The 99c Heart Surgeon (Updated & Annotated)

This presentation, originally held at BruCON 2011, was voted to be held again at the 10 year anniversary of BruCON in 2018.

Let's assume you need heart sugery. I hope you don't, but let's just stick with it for a minute. How much would you be willing for someone to fix it and who would you hire to do it? If you are a suicidal emo kid, please do not answer, you are ruining the point here. Here's the thing: People want someone suitable and knowledgeable to cut them open and sew them up again and they are willing to pay good money for it. Here are two things you don't want to do:

1) You don't want to hire some old drunk with a pocket knife and a sewing kit from the dollar shop which claims to fix your heart for 100 bucks.

2) You don't want to hire the same guy for 100'000 bucks when he's wearing a white coat and got shiny high tech tools because the last guy paid in advance...

What does this have to do with penetration testing? More than we like, unfortunately. I have met companies that invested thousands of dollars, expecting a pentest and getting a spiced up Nessus report as a result. More subtle nuances of "crappy pentest" might overlook essential threats and leave customers at risk with a false sense of security.

This talk will explore the common mistakes made when performing pentests, which includes the test itself, as well as pre- and post-engagement matters. Also, it applies for testers and customers alike. Also, it might help saving the rainforests.

While revisiting this talk from 2011, we will look into the question: Have things changed for the better and do we still face the same issues?

Transcript

1. BruCON 0x0A – Retro Talk The 99¢ Heart Surgeon Dilemma Extended Annotated Version Stefan Friedli stefan@stefanfriedli.ch @stfn42
2. Hi, I’m Stefan
3. 2570 days
6. Improving Penetration Testing
16. But wait, there is more!
17. • Accidentally pasting other customer names • General copy&paste weirdness (Font Mismatch...) • Spruced up Nessus reports • Horrible, horrible false positives • Pentesters beaten by rudimentary obstacles
18. “It’s easy to use cynicism as a protection mechanism for your own insecurities (...) You might be in a position right now in which you can stand on the sideline and heckle other people’s work without ever having to step up and present a better way to do things, but a time will come when you will be replaced by somebody who does not talk smack about other people’s ideas, but embraces these ideas and adapts them with his own security mindset to improve the overall product.” Me, unfortunately.
19. Let’s make things better.
20. “Never attribute to malice that which is adequately explained by stupidity.” “Hanlon’s razor”, Robert J. Hanlon
21. Bad Faith vs. Lack of Experience/Knowledge vs. Human Error
22. • Most of them don’t last long. • Avoiding them is mostly doable • Ask about procedures, standards • Ask to talk to the testers • Check for community participation • Look at sample deliverables. Look closely. • Be ready to walk away. Let’s talk about charlatans
23. The Attacker’s Mindset
24. • We like puzzles. • Nobody ever said “No” to more time. • We want to exceed expectations. • We like a broader scope. Why pentesters are pentesters:
25. The Buyer’s Mindset
26. • We want to identify vulnerabilities. • My boss is making me do it. • Compliance is making me to it. • I want to test my blue team. • I want to simulate a realistic attack. Why people buy pentests
27. Taxonomy
28. twitter.com/coffeetocode
29. Scope. Scope. Scope.
31. MITRE ATT&CK
32. Pentests are more than a report. Sometimes you barely need one.
33. How to fix Penetration Testing (One Slide Edition) Involve more people. Have more conversations. Don’t stop at the report.