Re: [PEN-TEST] PBX Security

["Loschiavo, Dave" <DLoschiavo () FRCC CC CA US>]

<quote> It's unfair to use a known back-door when pen-testing.  The
back-door on Norstar is pretty hard to stumble across, but it is nice to
know the default passcodes, and test for things like that.  Good luck!
</quote>

If it is known (heck, or even if you are the only one who knows it), why is
it unfair? If you were able to find it, via social engineering, why can't a
hacker. The way I look at, if a back-door has a hard coded (or unchanged
default) method for allowing access, then it is a security hole. Isn't that
what a Pen-Test is supposed to uncover?

Thoughts? Comments?