Pen - Test technique: Shred diving

[Mike Shaw <mshaw () wwisp com>]

Don't know if this will pass list muster, but I just had a great time in a 
client company's shredder bin.

This was a very inadequate shredder, very wide 'noodles' and no 
cross-shredding.  I've always disregarded the shredder bin because I 
thought it'd be too much trouble, but this is definitely not the case.

I was able to reconstruct a page of text in about 20 minutes.  This 
particular page was not very useful, but it proved the point.

The big bananas were a list of routers, IPs, and circuit IDs, and (drum 
roll...) a complete company employee roster including salaries (including 
CIO!).  These were printed landscape, and because there was no 
cross-shredding, the records were in very convenient strips, like they came 
from a fortune cookie.  One handful and 15 minutes of sorting made a very 
attractive list.  I don't know if anyone has coined a term for this yet, 
but I dubbed it "the fortune cookie effect".

<technical muse>
I'm toying with the idea of a "shred-cracker".  Basically you would scan 
the strips in, then the program would reconstruct them in every possibility 
and pass it through an OCR library.  When the OCR started hitting 
recognizable words, it would 'lock' those strips in place.

Sadly, my coding skills aren't really up to this project and even if they 
were I don't have that time.
</technical muse>

Anyway, if anyone is doing a pen-test that involves physical security, 
don't overlook the shred bin!

-Mike


----------------------------------------------------------------------------
This list is provided by the SecurityFocus Security Intelligence Alert (SIA)
Service. For more information on SecurityFocus' SIA service which
automatically alerts you to the latest security vulnerabilities please see:
https://alerts.securityfocus.com/