Comment by petcat

Comment by petcat 3 days ago

I might be mistaken, but it sounds like these guys showed up at a facility and did the classical "breaking and entering" thing. The onsite (terrified) staff called 911, the police showed up and arrested them. The perps said that they were hired to do this (they were), but nobody told the Sheriffs office or the staff about it.

So yeah, it sucks for these guys' reputations and criminal histories, but... what? The onsite staff didn't know what was going on, the Sheriffs didn't know what was going on.

The county basically said: "We want you to go try to break into this government building. We aren't going to tell the staff or the local police about it. Tell us what you find."

wat10000 3 days ago

If the sheriff had found out what was going on and then let them go, this wouldn't be news.

If the sheriff had arrested them and found out in the morning what was going on and then let them go, this wouldn't be news.

If the sheriff had arrested them and brought them before a judge who let them go, this wouldn't be news.

What actually happened is the sheriff found out what was going on, decided it was still criminal anyway, arrested them, and then the county charged and prosecuted them. The charges were eventually dismissed. That is why it's news.

And icing on the cake, the current county attorney disagrees with the dismissal done by his predecessor, and says that he will prosecute any future incidents of this nature. https://www.kcci.com/article/coalfire-contractors-settle-dal...

Reply View 0 replies

aksss 3 days ago

Definitely some things could have been done a bit differently. I get that they want to keep staff in the dark, and even beat cops, but it seems reasonable and prudent to have the highest level of local law enforcement brought into the loop in planning red team exercises. The likelihood is high that the team will interface with law enforcement. The escalation path within the enforcement side of the state regulatory machine should be cleared in advance.

I think the takeaway for security teams is that you shouldn't let the customer "authorize" what is otherwise criminal activity warranting a police response without getting some air cover from the enforcement side. Coordinating that is the customer's burden to bear and that cover should be secured before letting them hand-wave away the risks with a "just have the police call me and I'll clear it all up". In hindsight only, when you look at it like that, the security team was not covering their ass appropriately. In a perfect world, you'd assume there's some better planning and communication going on behind the curtain. In the real world, you need more than the flimsy "guarantee" of calling a guy who knows a guy in the middle of the night. At the very least, that get out of jail free card should have had as signatories judiciary representation and enforcement representation (e.g. sheriff).

Reply View 0 replies

unsnap_biceps 3 days ago

you are mistaken. There was no (terrified) staff present. The building was empty and they tripped an alarm on entry.

Reply View 0 replies

noitpmeder 3 days ago

Did you even read the article or review the story? The police showed up, reviewed and even verified their documents (called the numbers on the form to confirm their authorization) and we're seemingly satisfied all was in order.

Only once the sheriff himself arrived on scene did he order the arrest that caused all the issues. If that didn't happen it wouldn't have been a story other than "security professionals doing their authorized job".

Reply View 1 reply

Aurornis 3 days ago

> reviewed and even verified their documents (called the numbers on the form to confirm their authorization)
Apparently there's more to this story. From the original article https://arstechnica.com/information-technology/2019/11/how-a...
> Another reason for doubt: one of the people listed as a contact on the get-out-of-jail-free letter didn’t answer the deputies’ calls, while another said he didn’t believe the men had permission to conduct physical intrusions.
It's actually kind of amazing that the police first let them go after the official contact on the form said they were not authorized to intrude in the building.

Reply View | 0 replies

QuercusMax 3 days ago

Did you read the article?

They broke in and set off an alarm, the local cops responded, the pentesters showed their credentials, and there was no issue.

Then the sheriff arrived, was butthurt because he felt left out and wanted to show his authority, and caused these guys 6 years of grief for literally no reason at all.

Reply View 1 reply

petcat 3 days ago

> the local cops responded
Extremely dangerous and irresponsible for the county not to alert the local police and Sheriffs office that this operation was taking place.
I'm glad these guys got their money.

Reply View | 0 replies

sowbug 3 days ago

> I might be mistaken [snip].

FTFY

Also - a red-team exercise doesn't work if you tell the targets that they're about to be tested.

Reply View 4 replies

petcat 3 days ago

Sure, but that's different than not telling the local police department. Because they will show up with K9s and guns. And then it becomes a very dangerous situation.

Reply View | 3 replies
- mindslight 3 days ago
  
  That sounds like a problem with police procedures and accountability. It's weird to blame potential victims for that.
  And in this case, notifying the police would have seemingly affected the test. Based on the reaction they did have, I would guess such notification would have resulted in the police doing many more drive-bys of the courthouse and generally being alert.
  
  Reply View | 2 replies
  
  mikkupikku 3 days ago
  
  > "That sounds like a problem with police procedures and accountability"
  It would be supremely stupid to not plan and account for these kind of systemic social problems when you're planning out your contract to break into a building. "But they're the ones who suck, I did nothing wrong" won't bring you back from the dead.
  
  Reply View | 1 reply
  
  mindslight 2 days ago
  
  Sure, in the pragmatic sense I agree. If I was going to put myself in this type of situation, and the agency authorizing the test did not want to bring the agency that would be responding into the fold, I'd be contemplating things like having an employee or even some state official be physically present at the police station / dispatch when I was actually doing the pentest.
  But the commenter I was responding to seemed to be leaning on the territory of what ought to be, in which case it's good to not normalize those societal problems.
  
  Reply View | 0 replies

edm0nd 3 days ago

why even bother commenting if you didnt even read the article. You just spewed out a bunch of bullshit nonsense of nothing that happened lol

Reply View 0 replies