they would have received a thorough beating for resisting arrest, then treated to a new perspective on penetration testing.
Can't speak to the specific officer on the scene, but it sounds to me like the county sheriffs have a beef with the state courts and decided to take it out on their consultants. From the article: "The Des Moines Register notes the Iowa state judiciary and the county sheriffs are in a power struggle unrelated to the test".
I'm mad at your employer, so I'm going to take it out on you.
Again, not speaking to the officer, but as an organization the Dallas, Iowa sheriffs office sounds childish and vindictive.
Most likely this will be sorted out, but still a bit mean to detain the pair for essentially doing a job too well.
One wonders how far they got, and did they get their "sneaky device" plugged into the network before being caught?
Not sure what this would be termed, would it be a "Brown bag operation" or a "Blue Light Special" ?
"One wonders how far they got, and did they get their "sneaky device" plugged into the network before being caught?"
No, that was installed by the third member of the team, who walked straight in behind the sheriff while he was busy arguing with Wynn and Demercurio.
Yes, I may have been watching too many reruns of Hustle.
They could also have been looking to do some work on the side under the guise of pen testers.
Make a file go missing here or there. Etc.
That said the loss of reputation if caught and more besides, points more towards this being an elaboration of an over active imagination, and most likely occams razor applies.
On the positive, it sounds as though these guys are genuine, and not paid-up members of the Oceans eleven team. I think if nothing else the client-supplier lessons learned and PIR should definitely include "actually talking to each other in detail" to agree the terms, scope, approach and plan prior to the statement or work being signed.
Reading the Rules of Enagements (https://www.iowacourts.gov/static/media/cms/Rules_of_Engag_E9D807B3D13D3.pdf). It states
"Attempt to gain physical documentation at three locations ... Can be during the day and the evening ... " so far so good.
But the Social Engineering authorization (https://www.iowacourts.gov/static/media/cms/Social_Engr_D58D70423AAF3.pdf) states that
"Tasks that shall not be performed include - Alarm subversion and Force open doors"
Tampering with alarms, and damaging a door to break in its out. That doesn't exclude using other methods to circumvent physical security.
Good example is I've found a local hotel with a keypad lock can be circumvented with a hard drive magnet. No evidence of any tampering is left behind. Another could be owning a common key for things like postman's access and then gaining access that way. American mag locks can also be circumvented with nothing more than a vape in some circumstances. pen testing talk - I'll let myself in has some good examples that don't fall foul of your listed clauses.
of my proposed solution to Accountablity Theatre is to provide cover for just such legitimate operations.
Clearly what they omitted (and what was obviously omitted from their contract) was the step of informing a trusted confidante who was NOT a member of the client organisation nor the pen testing organisation but was trusted by both (eg a Lawyer) - of what they're plans were. The other step that they should have taken was to ensure a full digital record of every relevant action they took (whether through body cams for the on site "break in" or digital recording of their discussions, conclusions and plans and how/when those were shared with the T3P); and, of course, the routine digital capture and multiply redundant storage of all their evidence, together with regular snapshot hashes stored on an immutable audit trail (public hash-chain or block chain)
And although it obviously fits this case, it should apply not just to undercover surveillance activities, but ALL the activities carried out by anyone whose activities have - or could have - significant effect on the lives of others. None of the evidence is public by default. Only the proof that the evidence exists (the hash-chain) needs to be public. Then, in the event of reasonable challenge, the defendent has proof of their valid behaviour and decision making process. That "proof of proof" needs to be mandatory. And if in the event of challenge, if they can't prove that they kept the evidence, they're automatically guilty. And if they have the proof but choose not to present it, we're entitled to reach the same conclusion.
Citizens: Innocent until proven guilty
Authority: Guilty until proven innocent
Around here, there is nothing they could be charged with that has any reasonable chance of success. They weren't stealing anything. "Breaking and entering" is only "for the purposes of committing an offence". "Unlawfully on premises" has a defence of "honest and reasonable mistake of belief". Different locations have different rules, but unless it was a defence establishment or a bathroom I'm not seeing anything.
It's already being played out In public: I don't think it will go to court, and I don't think anything new will come out in court. Possible penalties include getting the men fired, and the company going out of business.
google is a "make money for Alphabet shareholders" engine. When you use it, you will find whatever makes those shareholders the most money.
You can improve your chances of finding what you are looking for by finding alternatives to google. Start with DuckDuckGo and search on "alternative search engines". The results might surprise you.
It will probably surprise very few of the readers here at ElReg that Eric S. Raymond doesn't pay google/alphabet any money, so his Jargon File stuff rarely comes to the top of googles list. Here's a link that might help you:
http://www.catb.org/~esr/jargon/html/D/DSW.html
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
