“This next heist will be far more daunting. It will take years of planning and—oh no way, it was changed to ‘Louvre1’”
Louvre2026
“okay, i’m gonna need about five min- oh!”
Proving once again that humans are the weakest link in your security chain. No firewall or other security protocol matters when people are too lazy to use more secure passwords (or just click on random links in their email).
I once read an interview with a white hat hacker. He said that people expect him to try to remotely connect to their network and try to brute force his way in. The first thing he actually does is put on a suit, visit the company’s headquarters, walk in the front door, start a conversation with the receptionist, and see how far he can get.
I’ve done exactly that, worked as a Red Team Lead, and the success rate is pretty disturbing. That, and vishing - calling people from the company you find on Linkedin from a spoofed number of their IT that they fucked something up and need to download and run this .exe to fix it before The Audit that’s currently happening notices it.
Even if we do internal infrastructure tests where they let you in, switch AVs to “detect mode” instead of “block mode” and the goal is to find as many unpatched systems/vulnerabilities as you can (instead of, well, testing the AV solution), what we usually do is run a password spray for all domain accounts with a combinations (you can try like 3 to not lock the accounts) of “<month><year><companyname>” we every single time got at least few accounts.
Fortunately this kind of tests are getting more popular, and passwords such as this should’ve definitely been caught in some kind of security test. But it is also pretty depressing, when you repeat the same test next year, and 80% of the passwords are still the same, and vulnerabilities are still not patched.
This reminds me of an excellent episode of Dark Net Diaries, “Jeremy from Marketing”. https://pca.st/episode/52252c9e-e4a8-42f6-85f5-f162ec3f6b40
was that the one where the corporate security was unexpectedly S-tier and ended up with him getting dogpiled by security guards after their IDS caught him popping powershell on his work machine?
I’ve done quite a bit of freelance work and visited various office spaces with multiple companies in a single building. It was pretty common just to call to the building reception and tell them that I’m working for this-and-that-company upcoming weekend for their network stuff and I’d need access to network cabinets and whatnot and they’d have keys ready for me with very little (if any) verification if I’m actually doing what I’m supposed to or if I am who I claim to be. Some of the locations just handed me keys with access to practically everything, including shared server rooms hosting their CCTV setup, key managing servers and all.
So, just get a name tag with a local operator logo and clothes to match and ask nicely. You’ll get access to a lot more than you think.
In marching band, I learned you can get pretty much everywhere with a white polo, black slacks, and (optionally) an instrument. The same usually holds true for a hi-vis vest and jeans.
Not the onion?
Not surprising tbh.,I’ve been in a security meeting before where the owner of the company just said outright his password was written in big letters on the outside of the building we were sitting in. Some people really have zero sense for security or just don’t care.
One time I got written up for stating that “failing to take cyber security seriously creates a massive potential liability” for the company. Apparently that was “out of line.”
Well you know what else is out of line? Critical infrastructure organizations (i.e. utilities) that don’t take security seriously.
I do not miss that dumpster fire.
I would really like to see companies held more accountable for their data security. If data gets leaked through some security breach, regardless of the criminality of the perpetrators of that breach, if it contains sensitive data like unhashed passwords, credit card or other personal data, and other potentially even more sensitive stuff (medical, financial), the company that was supposed to secure that data needs to be held liable too.
Any company that stores any of that kind of data, needs to have real security experts on board and listen to them. If you can’t, don’t store that kind of data.
I grew up having to learn everything about network security at home, on a windows PC, in a family with no regard for the concept of internet security because basically the idea didn’t exist yet. I was the one who scrubbed the PC every week and removed the 1300 toolbars and spyware apps, I was the one who had to repair the registry every time a sibling downloaded a file sent to him by a “hot girl” claiming it was a picture of her boobs.
So it’s maddening now working in a company of adult humans who are so bad at safety and security that our workstations have even had their settings menus neutered because everyone is so bad at security. Yesterday someone asked how to install the file they received in email titled “security update, please install asap!” from “rnicrosoft. com.”
my company doesn’t even allow passwords. everything is TPM+PIN/passkeys/FIDO2 from company managed devices on VPN… for the “low security” side.
Nice. Meanwhile at the place I work, they have mandated 15+ character passphrases that must have a capital letter and a symbol, that must be changed every 6 weeks, but banned the use of password managers. They also block yubikey and similar hardware tokens from corporate devices at the USB driver level, because “to stop the hackers!”. The only 2nd factor auth they allow is Microsoft Authenticator, and Windows Hello. At least it’s something I suppose.
I use my dog’s name as password for my WiFi.
Ed&1e.78x!
We call him Eddie for short.
Little Eddie Tables
you got your dog from elon and the one chick and kept the name
Haha you fool. I’m in.
Now what…
Look at a bunch of weird stuff on social media to screw up the targeted ads for their IP address
lol I louvre it!
Not even in verlan? Vrelou would have been at least amusing.
Verlan is one of my fav French gimmicks, je le trouve drôle
Ledrô even
No 1 at the end of it. Rookies.
Biometrics plus Fido key is the way to go.
Just hand over all your biometric data to a private company that definitely won’t sell them on, Promise!
No. It’s my biology.
I was mostly talking about the yubi key bio.
Further reading the fingerprint is still relying on you remembering a numeric pin. (Which is usually someone’s birth year)
Hardware keys use biometics as a password to unlock a key or OTP code. Your fingerprints never leaves the device.
So I’ve heard
