1. TAKING-OVER THE
PETROL STATION

2. Company Overview
Global fuel company with chapters
in more then 80 countries
Filling stations all over the country
Massive network infrastructure
Public websites

3. Audit Scope
Internal Penetration Testing
and IT-security Assessment
Social Engineering Attacks
External Penetration Testing
and IT-security Assessment

4. Areas assessed

5. Actions performed
Network Security
Testing
Web Application
Security Testing
Social Engineering
Attacks
Malware Attacks Internal Network
Infrastructure Analysis
Incident Response
Planning

6. Business risks discovered
Personal Identifiable Information leakage through web-
sites
Third party resources configuration files leakage which
may lead to malicious actions on filling stations
Employees are prone to Social Engineering attacks

7. VULNERABILITIES
DISCOVERED

8. EMPLOYEE SECURITY
UNAWARENESS

9. Cybersquatting
Victim’s domain is
example.com
Attacker registers
example.nl
Attacker send email with
malicious link or malware
Victim receives it but
ignores the mistake
Victim triggers the
payload

10. Cybersquatting results – hooked browsers
Hooked employee browsers

11. Cybersquatting results – malware executed
Crafted malware files

12. NETWORK BREACHES

13. No anti-bruteforce mechanisms
SSH accounts
bruteforce

14. Numerous protocol and outdated services vulnerabilities

15. WEB APPLICATION
VULNERABILITIES

16. SQL-Injections
Dumped admin password hashes

17. Cross-Site Scripting

18. SOFTWARE AND OS
MISCONFIGURATION

19. Outdated OS and software installed

20. Publicly available sensitive resources

21. COMPANY’S PARTNER
SECURITY BREACHES

22. Primitive passwords to password-storage

23. Publicly available sensitive resources
Public ftp
with radmin
keys

24. LESSONS LEARNED

25. EMPLOYEE SECURITY
AWARENESS IS A MUST

26. DO NOT COMPLETELY RELY
ON YOUR
BUSINESS-PARTNER’S
SECURITY

27. USE WELL-KNOWN TOOLS
AND FRAMEWORKS FOR
YOUR WEBSITE

28. KEEP YOUR NETWORK
SIMPLE AND SCALABLE

29. KEEP YOUR SOFTWARE
UP TO DATE

30. QUESTIONS?

31. NAZAR TYMOSHYK
BOHDAN SEREDNYTSKYI
YURII BILYK
STANISLAV BRESLAVSKYI
http://owasp-lviv.blogspot.com/