Description:

Copied directly from :Chris John Riley blog http://blog.c22.cc/2010/09/25/brucon-top-5-ways-to-destroy-a-company/ Top 5 ways to destroy a company (Chris Nickerson) No one cares about your findings. We work all day and the ignore your reports! Well why does that happen? * What we give them isn’t important. Managers don’t care about shells! * They don’t care about what we care about! What do they care about? * The product line * The brand * The employees * The bottom line What do you know about the company’s product line? If you didn’t research it, then why not! Don’t you think you should care about what the company cares about. How do you figure out whats important * Step 1: Your opinion doesn’t matter (unless you’re one of the execs that really are in the know) * Step 2: Think like them. You need to translate your speech to something they understand. * Step 3: Do work.. not on shells, on process, models, information If you get paid to just go in and hack fuck somebody, then you’re a prostitute. What kind of stuff are you looking for? * Secret * Confidential * Internal Use Only * Public Going for the secret stuff is great, but what if the Confidential stuff gives you access to the secret stuff? what if the public stuff should be secret? The business understand CIA (Confidentiality, Integrity, Availability)… all of these factors link into criticality. If you don’t do this, you’re a bad tester! Customer needs to give you information on what assets exist, the risks, and therefore how critical it is to a company. Sometimes you’re wrong… email isn’t the most important thing in your company! You only have a limited time to test, you don’t have an unlimited time to test like blackhats do! Top 5 ways to destroy a company * Tarnish the brand * Alter the product * Attack the employees * Effect financials directly * ** Your turn! ** Tarnish the brand (How to do it) * Understand the brand * Identify key words to market * Knowledge of the competitor advantage/disadvantage * Intelligence profiles on the “keepers of the brand” o Face of the brand o Executives o Key personnel o Entire marketing/design team * Reverse engineering the “go to market” * Take over the “indicators of quality” o False issues (product misdirection) o Negative reviews o Use by non standard customers o False company response Alter the product (How to do it) * Compare listing of products/services depending on the organization * Chain of command for product development or service integrity * Historical review of the products timeline * … Attack the product (How to do it) Company specific! * Software companies o Create bugs o Make backdoor (then tell the media) o Cause errors in function o Add hidden features! o Divert their code to your servers…. * Hospitals o Change patient diagnosis o Attack HVAC and crank the heat o Disable critical alerts o Attack crash carts to disable on the fly care o Attack narcotic dispensing stations o Alter patient doses * Manufacturing plants o Alter the product line (make something different) o Change design specs o Speed up the line… overflow o Slow down the line… underflow (deadlines) o Add or remove the product features o Decrease quality o Break shit.. a lot Attack the employees (How to do it) * Profile who they are (Nessus doesn’t tell you that!) * Find out where they live * Figure out what “dangers” they might have at the office * Figure out there daily routine then make a kidnapping profile * Use the company against them o Food? o Manufacturing equipment? o General Terrorism