Re: proposed pen-test

[krymson () gmail com]

If you have access to the mailboxes of the department, could you just slip them in with some prepared wear-and-tear on 
the packages and maybe a stamp making it look like it has been processed? Of course, now you're just pretending to be 
the real post instead of actually using them!

One problem with USB keys and social testing would be any effects if your targets take the devices home to check them 
out, or give them to a student or friend or family member. There's no way around that or to anticipate every use-case, 
but it is something to think about.

If the device does anything strange whatsoever to a system, that person may contact the popular social networking site, 
and then you've got a problem brewing.

How unlikely that situation may be is probably up to your own risk acceptance... I'd personally hope that such a test 
would be acceptable, since an attacker won't stop at such issues.



<- snip ->

Hi--

A consultant firm has recommended to my university's IT department
that we run the following pen-test:

We send, through regular mail, a letter to members of the staff and
faculty, that appears to come from a well-known social networking
site, that is, it uses a facsimile of the actual letterhead and
envelope of the site, including the correct return address. In this
letter, we invite the recipient to beta-test a new version of the
social networking site by using the program on the enclosed usb stick.
We offer a gift card to a major online retailer as further inducement.
If any staff member plugs in the usb stick, they will be told in a
pop-up window that they have been duped, and the fact will be logged
to a server at the university.

It seems to us that there are two potential legal problems here:
impersonating the social networking site, and using the US postal
service for a fraudulent, if well-intentioned, purpose. Can anyone
here comment on this?

Beyond the legalities, does this seem like an effective and worthwhile test?

Thanks for any insight.

------------------------------------------------------------------------
This list is sponsored by: Information Assurance Certification Review Board

Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT 
and CEPT certs require a full practical examination in order to become certified. 

http://www.iacertification.org
------------------------------------------------------------------------