Penetration Tester Describes Entering Data Center Through Sewer Tunnel

Summary

Maxi Reynolds recounts authorized physical and network penetration tests, including access to a data center through a sewer service tunnel and an accidental disruption of a city's water supply.

Key points

• Reynolds said she entered a transport company by impersonating a representative from its Swedish office, but was detained after an employee challenged her.
• During an authorized local-government network test, she said she accidentally shut off a city's water supply. The duration of the outage was unknown.
• At a logistics warehouse, Reynolds entered through an open upper window and reached unlocked terminals; an unalarmed loading door provided an exit.
• After the client expanded the test's scope, she moved several trucks using keys left in or around them and reported gaps in perimeter security and key control.
• At a data center, social engineering attempts failed, but Reynolds said her team used municipal plans to find a sewer service tunnel that led inside.
• Reynolds argued that underwater data centers can improve physical security, while acknowledging that their digital security footprint remains similar to other data centers.

People

Countries

Industries