I Can Pillage Your Castle Without Climbing the Walls - WST

One trend we have noticed in our Penetration Tests is the difficulty of getting a presence on internal networks has gone up over the past few years. Many organizations have implemented good multi-layered defenses to keep out malicious code. Between good spam filtering, behavior-based endpoint security, and executable sandboxing, our engineer’s job at getting remote access to end-user workstations has gotten a lot harder!

The bright side for us, and the reason our success rates have remained steady or even gone up a bit, is that we don’t need to get into your network to get your data.

Remote email access, or webmail, continues to be a common place we find weakness. Rather than try to get users to run a malicious attachment, we simply ask them for their password, often via a fake logon page. With access to a user’s login information, and webmail (like Microsoft365), we have access to all the information we need. Think about what can be found in a standard user’s mailbox...attachments, reports, spreadsheets, notes with password lists are common. All the information a Bad Guy™ may need, all without setting virtual foot inside your castle.

Remember to look carefully at webmail and other online services where information may reside when reviewing security controls. Here are a few things to consider:

Authored by: Jeremy Johnson, OSCP, CISSP