Re: But first...
My Google Pixel 7 Pro has a Bluetooth name of "Nokia 3210" and the number of times people have scanned it and look confused is incredible.
"Do people still use those?"
I'm still waiting for the one smart person that comes to me and says "That's weird, they didn't even have Bluetooth!".
Computer says b0rked! Modern pentesting in a nutshell.
1. Run a scan.
2. Grab the banners.
3. Do a lookup on a vulnerability database.
4. Print the list.
5. I can haz money plz?
I always like to point out that this isn't a pentest, this is a vulnerability scan...a pentest actually involves *testing* the vulnerabilities...because even though something has a known vulnerability, it doesn't mean it is actually vulnerable...it's possible to be aware of a vulnerability and mitigate it...in fact, mitigation to reduce risk is one of the things you're supposed to learn when you qualify as a cybersecurity expert...because updating to the latest version of something isn't always possible, so to reduce risk we implement mitigations...i.e. putting something behind a proxy or WAF, disabling vulnerable features, restricting access etc etc etc.
The current one size fits all "just patch everything and put MFA everywhere" policy is absolute fucking bollocks. It's like asking someone to knock their house down and rebuild it because the locks are fucked. It's absolutely nuts.
I'm eagerly awaiting the first pentester that comes to me and suggests getting armoured and shielded cable in case someone tries to eavesdrop (through concrete and 18 feet of earth) using a Van Eck phreaking device..."it could happen mate, I'm just here to tell you the risks".
I'm also eagerly awaiting a pentester that provides a proper risk assessment with their list of vulnerabilities as well...because not one of the pentesters I've met has successfully managed to quantify a risk and therefore stop the CEO absolutely shitting himself...despite risks being incredibly remote.
"We're not here to make you look bad!"
Yeah, I know that...you're here to sell shit to the CEO on a three year contract with a support bolt on, that you know full well that he's going to tell me to turn off within 3 days because it's "getting on his tits" and you'll never have to support it...then in three years, it'll be automatically renewed because nobody can remember why the fuck it's there in the first place.