{"id":126785,"date":"2026-05-14T07:22:47","date_gmt":"2026-05-14T07:22:47","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2026\/05\/14\/to-gain-root-access-at-this-company-all-an-intruder-had-to-do-was-ask-nicely\/"},"modified":"2026-05-14T07:23:50","modified_gmt":"2026-05-14T07:23:50","slug":"to-gain-root-access-at-this-company-all-an-intruder-had-to-do-was-ask-nicely","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2026\/05\/14\/to-gain-root-access-at-this-company-all-an-intruder-had-to-do-was-ask-nicely\/","title":{"rendered":"To gain root access at this company, all an intruder had to do was ask nicely"},"content":{"rendered":"

<\/a>\n
<\/p>\n

\n

Safety<\/p>\n

Human IT managers thought they have been being good to the boss, however have been helping a menace actor<\/p>\n<\/div>\n

\n

PWNED<\/span> Welcome as soon as once more to PWNED, the column the place we allow you to put together for safety success by learning others\u2019 embarrassing failures. In the present day\u2019s horrible story entails people making an attempt to do proper by an organization government by letting their guard down, by no means a wise transfer.\u00a0<\/p>\n

Have a narrative about somebody leaving a gaping gap of their community? Share it with us at\u00a0pwned@sitpub.com<\/a>. Anonymity is obtainable upon request.<\/span><\/p>\n

Our unhappy story comes from Brandon Dixon, who at the moment serves as CTO and co-founder of AI safety agency Ent<\/a>. In a previous life, nevertheless, Dixon was a penetration tester for rent and he noticed some issues that made all my remaining hairs stand on finish simply listening to about them.<\/p>\n

Throughout one pentesting project, Dixon tried to learn how simple it might be to steal somebody\u2019s account utilizing social engineering. The reply: barely an inconvenience.\u00a0<\/p>\n

Dixon telephoned IT safety and pretended that he was the top of safety who had misplaced his password. Once they requested him problem questions, he mentioned he had forgotten the solutions to these additionally.\u00a0<\/p>\n

Then he gave them the password he wished to make use of over the cellphone they usually did a reset for him. After that, he was in a position to get into the community and do no matter he wished there.\u00a0<\/p>\n

There\u2019s a lot that\u2019s clearly incorrect right here that it\u2019s laborious to know the place to start with our lesson-taking. The IT help brokers shouldn’t have taken Dixon\u2019s phrase that he was the safety supervisor, particularly after he failed problem questions, and may have denied his request to reset the password. They have been in all probability considering \u201cthis man is an government and we don\u2019t need to piss him off\u201d moderately than \u201cwe now have procedures that everybody should comply with.\u201d<\/p>\n

The opposite downside right here is that the IT division entered Dixon\u2019s steered password for him over the cellphone. Initially, the IT division ought to have despatched a password reset to the true worker\u2019s e mail or cellphone quantity. Second of all, it\u2019s piss-poor safety for anybody to know a consumer\u2019s password apart from the consumer themselves. And I say this as somebody who used to work for a corporation the place, for those who had an issue, the IT help individuals would ask in your password through chat.\u00a0<\/p>\n

Dixon additionally shared one other story about social engineering from a time when he consulted for a pharmaceutical firm. Members of the competitors would name gross sales and advertising reps, fake they have been coworkers, after which extract details about upcoming medication. This is able to enable opponents to know what was coming and the way to reply to it.<\/p>\n

To assist remedy the issue, Dixon instituted a system the place actual staff needed to give a secret password initially of a dialog.\u00a0<\/p>\n

\u201cI constructed a system referred to as ‘Chal-Resp,’ brief for ‘challenge-response,’ that generated work pairings so a consumer may validate they have been talking with an precise worker,\u201d he informed The Register<\/span>. \u201cThe caller would wish to say the phrase and the end-user would wish to reply with the correct problem; solely staff had entry.\u201d<\/p>\n

What each of Dixon\u2019s tales have in frequent is the proof that people are desperate to please and be useful. However suspicion is the entire root of infosec, so it behooves us all to be rather less useful to strangers within the office.\u00a0\u00ae<\/p>\n<\/div>\n