Pen Tester Describes Extracting DNA Data and Exposing Network Weaknesses
· 1:38:00 · Watch on YouTube ↗
Summary
Security researcher Greg recounts vulnerability research and authorized penetration tests, including extracting human DNA data on hard drives concealed in a printer and accessing internal networks through a guest Wi-Fi router.
Key points
- Greg says an authorized insider test reached DNA backups after he pivoted through systems and collected additional logins.
- He says he concealed external hard drives in a printer, copied DNA data onto them and removed the printer from the facility.
- In an earlier engagement at the same customer, ARP poisoning exposed a plaintext FTP credential that provided access to a build system.
- During a separate venture capital firm assessment, Greg says he found a guest Wi-Fi password on a whiteboard and gained router access, allowing him to bridge internal networks.
- He also describes using intercepted credentials and cloned access badges to test physical security at the firm.
- An initially publicized Word crash occurred only with a debugger attached; Greg says the research team subsequently found a separate Visio vulnerability.
- Greg alleges a corporate espionage operation involving Microsoft and eEye; the host says he could not confirm the story.
Article Details
- Topics
- [10:49] Early AOL vulnerability research and macro malware
- [27:32] eEye vulnerability research and responsible disclosure
- [31:56] Office fuzzing, a debugger-only crash and a subsequent Visio vulnerability
- [51:20] Unconfirmed allegations of corporate espionage
- [57:17] Insider penetration test and plaintext build-system credential
- [01:04:30] DNA data extraction using hard drives hidden in a printer
- [01:12:54] Venture capital firm assessment: guest Wi-Fi, network access and badge cloning
MITRE ATT&CK
T1078 · Valid AccountsThe testers used an intercepted credential to access a customer's build system during an authorized assessment.T1110 · Brute Force[01:19:23] Greg says he brute-forced a router's administrative password during a venture capital firm's security assessment.T1557.002 · ARP Cache PoisoningDuring an authorized test, Greg's team used ARP poisoning and intercepted a plaintext FTP credential.