r/cybersecurity • u/OMiniServer • Mar 23 '26

News - General Hackers exploit security testing apps to breach Fortune 500 firms

https://www.bleepingcomputer.com/news/security/hackers-exploit-security-testing-apps-to-breach-fortune-500-firms/
142 Upvotes

97% Upvoted

28 comments sorted by

45

u/Bobthebrain2 Mar 24 '26 edited Mar 24 '26

Did I read this right…Pentera, an automated penetration testing company, accessed over 1900 corporate systems without authorization?

13

u/almost_s0ber Mar 24 '26

No you read it wrong, it's *Pentera.

8

u/Bobthebrain2 Mar 24 '26

Fixed 👍

10

u/Ok_Consequence7967 Mar 24 '26

That's the irony of it. A pentesting tool with access to 1900 corporate environments is an incredibly high value target. One compromise and you have a master key to all of them. Security vendors get attacked specifically because of how much access they sit on.

-4

u/ihopeidontforgetmyun Mar 24 '26

That’s not correct….Pentera released the intelligence. They discovered vulnerable web apps for testing were exposed to the internet / overly permissive.

Did you read the article at all?

10

u/Bobthebrain2 Mar 24 '26

I did, did you?

There’s literally a screenshot captioned “Accessing the Secrets Manager on an exposed AWS account Source: Pentera Labs”

-7

u/ihopeidontforgetmyun Mar 24 '26

That’s disingenuous. They identified an issue, validated it, and reported it.

14

u/Bobthebrain2 Mar 24 '26

Proof of compromise emerged when assessing several misconfigured, vulnerable applications. The researchers established shells on the machines and enumerated data in an effort to determine their owners.

Ok cool, so we can all just drop shells on random systems now, I’ll give legal the good news.

-7

u/OMiniServer Mar 24 '26

Yep, the problem of the cloud architecture and how everything was created.

29

u/Bobthebrain2 Mar 24 '26

If they didn’t have authorisation, it’s not a penetration test….its an illegal breach.

-12

u/Infinite-Land-232 Mar 24 '26

Same hat, different color. Code don't care who is running it and if it is legal or not.

14

u/Bobthebrain2 Mar 24 '26

Except they are calling themselves a Penetration Testing company, which is a title that comes with responsibilities.

2

u/Infinite-Land-232 Mar 24 '26

Yes, if they were just popping sites for fun, street cred or advertising they were way stupid. Everybody else knows to wait for the get out of jail free letter before starting. Hope they don't have to pay site owners too much to not press charges.

But there is no limit on corporate stupidity, had a similar thing done to a site I ran. They were not trying to penetrate but were doubling our hit rate by using us to demonstrate their global monitoring capabilities. Untraceable until we blocked every one of their anonymous servers and they used one from their own domain. Gotcha was fun.

-13

u/OMiniServer Mar 24 '26

Correct, but it’s too fault of the system. This should not happen. It’s like saying your airbag don’t work when you have an accident. The problem of the f...ing industry.

People have accepted this crap.

11

u/Bobthebrain2 Mar 24 '26

Nah, their actions aren’t the “fault” of the system at all. Nobody made them log in to these systems, gather creds, use the creds to access AWS environments. AFAIK they weren’t working with the parameters of any bug bounty programs either….

If I find a loaded gun I don’t have to shoot somebody to prove that the gun is loaded.

-6

u/OMiniServer Mar 24 '26

Those security apps should be out after a certain time like Apple flight test apps. True about the gun, but if you never shoot you will never know if it works.

6

u/Bobthebrain2 Mar 24 '26

Nobody is disagreeing that the apps should have been removed. The disagreement is whether or not this automated “penetration testing” company accessed systems without authorisation.

-4

u/OMiniServer Mar 24 '26

I don’t see it that way for me because you don’t leave the key’s of your house to everyone. That they got access to the system with or without authorisation is a management problem and a system problem.

Everytime you use external ressources, you need to check the work and secure access. If you leave a web app open like this, you secure it and lock it when finish.

That's why in my company we don’t use external ressources. We have hackers in house for "crash test" and we do all from the inside.

The risk using outside ressources is this type of problems that happen too often and the worst is that you don’t have any control.

9

u/Bobthebrain2 Mar 24 '26

Just because the company fucked up, doesn’t give you the authority to access their system. Sure you have the ability to, but you don’t have the authority to.

If you find my house keys on the sidewalk it doesn’t give you permission to enter my house.

-1

u/OMiniServer Mar 24 '26

Agree, but it’s still for me a fault of the company and the CISO/CSO, all the security team and the people who fuck it up. The key on the sidewalk shouldn’t have been left in the first place.

Agree they should not have the authority to rob but you watch out who you work with.

-1

u/OMiniServer Mar 24 '26

Then, AWS, Azure... OMG, so crap people to work with and with the cloud at the back. They already have it all wrong.

2

u/BlowOutKit22 Mar 24 '26

Ehhh most F500 companies with cloud presence use a different cloud account for each app. So even if they had deployed a pen test application, when it was made publicly accessible, all the attacker would have been able to do was fool around in that specific account. The only thing "penetrated" would have been someone's wallet, and F500 companies are used to seeing 6+ figure cloud bills anyway.

14

u/[deleted] Mar 23 '26

[removed] — view removed comment

3

u/mercjr443 Mar 25 '26

This is about organizations putting deliberately vulnerable apps that are designed for testing exposed to the internet... not a good idea obviously...

4

u/Mrhiddenlotus Mar 24 '26

So... Pentera is a cyber crime org?