Re: Boot floppy

["Thor (Hammer of God)" <thor () hammerofgod com>]

I don't think anyone's missing the statement -- people are just (in my mind 
rightfully) suspicious of these types of scenarios where there are a million 
other things that could be done that actually solve the problem.  It's the 
company's computer.  They think this guy is stealing from them like someone 
else already did.  But, even though the OP's the administrator of a computer 
his company owns, he has no access to it and the admin account is disabled, 
and they can't get the guy to run a rootkit any other way.  So they want to 
figure out how to root the box without any boot tools, auto-runs, reboots, 
or anything else while the guy is taking a whiz so they can see if he is 
stealing intellectual property all because they are worried about hurting 
his feelings.  It just doesn't sound right.

Seize the box and perform forensics on it and be done with it.  Then have a 
set policy put in place to keep stupid things like that from happening 
again.

t

----- Original Message ----- 
From: "Shreyas Zare" <shreyas () technitium com>
To: "Pen-Testing" <pen-test () securityfocus com>
Sent: Thursday, April 12, 2007 8:47 AM
Subject: Re: Boot floppy


> Hi,
>
> Everyone almost is missing Mifa's statement which is, "Any other ideas
> how we maight gain access? It has to be fast (bathroom breaks ect). I
> dont have time to load a live cd. Further, robooting would cause the
> user to loose work."
>
> This means he has to do it quickly without rebooting the machine and
> no live CDs as rebooting would make the target suspicious of the act.
> So social engineering will work better in this case.
>
> If he has enough powers, he can trojan the machine as its company's
> property. And the target may be a real danger for the company's
> security, who knows ?


------------------------------------------------------------------------
This List Sponsored by: Cenzic

Are you using SPI, Watchfire or WhiteHat?
Consider getting clear vision with Cenzic
See HOW Now with our 20/20 program!

http://www.cenzic.com/c/2020
------------------------------------------------------------------------