Pen Tester Finds Tobacco Company's Trade-Secret Recipes Exposed on Unrestricted SMB File Share
A professional penetration tester, Dahvid Schloss, discovered that a tobacco company had left confidential product recipe files exposed on an unauthenticated SMB file share accessible to any employee on the network. The share, found by scanning for open ports 139 and 445, hosted IT and HR records alongside a folder labeled 'confidential' containing product recipe documents with chemical composition data, all marked 'Do not share'. Notably, the company's Trend Micro antivirus failed to flag active Metasploit and Nmap scanning activity during the engagement. When Schloss reported the finding, the client denied the files were ever real; he was unable to prove otherwise after being instructed to delete his downloaded copy, and the files were later quietly removed from the share, suggesting the company covered up the exposure rather than acknowledging it.
Detalhes técnicos
The tester used Metasploit for exploitation/scanning and Nmap to identify open SMB (ports 139/445) services, finding an anonymous/unauthenticated file share with no access controls protecting sensitive trade secret and HR data.
Remediação
The article implies organizations should restrict access to network file shares, disable anonymous SMB access, ensure endpoint security tools detect active scanning tools like Metasploit and Nmap, and avoid retaliatory denial of legitimate pentest findings.
Linha do tempo
-
Pen Tester Finds Tobacco Company's Trade-Secret Recipes Exposed on Unrestricted SMB File Share
ler a análise desta fonte ocultar
A professional penetration tester, Dahvid Schloss, discovered that a tobacco company had left confidential product recipe files exposed on an unauthenticated SMB file share accessible to any employee on the network. The share, found by scanning for open ports 139 and 445, hosted IT and HR records alongside a folder labeled 'confidential' containing product recipe documents with chemical composition data, all marked 'Do not share'. Notably, the company's Trend Micro antivirus failed to flag active Metasploit and Nmap scanning activity during the engagement. When Schloss reported the finding, the client denied the files were ever real; he was unable to prove otherwise after being instructed to delete his downloaded copy, and the files were later quietly removed from the share, suggesting the company covered up the exposure rather than acknowledging it.
Technical Details
The tester used Metasploit for exploitation/scanning and Nmap to identify open SMB (ports 139/445) services, finding an anonymous/unauthenticated file share with no access controls protecting sensitive trade secret and HR data.
Remediation
The article implies organizations should restrict access to network file shares, disable anonymous SMB access, ensure endpoint security tools detect active scanning tools like Metasploit and Nmap, and avoid retaliatory denial of legitimate pentest findings.