Keith Pachulski

Three hours. That's how long it took to go from standing outside a data center fence to dumping domain credentials from a VSS shadow copy. Not three days. Not three weeks of patient phishing campaigns and careful lateral movement. Three hours, start to finish, in broad daylight. The Setup A client hired us for a physical target assessment of a remote data center. The engagement included a network penetration test component, but with a catch—we only got to touch the network if we could obtain...

It's been a few weeks since my last post. I've been busy. The end of the year always seems to get us. Organizations are scrambling to close out projects that have been lingering for months, budgets are coming to a close, and with that comes an influx of high-priority, short-notice work. Sleep becomes optional. Most of my time has been spent on offensive technical work: external / internal penetration tests and public-facing web application testing. With that comes tool development, or...

I found this list a few months back while doing disaster operations training. I volunteer with the American Red Cross as a State Relations Disaster Liaison; it's what I do when I'm not doing security work. Some of the training material had this piece of dark satire buried in it, probably aimed at disaster responders or emergency workers. I wish I could remember where exactly it came from so I could credit whoever wrote it. Here's why it stuck with me: I read through it and realized every...