Remember that security probe that ended with a sheriff cuffing the pen testers? The contract is now public so you can decide who screwed up

The infosec duo cuffed during an IT penetration test that went south last week are out of jail, though not necessarily out of the woods. Both Florida man Justin Wynn, 29, and Gary Demercurio, 43, of Seattle, are out on bond following their arrest in the small hours of last Wednesday on burglary allegations. If you need a …

[jake]

IF, and I stress the IF ...

... the "rules" said 6AM to 6PM, and there was no change order or addendum to allow the midnight excursion (verbal agreement with a party who has been mum up until now?), then the pen testers are guilty of breaking and entering.

However, the facts show that they had no intention of causing harm, quite the opposite in fact, which mitigates the situation.

There was quite literally no harm done, and all parties learned something from their transgression.

Slap 'em on the behind and send 'em to bed without supper and be done with it.

[Unbelievable!]

Re: IF, and I stress the IF ...

i think thats too harsh. they did a job. they got caught as well.

it's affirmation that the protection in place works. they deserve an apology. imho, of course

[bazza]

Re: IF, and I stress the IF ...

It’s slightly odd to have a 6am to 6pm restriction in the first place. Do they expect real hackers / attackers to operate to the same rules? How nice of them!

This certainly seems to have been blown out of all proportion.

Besides, assuming that the pair found some flaws, do prosecutors really expect their systems to be able to process all this, or will their IT mysteriously crumble into a steaming heap of charges are actually levelled?

[Anonymous Coward]

Re: IF, and I stress the IF ...

That's probably to protect them from a company that charges by the hour telling them "we were working all night long from our hotel rooms" when they send them a huge bill. They want to insure all or almost all work is done on site when the daytime staff is around (with a little extra before and after the workday for stuff that might interfere with the normal workday)

It is pretty common for a contract to specify what day/hours you can work. Requiring all work be performed on site is not unusual, especially when doing government work.

[don't you hate it when you lose your account]

Re: IF, and I stress the IF ...

I personally never expect my security to be compromised outside of work hours. That's simply not cricket.

Or to put it another way

The clients are acting like complete idiots.

[disgruntled yank]

Re: IF, and I stress the IF ...

"The clients are acting like complete idiots."

Because it makes for a more entertaining Register headline to read of consultants shot up by over-zealous law enforcement?

[ds6]

Re: IF, and I stress the IF ...

What does that have to do with the topic?

[JohnG]

Re: IF, and I stress the IF ...

"That's probably to protect them from a company that charges by the hour..."

My experience is only of fixed price contracts for pen testing i.e. they look at the scale of the testing, the number of servers, etc. and give a price for the whole thing, including the report at the end.

[d3vy]

Re: IF, and I stress the IF ...

@Doug

"It is pretty common for a contract to specify what day/hours you can work. Requiring all work be performed on site is not unusual, especially when doing government work."

Why not get them to sign an acceptable use policy and adhere to that too... You know like an actual hacker would.

Putting restrictions like this on a red team engagement pretty much invalidates the whole thing.

If they wanted to test physical security of the building (and they clearly did) then they need to allow this to happen over the full 24 hours or its pointless.

[Carpet Deal 'em]

Re: IF, and I stress the IF ...

It makes perfect sense: most places will have different measures in place during the day versus during the night, both of which are worth testing. But, more importantly, this is also a matter of safety: if the police aren't informed of the test, you invite a confrontation in poor lighting - and potentially fatal misunderstandings.

[d3vy]

Re: IF, and I stress the IF ...

"It makes perfect sense: most places will have different measures in place during the day versus during the night, both of which are worth testing. But, more importantly, this is also a matter of safety: if the police aren't informed of the test, you invite a confrontation in poor lighting - and potentially fatal misunderstandings."

Which is obviously why no physical testing takes place at night.. ever.. Yeah?

Good job real hackers only operate 9-5 on week days.

[Cederic]

Re: IF, and I stress the IF ...

Would it not be to assure that any detection of their activities could be handled by the client's staff during their normal daily business, avoiding expensive and distracting call outs?

Such as the one that happened..

[JohnG]

Re: IF, and I stress the IF ...

"Would it not be to assure that any detection of their activities could be handled by the client's staff during their normal daily business, avoiding expensive and distracting call outs?"

The pen test includes the testing of procedures i.e. it is no use having firewalls and and intrusion detection system if these are ignored at weekends. I have often seen attempts started on Friday evenings, by hackers who had clearly given some thought as to when systems were likely to have the least supervision.

[Jon 37]

Contradictory document

The rules of engagement document says all pen testing had to be performed between 6AM to 6PM, in a way that suggests that Coalfire would want extra pay for working out of hours, and that would require a Change Order.

The same document, in the physical pen testing section, says that work will be performed in "afternoons or evenings". That's contradictory: 5:59pm isn't really "evening", it's more "afternoon".

I think the most reasonable way to read that document is that physical pen testing can be performed in afternoons and evenings, but Coalfire won't get extra money for working out of hours unless there's a Change Order. So I believe the pen testing was in scope.

However, it's clear that this isn't really a dispute between Coalfire and the state organization that hired them. It's a dispute between the state organization that authorized the break-in and the county organization that owns the building and arrested them.

What should really happen is the county should release the pen-testers since there was no intent to break the law - they genuinely believed they had permission. Then they county could try to arrest the state people who signed the contract for conspiracy to break-and-enter since they authorised the break-in (although we all know that won't happen).

[Anonymous Coward]

Re: Contradictory document

5:59pm isn't really "evening", it's more "afternoon".

Seems well past beer o'clock to me...

[JohnFen]

Re: Contradictory document

"That's contradictory: 5:59pm isn't really "evening", it's more "afternoon"."

5:59 sounds squarely like "evening" to me.

I think maybe there's a region difference here? "Evening" is a loose, subjective term for most people, so I did a little searching. All I found was that as used colloquially, "evening" is a loose, subjective term, but is most commonly considered to begin at 6pm.

Interestingly, the term is slightly more precise among the astronomically inclined -- in that crowd, "evening" begins at twilight and ends at the start of astronomical night.

[Neoc]

Re: Contradictory document

Technically, "evening" begins at 5pm. At least in this neck of the wood, as I understand that some benighted places do not ask for eveningwear until 6pm. Tsk.

[jake]

Re: Contradictory document

Some places actually ask for evening wear? How delightfully archaic!

[Unbelievable!]

it's a test of law more than penetration

clearly, the contracted pentest-testers did their work.

the arresting officer has issue with the authority that authorised the pentesting.

thats between the police and the law makers to decide.

the duo are vindicated. i wouldn't be surprised if they sued for loss of earnings and defamation of charater!

[Doctor Syntax]

Re: it's a test of law more than penetration

Just invoice for the time spent in custody.

[Fatman]

Re: it's a test of law more than penetration

<quote>Just invoice for the time spent in custody.</quote>

Don't forget to charge time and a half for "over time" (in excess of 8 hours/day).

[Adrian 4]

Re: it's a test of law more than penetration

But they'll only pay for time spent in custody between the hours of 6am and 6pm

[Kiwi]

Re: it's a test of law more than penetration

Just invoice for the time spent in custody.

I don't think they can as that was already covered in their contract.

Surely the time they were locked up is the ultimate in "PEN" testing? Especially when it's for the state?

("State Pen", obviously)

[mevets]

sounds to me...

Like the Iowa courthouse officer performed his job admirably. He caught them, refused to co-operate with what could have been a spoofed authority, and handed the matter over to the justice department to deal with. I hope Justin and Gary are well paid; in many a jurisdiction they would have received a thorough beating for resisting arrest, then treated to a new perspective on penetration testing.

[trindflo]

Re: sounds to me...

Can't speak to the specific officer on the scene, but it sounds to me like the county sheriffs have a beef with the state courts and decided to take it out on their consultants. From the article: "The Des Moines Register notes the Iowa state judiciary and the county sheriffs are in a power struggle unrelated to the test".

I'm mad at your employer, so I'm going to take it out on you.

Again, not speaking to the officer, but as an organization the Dallas, Iowa sheriffs office sounds childish and vindictive.

[Anonymous Coward]

Pentesting

Most likely this will be sorted out, but still a bit mean to detain the pair for essentially doing a job too well.

One wonders how far they got, and did they get their "sneaky device" plugged into the network before being caught?

Not sure what this would be termed, would it be a "Brown bag operation" or a "Blue Light Special" ?

[electricmonk]

Re: Pentesting

"One wonders how far they got, and did they get their "sneaky device" plugged into the network before being caught?"

No, that was installed by the third member of the team, who walked straight in behind the sheriff while he was busy arguing with Wynn and Demercurio.

Yes, I may have been watching too many reruns of Hustle.

[Charles Calthrop]

Re: Pentesting

they didn't do their job too well, though. They got caught.

[David Nash]

Re: Pentesting

Their job was to test security, not to break in without getting caught. They did their job very well. They guys who caught them passed the test.

[Henry Wertz 1]

passed the test

Looks like the courthouse passed the physical part of the pen test. What a collosal fuckup though...

You know, our local media does such a lovely job on news coverage... I live in Iowa and this is the first I've heard of this!

[Rich 11]

Re: passed the test

Yeah, but the talking raccoon has kept the media busy all week.

What? You've never heard of that story either? Wow...

[Kiwi]

Re: passed the test

Yeah, but the talking raccoon has kept the media busy all week.

Over these ways they're too busy with an orangeutan going ape...

[John Brown (no body)]

Re: passed the test

"orangeutan"

Pedant ale....ah, no...wait.

[Nick Kew]

We should be told ...

Evidently they were working outside their regular hours. But were they moonlighting, or was it a dark night?

[hplasm]

Re: We should be told ...

"or was it a dark night?"

Or the Dark Knight - who would escape via the roof...

[Sgt_Oddball]

playing devils advocate here...

They could also have been looking to do some work on the side under the guise of pen testers.

Make a file go missing here or there. Etc.

That said the loss of reputation if caught and more besides, points more towards this being an elaboration of an over active imagination, and most likely occams razor applies.

[Mage]

Wonderful

More great background from el Reg for my 'Dark Ops' series

[Anonymous Coward]

#semantics

It's always between 0600 and 1800 somewhere in the world...

Did they specify a timezone in the contract...?

"Loopholery" for the win...!

[John Robson]

Re: #semantics

Yes - they specific mountain time in the snippet quoted in the flipping' article!

[tim 13]

Re: #semantics

Which mountain?

[disgruntled yank]

Re: #semantics

Interesting. Iowa is not on Mountain Time, it is on Central Time.

[Aristotles slow and dimwitted horse]

I think if nothing else...

On the positive, it sounds as though these guys are genuine, and not paid-up members of the Oceans eleven team. I think if nothing else the client-supplier lessons learned and PIR should definitely include "actually talking to each other in detail" to agree the terms, scope, approach and plan prior to the statement or work being signed.

[Ochib]

Reading the Rules of Enagements (https://www.iowacourts.gov/static/media/cms/Rules_of_Engag_E9D807B3D13D3.pdf). It states

"Attempt to gain physical documentation at three locations ... Can be during the day and the evening ... " so far so good.

But the Social Engineering authorization (https://www.iowacourts.gov/static/media/cms/Social_Engr_D58D70423AAF3.pdf) states that

"Tasks that shall not be performed include - Alarm subversion and Force open doors"

[Sgt_Oddball]

Sooo

Tampering with alarms, and damaging a door to break in its out. That doesn't exclude using other methods to circumvent physical security.

Good example is I've found a local hotel with a keypad lock can be circumvented with a hard drive magnet. No evidence of any tampering is left behind. Another could be owning a common key for things like postman's access and then gaining access that way. American mag locks can also be circumvented with nothing more than a vape in some circumstances. pen testing talk - I'll let myself in has some good examples that don't fall foul of your listed clauses.

[Cederic]

They clearly did not subvert the alarm, as that alerted the arresting officer.

[chivo243]

Potato potatoe

Even if the language is clear, one side will interpret it their way, the other side will say that's not what it means... in this context...

[Harry Stottle]

One of the main purposes

of my proposed solution to Accountablity Theatre is to provide cover for just such legitimate operations.

Clearly what they omitted (and what was obviously omitted from their contract) was the step of informing a trusted confidante who was NOT a member of the client organisation nor the pen testing organisation but was trusted by both (eg a Lawyer) - of what they're plans were. The other step that they should have taken was to ensure a full digital record of every relevant action they took (whether through body cams for the on site "break in" or digital recording of their discussions, conclusions and plans and how/when those were shared with the T3P); and, of course, the routine digital capture and multiply redundant storage of all their evidence, together with regular snapshot hashes stored on an immutable audit trail (public hash-chain or block chain)

And although it obviously fits this case, it should apply not just to undercover surveillance activities, but ALL the activities carried out by anyone whose activities have - or could have - significant effect on the lives of others. None of the evidence is public by default. Only the proof that the evidence exists (the hash-chain) needs to be public. Then, in the event of reasonable challenge, the defendent has proof of their valid behaviour and decision making process. That "proof of proof" needs to be mandatory. And if in the event of challenge, if they can't prove that they kept the evidence, they're automatically guilty. And if they have the proof but choose not to present it, we're entitled to reach the same conclusion.

Citizens: Innocent until proven guilty

Authority: Guilty until proven innocent

[david 12]

What Charge?

Around here, there is nothing they could be charged with that has any reasonable chance of success. They weren't stealing anything. "Breaking and entering" is only "for the purposes of committing an offence". "Unlawfully on premises" has a defence of "honest and reasonable mistake of belief". Different locations have different rules, but unless it was a defence establishment or a bathroom I'm not seeing anything.

It's already being played out In public: I don't think it will go to court, and I don't think anything new will come out in court. Possible penalties include getting the men fired, and the company going out of business.

[TRT]

Re: What Charge?

You are very right that different premises have different rules. They also have different laws. Shipyards, railway premises, Crown premises... all very different laws.

[Anonymous Coward]

Cojones

You could not pay me enough to break in to a courthouse at midnight in a country where even security guards carry guns. Were these guys bravely taking their responsibilities seriously, forced into it by their employer, macho idiots?

[Chozo]

Sour grapes of wrath?

Appears the duo also successfully planted an unspecified 'device' inside the Polk County Courthouse on Sept 9th.

source APnews https://www.apnews.com/88df1bce5dd5491083af761758b74554

[Anonymous Coward]

Dumb testers

This was stupid move on the part of the pentesters. When I saw it was Coalfire, I was not surprised. Ive heard a lot of stories of their pentesters pulling these kind of stunts.

[Neoc]

None of this is helped by the USA's (in)famous Federal vs State vs County vs City legal system. For all I know, there may be even more competing legal groups.

[jake]

Our legal system has nothing to do with it. What this is is a typical case of petty bureaucrats playing DSWs. Happens in pretty much every so-called "civilized" country.

[Anonymous Coward]

I googled DSW but all I got was a shoe-shop

[jake]

google isn't a "search" engine.

google is a "make money for Alphabet shareholders" engine. When you use it, you will find whatever makes those shareholders the most money.

You can improve your chances of finding what you are looking for by finding alternatives to google. Start with DuckDuckGo and search on "alternative search engines". The results might surprise you.

It will probably surprise very few of the readers here at ElReg that Eric S. Raymond doesn't pay google/alphabet any money, so his Jargon File stuff rarely comes to the top of googles list. Here's a link that might help you:

http://www.catb.org/~esr/jargon/html/D/DSW.html

[Anonymous Coward]

Sheriff hears from state that the guys are legit, but instead of letting them go and raising his issue with state, he has to act a dickless twat and hold them at the taxpayer's expense because he's in a huff

[jake]

Is this true?

[Neoc]

Actually, he's in a minute-and-a-huff.

<guess what I've been watching on the weekend>

[Anonymous Coward]

I can't really e sure... I've never looked!