Pwned Me a N00b

The following is a Medieval tale of treachery gone awry. Its origins date back to my time working at InGuardians: we had a client who had an employee who was convinced that his boss was wasting money hiring a professional security consulting firm. He was pretty sure that he knew waaay more than those “InGuardians dudes” and, to prove his point, he planned a little stunt. He decided that when we started doing our testing, he would try “hacking back” just to see if we were being careful - if he found anything “fun,” he would use it to make us look foolish to his boss.

I was the one doing the testing… and I’m always careful.

Imagine his surprise when he found out how incredibly easy InGuardians was to hack…

nce upon a time, a noble knight of the InGuardians clan was asked by a client to perform a penetration test against that client’s network. Late one afternoon, the noble knight began his testing, and lo!, there was much 0wnage to be had.

While the knight was doing his heroic deeds, little did he know that a plan was hatching in the mind of one of the client’s minions. “Those knights aren’t nearly as cool as everyone makes them out to be,” thought the minion, “I believe I shall try to show them up.”

Now the noble knight had been required by the client to provide details describing the “location” from whence his testing would proceed. Thus, the minion - armed with this knowledge - did plan a counter-attack against the knight, thinking that the knight would be using some type of “Live CD” to do his testing.

nd it came to pass that the minion attempted to log into the knight’s system via “ye olde SSH” in a vain attempt to disprove the rumors of the knight’s coolness.

Unfortunately for the minion, he forgot that knights always wear armor.

Thus, due to a truly awesome network / routing setup on the part of the knight, when the minion “hacked back” at the knight’s location, the minion did find himself logged in as “root” on what appeared to be the knight’s testing machine.

And there was much rejoicing - and giggling like a schoolgirl - as the minion began planning to reveal his treachery.

But, as he looked around, attempting to gather information on the knight’s system as proof of his superiority to the knight, the minion began to feel, more and more, that something was amiss. The system seemed oddly quiet… too quiet. In fact, it appeared that the minion was the only one logged in…

The minion logged off and then back on. All together, he logged into what he believed to be the knight’s machine three times, and issued many commands… but alas, everything seemed wrong.

lowly it began to dawn on the minion that perhaps things hadn’t worked out quite as well as he thought. He began to get the idea that he had stumbled into a trap.

He went to his master and slowly and fearfully admitted all that he had done. His master was - to put it mildly - displeased. Shocked at the stupidity of his minion, the master explained the concept of a “honeypot” and then ordered the minion to contact the InGuardians clan, make penance, and hope that the clan would be merciful.

he knights of the InGuardians clan are nothing if not merciful. They chided the minion but forgave him, telling him that they hoped he had learned a lesson.

And, to make the lesson perfectly clear to both the minion and his master, they showed the minion that the result of his treachery was forever etched into the fabric of the Internet by the Twittering of a bird.

And, once again, there was much rejoicing - this time by the Knights of the InGuardians clan.

Therefore, I beseech of you: Go forth and do good things - always remembering that every time you hack back, God kills a kitten.

-TL
Tom Liston
Owner, Principal Consultant
Bad Wolf Security, LLC
Mastodon: @tliston@infosec.exchange
Twitter: @tliston
June 28, 2016