From pen-test to penitentiary: Infosec duo cuffed during IT security assessment

guest · Sep 12, 2019

From pen-test to penitentiary: Infosec duo cuffed after physically breaking into courthouse during IT security assessment
Blokes left in legal limbo amid electronic records audit
September 13, 2019
https://www.theregister.co.uk/2019/09/13/pentest_arrest_coalfire/

Two men hired to assess a court record system's computer security were arrested Wednesday – after they were caught physically sneaking into a courthouse.

The two men, who now face burglary charges, said they were attempting the break-in as part of a penetration test the county court had paid their employer, security biz CoalFire, to perform against the court's electronic records system.
In other words, the ethical hacker duo were pen-testers just trying to get physical access to computers managing or storing court records as part of a planned security test.

Here's where things jump the tracks. The Dallas County court officials fully acknowledged they hired the two experts to test the security of their IT system. The bureaucrats were, however, unaware the tests could also involve physical break-ins, it is claimed.
Click to expand...

guest · Sep 19, 2019

Iowa officials claim confusion over scope led to arrest of pen-testers
Rules of engagement covered courthouse and authorized lock picking
September 19, 2019
https://arstechnica.com/information...sion-over-scope-led-to-arrest-of-pen-testers/

In a post to the Iowa Judicial Branch website today, a spokesperson for the state's court administration released redacted images of the documents associated with the security tests that landed two penetration testers in jail earlier this month.

The "rules of engagement" document for the contract shows that the state court administration did request a physical security assessment from the security firm Coalfire.
State officials say that Coalfire's employees interpreted the documents differently than they had. But it would appear that the real problem behind the arrest of Coalfire's team is a turf war between state and county officials—and whether the state judicial administrators had cleared the security tests with local authorities.

At 12:30am on the morning of September 11, penetration testers Justin Wynn and Gary DeMercurio were caught with lock picks inside the Dallas County courthouse by Dallas County Sheriff's Department officers. They presented documents showing they had authorization from the state; the officers contacted state officials on the document, who verified that the test was authorized. But they arrested Wynn and DeMercurio anyway and charged them with burglary.
Click to expand...

mirimir · Sep 19, 2019

The sheriff involved claims that the state had no right to authorize a break-in of county property.

Whoever's at fault, it doesn't seem like it should be Justin and Gary. Except maybe that it was supposed to happen during working hours, not at 12:30 am.

guest · Oct 31, 2019

Coalfire CEO Wants Criminal Charges Against His Employees Dropped
October 31, 2019
https://www.darkreading.com/attacks...-against-his-employees-dropped/d/d-id/1336232

The CEO of cybersecurity services firm Coalfire on Wednesday released a statement pledging to clear two employees of all charges stemming from their arrests by the Dallas County, Iowa, sheriff during a security test at the county courthouse last month.
While charges against Coalfire employees Justin Wynn and Gary Demercurio have already been reduced from the initial felony charges to misdemeanor trespass, McAndrew said the reduction is insufficient.

The Iowa Supreme Court Chief Justice has apologized for the pen test and announced changes will be made to the contracts for any future such tests, including prohibitions on entering courthouse property after business hours.
Click to expand...

Coalfire CEO says Dallas County Courthouse doors were unlocked

guest · Jan 30, 2020

Exonerated: Charges dropped against pentesters paid to break into Iowa courthouse
Dismissal is a victory for the security industry and the customers who rely on it
January 30, 2020
https://arstechnica.com/information...-2-pentesters-who-broke-into-iowa-courthouse/

Prosecutors have dropped criminal charges against two security professionals who were arrested and jailed last September for breaking into an Iowa courthouse as part of a contract with Iowa’s judicial arm.

The dismissal, which was announced on Thursday, is a victory not only for Coalfire Labs, the security firm that employed the two penetration testers, but the security industry as a whole and the countless organizations that rely on it.
The case cast a menacing cloud over an age-old practice that’s crucial to securing buildings and the computers and networks inside of them.

“I’m very glad to hear this,” said a professional pentester when I told him the charges were dropped (he prefers to use only his handle: Tink). “Clients and security firms have an obligation to protect their pentesters and consultants. Pentesters are not criminals. Pentesters help organizations protect against criminals.”
After learning of the pentesting contract, Dallas County Attorney Charles Sinnard reduced the charges, but despite there being no support for criminal intent, he continued to prosecute the two men. In a statement Coalfire issued on Thursday, officials wrote: [...]
Click to expand...

Coalfire CEO Tom McAndrew added, “With positive lessons learned, a new dialogue now begins with a focus on improving best practices and elevating the alignment between security professionals and law enforcement. We’re grateful to the global security community for their support throughout this experience.”
Click to expand...

Coalfire: Charges Dismissed Against Coalfire Employees

guest · Aug 5, 2020

Pen Testers Who Got Arrested Doing Their Jobs Tell All
August 5, 2020
https://www.darkreading.com/vulnera...sted-doing-their-jobs-tell-all/d/d-id/1338570

When they first scanned the cardkey to the front entrance of the Dallas County Courthouse in Iowa, red-team experts Gary De Mercurio and Justin Wynn didn't hear the requisite click of a lock disengaging. It was after midnight on Sept. 11, 2019, the last leg of their penetration-testing engagement for the state of Iowa's Judicial Branch, and they got their first big surprise of that now-infamous evening.

"Justin grabs the door and we look at each other, and I said, 'Did it work?' and he's like, 'No, it's open,'" recalls De Mercurio, a senior manager at Coalfire. "The door was locked, but they hadn't latched it all the way."
So the two social engineering and physical pen-test experts could get a more accurate take on the entrance security, Wynn closed the door and they started all over again with the cardkey, this time with the door locked.
Click to expand...

Aside from their physical pen-testing toolkits, the pair were armed with what they call a "get out of jail free" letter, a written authorization signed by the judicial branch that proved they were working on behalf of the state.
Painful Lessons
It took a state legislative hearing to lead to Dallas County officials finally dropping all charges against De Mercurio and Wynn in late January 2020.

Being able to freely tell their story is liberating; they faced plenty of press scrutiny and even some from the security community about possible missteps that could have led to the legal troubles they experienced.

"It's good to be able to come forth with the details and to be able to validate [our actions]," Wynn says. "On the [legal challenges on] the question of scope, the entire industry rallied around us. Our infosec family took care of us, and we appreciate it."
Click to expand...

Log in or Sign up

From pen-test to penitentiary: Infosec duo cuffed during IT security assessment

guest Guest

guest Guest

mirimir Registered Member

guest Guest

guest Guest

guest Guest

Log in or Sign up

From pen-test to penitentiary: Infosec duo cuffed during IT security assessment

guest Guest

guest Guest

mirimir Registered Member

guest Guest

guest Guest

guest Guest

Useful Searches