What's the worst OPSEC you've found in a job?

My last job had a "banking system" atop of a Wordpress site, turns out that every account was implemented in a post and every balance was updated manually, aside from the bizzarre choice of technologies, every post/account was public and easily listed via google. This included names, emails, phone numbers, bank info, and monthly balances. I realized this crap was happening the thrid day aboard and quickly notified the higher ups, not a word from them. Two days later I showed them all the accounts listed with a google query, they weren't worried at all and this issue wasn't given any priority. Only lasted a week there, the pay was too crappy for caring more for the business that the owners. So, what's the worst OPSEC you've encountered in a job?

I don't know soykaf about the law, but shouldn't it be illegal for a bank to be effectively mass-doxxing unknowing customers?

>>14920 It wasn't a bank, all I could say is that they hold money for their customers, it's absolutely illegal but they don't care.

>>14919 Deliberately poorsec private info which is sold to some company literally hiding in plain sight? or the higher ups are datamining and know this bug is a feature? No one knows but what you can do is maybe with a little bit of precaution is sell the n00b info to ad company. [Not] Quick question: Is it a public cdn info leaking? Happens all the time that you might come across crucial information from time to time by searching random numbers and letters (on google or ddg). Somebody forgot to block bots/crawls and make directories private. >>14920 Depends on the privacy laws of the said country. Don't know about OPs country, could be a developing country where such laws are still mandated.

Nothing major, just that this rental software used by one of our clients stores passwords in plaintext. Didn't find that out until I forgot the admin username (but not the password) and started digging around in the database to jog my memory.

I worked at a company that made medical devices. A security audit six months before I got on had proved that there was a gaping security hole, which the auditor had used to get root access on one of our machines within 15 minutes. I was tasked to check whether the vulnerability was still there. It was, and they basically decided not to fix it. They were trying to sell these to the US army

All account passwords company-wide limited to 12 char, no symbols allowed. Legacy systems lmao. Very well known company internationally. Highly visible rear entry onto premise, credentials are keycard for an oft-used elevator so tailgating isn't conspicuous. I've used it after my employment terminated. Another very well known company, head office.

>>14921 Then tell us who they are Present Day, Present Time! AHAHAHAHAHA!

>>14919 I have a strong urge to find bad opsec at work. Calling people out for posting selfies with sensitive information in the background. When your whole company operates on the basis that our trade secrets stay here, and some 18y/o almost fuarrrks it up by posting fuarrrking selfies, you have a serious problem. The usual someone spilled coffee on a document and throws it into the trash instead of shredding it. Some Engineers are the worst. Another job I worked where we traveled internationally and had to maintain a low profile to not be kidnapped and soykaf, one woman broadcasted her real time location on social media so her kids could follow mommy. I turned off and smashed her phone when I saw that no regrats lel We had to fire someone for violating a non-disclosure policy by bragging to some hookers at a bar about some project he was working on. (this was a third world country) He didn't provide any technical details, but one of the terms of employment was to not discuss projects outside of our work areas. Corporate espionage is real, and to be honest i get suspicious of every Chinese looking mother fuarrrker who walks through the door at my company. I don't want to loose my job because some fuarrrk in china steals someones idea and then becomes a millionaire. I know a few people this happened to, and it really grinds my gears.

>>14931 >and to be honest i get suspicious of every Chinese looking mother fuarrrker who walks through the door at my company. the successful spy is going to be white, amiable, he's going to have a demeanor that puts you at ease.

>>14931 >I turned off and smashed her phone it seems a bit redundant to do both.

>>14921 >>14930 I understand you may not want to over fear that they'll blame you, but it's probably for the best someone does something about this. Whether you share the info online, or tell the local newspaper about it and hope they make a story good enough to put them out of business. Eventually someone will find out about this and take advantage of it. Someone could already be taking advantage of it now.

>>14943 depends on who's tracking them

>>14943 So she wouldn't screw up again hahahaha, a little extreme nonetheless... >>14930 >>14945 this could easily land me trouble, and my country is lawless so nice try. Another not so relevant history: I had a hustle for some time fixing computers for lottery agencies, this a~holes get the worst computers that almost two decade old off-lease could get you, roach infested dust magnets, P4s and core 2 duos that had to run XP because it was the last version that could run the lottery software, they took the cheap seriously, the Windows version they demanded installed was an unatended one full of old versions and bloat. All the computers needed an internet connection for this lottery software to work, and they didn't had a firewall or woking antivirus, cashiers used to browse internet and watch videos so it was natural for the computers to catch all sorts of malware, when not the hardware was simply diying of old age in daily use, they had piles of broken machines, when a repair was too expensive, they asked me to rather throw it in the pile or build a frankenstein with the scrap, 15$ is where the too expensive line was drawn. Aside from the inconveniences of having to reinstall computers all the time because a virus got a whole agency, they didn't got any trouble and their business was flourishing as the roaches in the agencies. This is what frustrates me the most: how crapsec gets away most of the time because of luck or lack of bad intent from others, handling a lot of money over the net and not caring two fuarrrks about security is a widespread defect. I don't simpatize with OPSEC snake oil vendors, I'm just asking for a little malice when pluging your business to the internet.

>>14947 Sorry if it's a stupid question, but what does your job require? Do you just go around installing and repairing computers, or do you do network security? Both?

>>14940 Those are the low key insider threats. Americans are greedy and easily swayed by money. The blatant spy is going to be the "oh im just escaping that darn communism guise" chinaman whose daddy is a big time factory business owner and member of the communist party.

>>14947

yf
w the OPSEC LA
RPers are the same people who put an email address in the email field

>>14963 I am continually amazed by how after countless lectures about how poor opsec can fuarrrk you and other peoples lives up and land you in huge trouble, people treat it like its some kind of unnecessary outrageous extra step that gets in the way of them doing mediocre work to begin with. Also people who admit that botnet is a terrible thing, but let me log into this facebook affiliate bullshit and tie it to my apple pay and paypal so I can order a coffee that I could have payed for with the change in my pocket.

companyname123

half baked right wing terrorists posing about needing to where a mask for opsec reasons, only to post it to their main facebook/telegram with there phone number attached to both. p.s. If your trying to find someone on telegram and you know their number, buy a cheap smartphone and a burner simcard add their number to your contacts, then when you go to setup and install telegram their account will pop right up. This is how antifa grabs it, lol everytime.

>>14919 That sounds so bad, it's probably done with purpose for some nefarious reason, with them claiming incompetence as plausible deniability.

>I don't want to loose my job because some fuarrrk in china steals someones idea and then becomes a millionaire. I know a few people this happened to, and it really grinds my gears. Smartphones are effective keyloggers and clipboard loggers. Android or iPhone? latest operating system? Got a China app? That's all you will need. Unreleased albums, unreleased patents, unreleased code, copied that email:password and don't have 2FA/3FA ? They will log into it, they will breach your soykaf and take all the blueprints. Some older (Chinese) smart phones even had infected vendor apps required for the CPU and other features like gps to work and instead it had a 5GiB of user data mined through the years. Espionage = money, some dumbass would wear a fitness tracker and leak their soykaf to some a data thief.

>>14969 >people treat it like its some kind of unnecessary outrageous extra step that gets in the way of them doing mediocre work to begin with Too fuarrrkin true. Look, if you're not willing to spend the time and resources to have good opsec, it's not worth it. If you decide to anyways, you deserve it. I often think about a hypothetical scenario where something drives me to "hacktivism" or whatever soykafty term they use nowadays. I keep asking myself if there's anything that's worth the time/effort expenditure to feel secure in my opsec and most of the time the answer is "no." History shows us any breach significant enough will be revealed with time. Protip: No one single lainon acting by themselves has good enough opsec to even think of including an intelligence community in your threat model. If you think you do, you're delusional or blissfully unaware of the insane amount of ways you can fuarrrk it up.

>>15016 I saw a fascist group unironically recently recommend antiX Linux and Google services as anti-fed opsec, lmao >>15028 >of including an intelligence community in your threat model As an active adversary? 200%. But what about passive surveillance like dragnet?

>>15029 Honestly, I don't know enough to say one way or the either with absolute confidence but IMHO I believe it's at least plausible to a certain degree. That being said if someone gets spotted and focused in on, good luck to you.

>>14920 At least in Germany this would be a strong violation of the DSGVO (Datenschutzgrundverordnung, "general data protection regulation") and could get very expensive for the company.

I used to work at [REDACTED BIG ECOMMERCE COMPANY]. Using Jenkins jobs, you could go godmode and run literally anything in production without permissions. We used this hack for all sorts of benign thing--but if some hacker got through their firewall or whatever, it would be trivial to pwn the company.

>>15589 >but if some hacker got through their firewall or whatever, it would be trivial to pwn the company. Sometimes I wonder if some VIPs at big companies like to keep it that way. Deliberately poor security would be a great way to cover one's tracks of there were some sort of internal fraud going on. "Oh, so sorry, mister police investigator. Looks like a few months back a hacker broke in to our systems and caused a lot of damage, we don't have those audit log files anymore. I'll have to remember to scold our security people for being incompetent."

>>15016 How would one know a random pseudonymous fascist internetperson's phone number prior knowing their FBIbook/FSBgram nicknames? I thought the credential acquisition goes the other way around: first you talk to a person using pseudonyms on one messaging system, then after some hacker movie-tier social engineering you solicit their phone number which might be private (or more likely a throwaway burner which is not hard to acquire) to talk on a "more secure uncensored app that popped last week and all the cool magapedes are on it, also hosted in Israel by our greatest allies".

>>15707 In this case you direct them to a version with a vulnerability.

https://en.wikipedia.org/wiki/Zero_trust_security_model any other resources for further reading?

>>15028 > No one single lainon acting by themselves has good enough opsec to even think of including an intelligence community in your threat model. If you think you do, you're delusional or blissfully unaware of the insane amount of ways you can fuarrrk it up. What about phineas? I feel like phineas is proving this wrong. I think law enforcement is more incompetent than you think, and intelligence communities don't care that much about hacktivism unless you are in palestine going after israel

>>16174 Yeah, you make good points I can only agree with. It's just weird to me, though. Sometimes they (in the US, at least) are inept and completely miss the mark, but when they nail someone they REALLY nail them.

>>16175 I think acting by totally by yourself is one of the best ways to make your opsec bulletproof. Its trying to be part of/make an organization, move money, bragging, etc that gets people caught

root/root login for servers. user account with uid 0 and easy as fuarrrk password on servers. ssh exposes on all interfaces with root authentication enable. No pubkey auth. No siem, syslog collector, nothing. Unpatched OS. Unpatched network equipment.