From: Jay D. Dyson (jdyson@treachery.net)
Date: Sat Aug 05 2006 - 11:43:36 EDT
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On Sat, 5 Aug 2006, itsec.info wrote:
> I have a client who is a very high powered Executive and he asked me to
> check his notebook regarding security etc.
>
> Actually this would be any easy task but he is not willing to hand over
> his notebook to me and I am not allowed to retrieve any data from it.
Sounds like part of your job is to determine how easy it is to
steal his notebook. That's what I call a fun assignment.
In that arena, I prefer to get a notebook of identical appearance
and disable it (disconnect its video strip; usually works best). Then
have a co-conspirator do the swap while you distract the mark. The mark
will think his notebook simply isn't working and not suspect a thing.
Most importantly, he won't suspect you because you were right in front of
him when his notebook took a powder.
Do this sort of thing about an hour before quitting time; on a
Friday is best if he's not the type to cut out at 3 PM to go golfing.
That'll leave you all evening (and possibly all weekend) to have an
interesting time with the goods.
When you're done, swap the "broken" notebook out and replace it
with the original. The mark shouldn't suspect a thing. Then scare the
bejeezus out of the client when you present your report.
If the client should protest your methodology, point out that you
did nothing that wouldn't have been done in any other garden-variety case
of corporate espionage. Then deliver the Seven Beatings of Enlightenment.
> The only idea I found so far is to re-direct the notebook's Internet
> traffic through a proxy and then I can examine this traffic and give him
> some advice.
That's good, too. Most Pointy-Haired Bosses (PHBs) think their
e-mail is only read by the intended recipient. Same goes for their
surfing. Lots of stories on that count, but I ain't goin' there today.
- -Jay
( ( _______
)) )) .-"There's always time for a good cup of coffee."-. >====<--.
C|~~|C|~~| \------ Jay D. Dyson - jdyson@treachery.net ------/ | = |-'
`--' `--' `------- I put the 'male' in malevolent. -------' `------'
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (TreacherOS)
Comment: See http://www.treachery.net/~jdyson/ for current keys.
iD8DBQFE1Ly4AAI/KXdPiuQRAjWoAJwOA2Hd6DxT5Rd6/aOtuH5bxD580gCeJsnw
JxJQVwMXdfHf1i0vrAk8g6w=
=tIOQ
-----END PGP SIGNATURE-----
------------------------------------------------------------------------------
This List Sponsored by: Cenzic
Concerned about Web Application Security?
Why not go with the #1 solution - Cenzic, the only one to win the Analyst's
Choice Award from eWeek. As attacks through web applications continue to rise,
you need to proactively protect your applications from hackers. Cenzic has the
most comprehensive solutions to meet your application security penetration
testing and vulnerability management needs. You have an option to go with a
managed service (Cenzic ClickToSecure) or an enterprise software
(Cenzic Hailstorm). Download FREE whitepaper on how a managed service can
help you: http://www.cenzic.com/news_events/wpappsec.php
And, now for a limited time we can do a FREE audit for you to confirm your
results from other product. Contact us at request@cenzic.com for details.
------------------------------------------------------------------------------
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:56:33 EDT