- OSINT Investigation
- Penetration Test
- Blackbox
- OWASP
- E-reputation
- Retail industry
- Web Application Testing
Key challenges
2019 was the worst year ever for data breaches and online security. Because of their vast attack surfaces, brick and mortar stores and e-commerce sites have received the unwanted attention of cyber criminals. The combination of “swipe-to-pay” technology and the millions of transactions happening every minute have awarded the retail industry the second most often cited sector to suffer data breaches in 2019.
At the root of these issues are poor security standards, low investments and lack of concern from retailers regarding the storage and management of payment data.
What can retailers do to protect themselves and their customers?
While no organisation can ever claim to be 100% secure and at zero risk of a cyber attack, there are a few steps to take in order to address the risks and eliminate critical vulnerabilities. This includes regularly taking a critical look at ones’ infrastructure, processes, systems and controls.
As the oldest fine leather luxury goods house in the world, our client has a strong brand image which must keep up with the prestige of the products it offers. The company needed a security partner to assess its security maturity and identify potential vulnerabilities.
The ultimate objective was to prevent any reputational damage caused by a lack of security. The secondary objective was to map the attack surface to raise visibility, understand the risks and identify the parts of the environment that needed security vulnerabilities testing.
Our approach (OSINT & Penetration Testing)
We performed a penetration test upon the client’s main website, and other related websites that we discovered.
The engagement was considered a blackbox testing. Following the OWASP standards we performed an extensive reconnaissance where we were able to map the entire surface and continued digging for vulnerabilities which could compromise the environment.
We carried out an OSINT Investigation, whose objective was to collect information about the company from publicly available sources to pinpoint the vulnerabilities that an attacker could leverage in a social engineering or phishing attack.
To do so we used a couple techniques:
Public search engines
Find the content of emails, discover email patterns, use satellite images or videos to determine geographic location of a client’s premises.
Domain Name System (DNS)
Detect and list all possible DNS records for the client’s domain name including hostnames, DNS records, IP addresses, etc.
Social media
Scrapping email addresses, phone numbers, employees’ full names, screenshots, pictures of the premises and company assets.
Website
Reveal hidden information leaked in the website code like emails, comments, software versions, etc.
After presenting the various flaws we had identified further following our methodologies, we gave the customer our recommendations based on best practices and trusted actors in the cyber security world.
Benefits
We were able to compromise not only the organization’s infrastructure but also important personal data. These issues (i.e., URL, falsification, email addresses impersonation) revealed via the OSINT investigation could have been abused by malicious actors and caused serious reputational damage.
Instead, the client has received invaluable feedback on how to secure its perimeter and resolve its current issues in an efficient way. At the conclusion of this penetration test, our cyber security experts gathered evidence, documented their exploit step by step and developed a remediation plan compiled in both technical and high-level reports.
We followed up with a review meeting involving the client’s key stakeholders to present the findings, recommendations, and next steps to prevent such issues from appearing in the future.
The highest value of this penetration test was not only the help in remediating current issues but also the creation of a mindset and reflex to think about security when implementing new functions in the future.
Thanks to our
Author
