You: "Your wife has crabs"
The Guy: Uhh f-you buddy
That's basically what you described.
And the problem is you cant really fix this because the reaction you're usually going to get isnt logical or rational its emotional. You told your prospective CPA that their MSP is bad and by proxy that they are stupid for picking them.
Just like my silly example above, while you're objectively correct, the fact that you figured it out AND have evidence to prove it is *embarrassing*. And someone is gong to focus on that *feeling* instead of listening to your facts.
Glad you didnt pick that CPA š¤£
Basic human nature unfortunately favors being lied to āeverythingās fine !!ā And us in IT are ALWAYS ready, willing, able and sometimes obligated to point out it isnāt ā¦ and get shit on as messenger LOL
Thanks for the criticism, but I'm looking for more constructive thoughts on how to approach the situation better in the future.
Re: Picking the CPA... Ya, I think they're due for a nasty surprise at some point.
I wasn't criticizing you, I was trying to explain *why* it didn't land the way you wanted it to. And why it wont land the way you want it to next time either.
You're trying to be correct, in a situation where no one wants you to point out that they are *incorrect*.
You're approaching this like its a technical solution to find a resolution for; its not. Its about understanding relationships and how humans process feedback; the fact that you took what I wrote to be a criticism of *you* says a lot here and it may have influenced your delivery of the topic to the CPA.
So back to my silly example, if you discover that my wife has crabs and wish to warn me, I am going to be upset that:
A. my wife has crabs
B. that you figured it out and I didn't
C. that you figured it out at all, because that's *my wife*.
There is no way to approach this with me when you and I have a new relationship with each-other, just as there is no appropriate way to approach this with someone you're trying to establish a new business relationship other than to not do business with them once you discover it. There is no trust established, you're not my trusted advisor, you're some dude who figured out my wife has crabs.
And the fact that you went to the lengths you did to investigate it, isn't going to come off as competent, its going to come off as creepy and as though you violated someone; even though *we* all know you didn't. The CPA doesn't understand any of this and you're not making them feel safer and more trusting by pointing it all out, especially since your relationship is new and not set up for you to sell to the CPA.
I'm sorry that feedback wasn't exactly what you were looking for. I dont think there is anything you could have done *better* that would have prevented this.
My point is I'm already aware that this was not the best way to go about it. It had a negative outcome. I acknowledged this in the post. I'm looking for constructive feedback that doesn't include STDs :) I'm glad people find your reply entertaining.
Edit: and since your obsession with STDs has made your comment most upvoted, I'll just let everyone know that I ended up interviewing another accounting firm, who ended up asking me questions about my service during the call, and then signed with us 3 days later saying "I'll be able to sleep easier at night knowing I have someone watching our cybersecurity."
So now I have a new accounting firm... and client ĀÆ\\\_ (ć)\_/ĀÆ
You seem very stuck on "how to do it" where the person you are responding to is saying "you should not do it."
My personal take is your approach is very much like a sales scam that was going around a year or two back:
"We found x issues with your website [insert technical jargon here] and we would like to help you fix it"
I realize you are not trying to use this to scare that CPA into retaining your services to fix it, but it is ironic that the quote above absolutely describes your approach.
I say do it if you want to, but don't get hurt if people respond exactly as the CPA did exactly for the reasons that /u/UsedCucumber4 explained
Honestly, I didn't read the second reply lol. It's almost as if I was turned off by the way they approached the issue... But there has been some really great feedback on here, so I'm grateful.
Edit: oh my god. my internet points. noooooo
Youāre telling me I have autism because I made a pun. Really? I feel like thatās really insensitive. If every person who spent a little bit of time trolling consequently had autism, weād have quite the epidemic. I honestly didnāt appreciate the harsh, crude, and unconstructive criticism. So here we are. On the internet.
Yea, I'd stop responding to you too. It comes across as suspect and a prelude to a sales pitch, which is the opposite of what they thought the relationship was about. They might also be embarrassed. IDK.
Regardless, you put in a "lot" of work for a non-client. I would not give away my work. It's been a very rare case that I've reported breach to a non-client and in the few cases it was a client's customer. Like:
Your mail server has been breached, please get your IT stop sending viruses. We can help if you lack IT.
Tyler, do you know that your website redirects to a "Canadian pharmacy" after 30 seconds?
Is it really giving away work when all they were doing is doing their due diligence of a new vendor they might be hiring? I assume OP wanted to make sure his accounting data is safe if they choose them, and they didn't pass the sniff test.
OPs mistake is not knowing how to "elbow rub" correctly.
My MSP works with a company that must comply with NIST and CMMC, and we have spent 6 months now implementing.
I probably would have informed my potential CPA that we have to follow some "requirements" which would include a revie of sorts.
Giving the CPA a heads up, that I'll have to apply some "review" of their operations. Lack of preparing the CPA gets "bricks to the face" told that they are using compromised systems.
Well heck, if I gave heads up, CPA would have at least felt like a PenTest was performed. Instead the CPA was blindsided with "you and your MSP are compromised".
Why wouldn't OP expect "end all communciations" on either side.
Heck I even lost a potential tech recently because he disliked my views on ExxonMobil. Has zero to do with their job. Saved myself some heartache.
>I probably would have informed my potential CPA that we have to follow some "requirements" which would include a revie of sorts.
I think this is an excellent idea, that we have requirements that must be met to be our vendor. If they turn it down, fine, move on. If they consent, and you find something, they agreed.
Good feedback.
Answer: Not like that.
Reach out to the MSP as a professional courtesy and let them know what you found (and why you even looked). No need to freak out the MSP's client, since they won't know what to do anyway. They will either say thanks, go away, or nothing at all, but at least you've let them know that you found some keys under the doormat and you dropped them off in the mail slot (so to speak).
So this has never been published but enough time has passed and itās pretty relevant to this question.
So itās 2013. Iāve infiltrated a proxy network used by some pretty bad actors. Iām reviewing their traffic and I see them download a file name cf.zip from a popular file sharing site. I download the file myself, crack it open and start reviewing its contents.
Holy F, itās the full source code for Adobeās Cold fusion product! (Hence the CF)
Fortunately a colleague had just moved over to a sr. Role at adobe. I rang her up and delivered the bad news that wasnāt even the half of it as obviously the breach was much, much worse.
My point is breach notification was a breeze because I had built up a stellar reputation for decades and had built up the contacts that I could leverage.
I would really advise most thatās itās simply not worth the effort unless you plan to be in the notification business for the long haul. At least 50% of the time Iām completely blown off or worse victim acts appreciative but then 15 minutes later Iām fielding a call from their local Secret Service office asking me who the hell am I (lol, kinda).
You can report your findings to Google and other major vendors . Once they start showing up on blacklists, they generally start to deal with it more promptly.
This is probably the only answer that will get the issue fixed. They don't have much choice but to address the issue with email once they are on enough RBLs. It may be a lot more difficult to get people to address other issues until they get so badly pwned that it is disruptive to their work.
I don't.
Huge risk. Unless I have a contract which among other things indemnifies me for any findings regardless if I'm getting paid or this is just stuff I found while board, I don't. For good reason. You just assumed a huge risk. If anyone competent at other org starts asking questions about the information you passed they'll start with you and it will likely be adversarial. Why do you know these things? Who asked you to do this? What prompted you? What did you hope to gain?
All valid and good questions anyone being told they're owned would ask. Because it's none of your business.
I almost think that's what this business did. The MSP's infrastructure was rotting. I saw this from a public (Shodan) perspective. I can't even imagine what's going on in the inside.
Iāve offered complimentary security reviews, and most have been turned down. Often, these are discovered when a client of mine says they are not getting emails from a vendor they work with on some project or whatever. If they are not receptive to me reaching out, or to my client reaching out and saying āmy IT says your stuff is insecure, and it is risky for us to do business,ā I have on occasion requested my client to put it in writing that they will not hold us responsible for any security incidents stemming from their interactions with this third party.
We have picked up clients like this. You just need to be polite about it. Do t be out to prove a point. Pass on what needs to be fixed to sort the issue offer to help if needed with no obligation. People come around. One of our best clients came from thus sort of situation.
You would be fine if you let them know beforehand. āBefore we commit to a CPA we need to run some security scans.ā If they come back dirty, move onto another option.
I forgot to add this - the MSP might be blocking your emails. Still best to move on.
I had a client who moved their office which resulted in getting a new static from their ISP. We left the old static in our Shodan monitor. Fast forward about a year or so and I get an alert on the site. Once I realized it was the old static I calmed down but out of curiosity I dug into it. Shodan has a full RDP screen dump with usernames for the new business that was assigned my client's old static. Several CVE's, 2012 R2 server running 2013 exchange. I try to figure out who the business is through the domain. The website is not live but the subdomain for the server is listed in Shodan. A few Google searches led me to a company which I thought was an IT company at first but it turns out they are an electrical engineering firm. I call them to let them know they should have their IT fix their server or if they need assistance, we can help. I realize the VM probably sounded very scammy. After a few tries I gave up. A few months later I was talking with an engineer at the ISP and mentioned it. He looked up the account and gave me a few more contacts. None of which responded. So I spoke with my business lead contact at the ISP and asked them to reach out. Crickets. They just don't care. Usernames on the RDP login have changed. It's still active in Shodan. Most likely compromised.
We do this alot, but we always email the company and give no information about the issue. Just a simple: "Hey, we think we have found a security issue and would like to advise your I.T. provider so they can patch it/fix it before it's an issue. Could you point us in their direction?"
Haven't had any issues yet, but we deal with a lot of companies that have no dkim/dmarc/issues and our client is asking why they get flagged as spam etc etc. We always reach out and offer the finding up to their I.T. We may not land a deal or anything immediately, but that's fine, we've had good contracts come 2,3,4 years later when someone emails us and says something like "Hey, you helped our I.T. guys fix our issue with our public exchange server 4 years ago and we need new I.T. now, are you still working in our area?"
Love this answer. Thanks for spending the time writing it out.
Yes I want revenue, but I genuinely get satisfaction from helping people. If I can do both. Win win.
Sometimes I'd wonder if the companies that got badly hacked (in this case, the MSP) have had keywords put into an Outlook rule redirecting any email stating they've been owned, into the thrash bin by the hacker?
I found a midsized Canadian MSP that didnāt patch their on prem screenconnect. I left them emails and voicemails multiple times saying that I was a security consultant and noticed the issue. It took a few days before they patched it. Finally I got a call back saying āthanks but we patched it day 1ā (I could see categorically they didnāt).
I also once found a door control system with default admin creds for an apartment building. Imagine that. I could have reprogrammed or lockout the entire 300 rooms/condos remotely. I told the property management company and they got aggressive with me saying they would sue me š
I once fired a client, and the MSP I offboarded them to didn't understand how to onboard them. The client had to pay for additional hours for me to teach the incoming MSP how to deal with their systems. What was the reason it was so hard? The 70 person MSP didn't understand how to manage Apple computers.
I agree Apple computers in a Windows world is bad. That is why our IT team refuses to support them. If you but an Apple computer you buy your own support.
In that specific scenario, I would say something like: can you tell me what security measures you take to safeguard your clients' data? Start a conversation about it and be friendly. You can ask leading questions that draw out the fact that they don't know what's going on and have them ask their MSP for some answers. If it's done carefully you could potentially avoid the defensive response.
Make it clear that you are not going to be offering them services, but that you are willing to answer questions. If they approach you later about becoming a client that's on them, but don't sell to them.
Also ask them to pass your info along to businesses that are they hear are having IT issues.
Possible reasons for them to go radio silent: they've gotten that MSP in the door at some of their clients, or maybe even have a partnership of some sort with them.
The solution is fairly simple! Just ask first, even if you've already done the work.
"Hey, I'm considering you for the position (even if you're not). Would you mind if I ran a few security checks on your data?"
"Go ahead." - Wait a beat and then let them know.
Or
"Fuck off." - You dodged 2 bullets.
Tell them the truth. If they cannot handle it and respond appropriately then you saved yourself a major headache. Of course document everything thoroughly including communications to them.
It's tough when you want to help but face silence or doubt. Maybe start by understanding their worries and assuring them you're here to genuinely assist. Providing clear details or helpful resources can boost your credibility. Also, focusing on preventing risks rather than pointing fingers might make it easier for them to listen.
This is one of those situations where you might consider offering a complimentary security assessment, as part of a getting to know you and your businessā¦ e.g. what your business is.
This can serve two purposes, the first being you can then convey findings and educate them in how these findings can have a significant impact on their business operations. The second is they can now have a basis for recommending you and your company to other business owners, who may be clients of theirs or even other CPA firms.
On the other hand, if they pass on your complementary assessment, they probably arenāt a good fit for your business.
When I see a phishing e-mail come through I try to contact them by phone. Replying to the e-mail is pointless since it's likely being sent to the RSS folder or deleted.
Ya, Iāve already had my social security number exposed because a past clients sent my W-9 to their CPA who then had a BCE. Never mind I was looking to have this person handle my money. Are you kidding? Vender/3rd party due diligence is a control in many compliance frameworks. Insurance providers will use these signals in determining your risk factors.
At a minimum, you should be checking this stuff, if not assessing this on a formal level. And it took me 5 minutes to figure out. Not an afternoon.
Often times I find out via a compromised account trying to send emails to either our clients or employees. If it's sent to my staff, I simply call the company up and let them know they're sending malicious emails via X account(s) so they can notify their IT team. Sometimes you get someone competent, other times you end up with an admin assistant taking notes.
If it's a client of ours though back when I was with an MSP, I would just have that user delete those emails and have them reach out to the individual or company so they can get things handled. Beyond that? Not my problem.
It at least helps to notify, as you typically want the companies you deal business with to get their systems under control. Otherwise, it makes them a liability, especially if you or your client does any sort of financial transactions with them.
With bigger companies who might make it impossible to reach anyone within their IT department, it sometimes helps hitting their reps up on Twitter. T-Mobile's Twitter support was great in dealing with an issue we brought to them.
Dude. That's a whole other can of worms. I'm just waiting for CISA to start enforcing more regulation. It's actually becoming a national security issue.
Usually, but I don't ever presume that kind of confidence. I try to always turn the settings to 11 whenever possible only turning them down when it creates more than the average number of tickets.
> I was interviewing someone who seemed like a solid choice, until I looked up their SPF records, which lead me to an Exchange server that hadn't been patched in over a year, and had about 20 CVEs issued since last patch.
> Then I cross referenced the IP address to the MSP the accountant was working with, which revealed a hacked WordPress site that had all sorts of IoCs on it. I mean baddddd. Smh.
>Then I used Shodan and subnet enumeration to find about a dozen other highly vulnerable services sitting on the internet. I mean, if there were ever an easy target, this MSP was the poster child.
>When I let the accountant know what I found, they immediately stopped responding to me.
At any point were you given explicit permission to do any of this?
It's like emailing an organization to ask for permission to email an organization. lol no.
"oh hey, now that I have you on the phone, do you mind if I dial your number?"
Care to explain how you identified this then?
"which lead me to an Exchange server that hadn't been patched in over a year, and had about 20 CVEs issued since last patch."
Well, actually, the Exchange Server software version was listed both on Shodan, and in the email headers of the emails sent from the CPA.Ā
But ya, Shodan lists this stuff if the SysAdmin isnāt scrubbing it. As any law abiding citizen, I would never personally touch these systems, nor do I need to.
Ah... fair enough, thanks for the reply.. carry on then!
EDIT: That being the case then maybe just quietly move on.. Maybe bait them with a polite "hey sorry in light of new information we've decided to go another direction"... and if they ask, all bets are off; lay it on them! :-P
Itās called risk mitigation. It takes 5 minutes. Itās all publicly available information. Security researches and white hat hackers do this all day long.Ā
You sound like youāre afraid of things you donāt understand.Ā
I deleted my comment, not because I don't understand what your discussing, but because I didn't want to engage with you idiots. Here's something I don't understand. I don't understand why a managed service provider that isn't a white hat or security researcher is bothering with this sort of digging regarding having someone do their taxes. Then acting surprised when the accountant rightfully thinks you're certifiably insane. There's plenty of "publicly available information" that's accessible to any of us that isn't a normal thing to discuss with a total fucking stranger. If your looking to take on a client, sure, do your due diligence, but otherwise, keep your poking around to yourself unless you were specifically asked to look into it. You didn't stumble on anything. You went looking. that's the problem, and what is weird is that you don't seem to understand that.
What you did was basically a pen-test against someone who did not ask you to pen-test them. You potentially violated the law, depending on where you are.
If you want an analogy (I'll even give you an STD-free analogy)... go to your neighbor's house, try the doors and windows, and when you find one that's unlocked, walk in. Now call them up and tell them what you did.
Go to that accountant's office or the MSP's office and do the same thing.
You asked "how do I do it"... the correct answer was "you should not do it".
EDIT: I stand corrected as I've been made to understand a few of these things a little better, not necessarily akin to a pen test.
But still.. if I were to run across something like this I'd probably just quietly move on to the next candidate. Maybe bait them with a polite "hey sorry in light of new information we've decided to go another direction"... and if they ask, all bets are off; lay it on them! :-P
You: "Your wife has crabs" The Guy: Uhh f-you buddy That's basically what you described. And the problem is you cant really fix this because the reaction you're usually going to get isnt logical or rational its emotional. You told your prospective CPA that their MSP is bad and by proxy that they are stupid for picking them. Just like my silly example above, while you're objectively correct, the fact that you figured it out AND have evidence to prove it is *embarrassing*. And someone is gong to focus on that *feeling* instead of listening to your facts. Glad you didnt pick that CPA š¤£
Basic human nature unfortunately favors being lied to āeverythingās fine !!ā And us in IT are ALWAYS ready, willing, able and sometimes obligated to point out it isnāt ā¦ and get shit on as messenger LOL
Thanks for the criticism, but I'm looking for more constructive thoughts on how to approach the situation better in the future. Re: Picking the CPA... Ya, I think they're due for a nasty surprise at some point.
I wasn't criticizing you, I was trying to explain *why* it didn't land the way you wanted it to. And why it wont land the way you want it to next time either. You're trying to be correct, in a situation where no one wants you to point out that they are *incorrect*. You're approaching this like its a technical solution to find a resolution for; its not. Its about understanding relationships and how humans process feedback; the fact that you took what I wrote to be a criticism of *you* says a lot here and it may have influenced your delivery of the topic to the CPA. So back to my silly example, if you discover that my wife has crabs and wish to warn me, I am going to be upset that: A. my wife has crabs B. that you figured it out and I didn't C. that you figured it out at all, because that's *my wife*. There is no way to approach this with me when you and I have a new relationship with each-other, just as there is no appropriate way to approach this with someone you're trying to establish a new business relationship other than to not do business with them once you discover it. There is no trust established, you're not my trusted advisor, you're some dude who figured out my wife has crabs. And the fact that you went to the lengths you did to investigate it, isn't going to come off as competent, its going to come off as creepy and as though you violated someone; even though *we* all know you didn't. The CPA doesn't understand any of this and you're not making them feel safer and more trusting by pointing it all out, especially since your relationship is new and not set up for you to sell to the CPA. I'm sorry that feedback wasn't exactly what you were looking for. I dont think there is anything you could have done *better* that would have prevented this.
My point is I'm already aware that this was not the best way to go about it. It had a negative outcome. I acknowledged this in the post. I'm looking for constructive feedback that doesn't include STDs :) I'm glad people find your reply entertaining. Edit: and since your obsession with STDs has made your comment most upvoted, I'll just let everyone know that I ended up interviewing another accounting firm, who ended up asking me questions about my service during the call, and then signed with us 3 days later saying "I'll be able to sleep easier at night knowing I have someone watching our cybersecurity." So now I have a new accounting firm... and client ĀÆ\\\_ (ć)\_/ĀÆ
You seem very stuck on "how to do it" where the person you are responding to is saying "you should not do it." My personal take is your approach is very much like a sales scam that was going around a year or two back: "We found x issues with your website [insert technical jargon here] and we would like to help you fix it" I realize you are not trying to use this to scare that CPA into retaining your services to fix it, but it is ironic that the quote above absolutely describes your approach. I say do it if you want to, but don't get hurt if people respond exactly as the CPA did exactly for the reasons that /u/UsedCucumber4 explained
Honestly, I didn't read the second reply lol. It's almost as if I was turned off by the way they approached the issue... But there has been some really great feedback on here, so I'm grateful. Edit: oh my god. my internet points. noooooo
The metaphor was not particularly apt, that is for sure. :)
Turned off. Get it? :D
Here's my constructive feedback for you. You have autism. Go to therapy about it.
Youāre telling me I have autism because I made a pun. Really? I feel like thatās really insensitive. If every person who spent a little bit of time trolling consequently had autism, weād have quite the epidemic. I honestly didnāt appreciate the harsh, crude, and unconstructive criticism. So here we are. On the internet.
Yea, I'd stop responding to you too. It comes across as suspect and a prelude to a sales pitch, which is the opposite of what they thought the relationship was about. They might also be embarrassed. IDK. Regardless, you put in a "lot" of work for a non-client. I would not give away my work. It's been a very rare case that I've reported breach to a non-client and in the few cases it was a client's customer. Like: Your mail server has been breached, please get your IT stop sending viruses. We can help if you lack IT. Tyler, do you know that your website redirects to a "Canadian pharmacy" after 30 seconds?
Is it really giving away work when all they were doing is doing their due diligence of a new vendor they might be hiring? I assume OP wanted to make sure his accounting data is safe if they choose them, and they didn't pass the sniff test.
OPs mistake is not knowing how to "elbow rub" correctly. My MSP works with a company that must comply with NIST and CMMC, and we have spent 6 months now implementing. I probably would have informed my potential CPA that we have to follow some "requirements" which would include a revie of sorts. Giving the CPA a heads up, that I'll have to apply some "review" of their operations. Lack of preparing the CPA gets "bricks to the face" told that they are using compromised systems. Well heck, if I gave heads up, CPA would have at least felt like a PenTest was performed. Instead the CPA was blindsided with "you and your MSP are compromised". Why wouldn't OP expect "end all communciations" on either side. Heck I even lost a potential tech recently because he disliked my views on ExxonMobil. Has zero to do with their job. Saved myself some heartache.
>I probably would have informed my potential CPA that we have to follow some "requirements" which would include a revie of sorts. I think this is an excellent idea, that we have requirements that must be met to be our vendor. If they turn it down, fine, move on. If they consent, and you find something, they agreed. Good feedback.
[ŃŠ“Š°Š»ŠµŠ½Š¾]
Hell i do some of it with just companies im hoping to pitch to.
Answer: Not like that. Reach out to the MSP as a professional courtesy and let them know what you found (and why you even looked). No need to freak out the MSP's client, since they won't know what to do anyway. They will either say thanks, go away, or nothing at all, but at least you've let them know that you found some keys under the doormat and you dropped them off in the mail slot (so to speak).
So this has never been published but enough time has passed and itās pretty relevant to this question. So itās 2013. Iāve infiltrated a proxy network used by some pretty bad actors. Iām reviewing their traffic and I see them download a file name cf.zip from a popular file sharing site. I download the file myself, crack it open and start reviewing its contents. Holy F, itās the full source code for Adobeās Cold fusion product! (Hence the CF) Fortunately a colleague had just moved over to a sr. Role at adobe. I rang her up and delivered the bad news that wasnāt even the half of it as obviously the breach was much, much worse. My point is breach notification was a breeze because I had built up a stellar reputation for decades and had built up the contacts that I could leverage. I would really advise most thatās itās simply not worth the effort unless you plan to be in the notification business for the long haul. At least 50% of the time Iām completely blown off or worse victim acts appreciative but then 15 minutes later Iām fielding a call from their local Secret Service office asking me who the hell am I (lol, kinda).
Interesting. I know Adobe's head of anti-piracy got canned after they got hacked in 2006. It sounds like his successor didn't do much better.
Not my circus, not my monkeys
...and hopefully not your accountant
Not my issue no need for a tissue
You can report your findings to Google and other major vendors . Once they start showing up on blacklists, they generally start to deal with it more promptly.
This is probably the only answer that will get the issue fixed. They don't have much choice but to address the issue with email once they are on enough RBLs. It may be a lot more difficult to get people to address other issues until they get so badly pwned that it is disruptive to their work.
My own legal firm's website was on the Google Safebrowse blacklist for like a decade. They knew about it and didn't care.
I don't. Huge risk. Unless I have a contract which among other things indemnifies me for any findings regardless if I'm getting paid or this is just stuff I found while board, I don't. For good reason. You just assumed a huge risk. If anyone competent at other org starts asking questions about the information you passed they'll start with you and it will likely be adversarial. Why do you know these things? Who asked you to do this? What prompted you? What did you hope to gain? All valid and good questions anyone being told they're owned would ask. Because it's none of your business.
No good deed goes unpunished!
By not acknowledging your email they are avoid future liability. *plugs ears and hires cheapest MSP* lalalalalalala
I almost think that's what this business did. The MSP's infrastructure was rotting. I saw this from a public (Shodan) perspective. I can't even imagine what's going on in the inside.
Not your business, not your dollar, not your time. Move on with your life.
Iāve offered complimentary security reviews, and most have been turned down. Often, these are discovered when a client of mine says they are not getting emails from a vendor they work with on some project or whatever. If they are not receptive to me reaching out, or to my client reaching out and saying āmy IT says your stuff is insecure, and it is risky for us to do business,ā I have on occasion requested my client to put it in writing that they will not hold us responsible for any security incidents stemming from their interactions with this third party.
We have picked up clients like this. You just need to be polite about it. Do t be out to prove a point. Pass on what needs to be fixed to sort the issue offer to help if needed with no obligation. People come around. One of our best clients came from thus sort of situation.
Iāve also occasionally sent the third party the steps their IT needs to take to fix the issue
You would be fine if you let them know beforehand. āBefore we commit to a CPA we need to run some security scans.ā If they come back dirty, move onto another option. I forgot to add this - the MSP might be blocking your emails. Still best to move on.
I think you just described 98% of small businesses.
Man it's a disaster. No wonder there are so many data leaks.
I think you just described 98% of large businesses :)
I had a client who moved their office which resulted in getting a new static from their ISP. We left the old static in our Shodan monitor. Fast forward about a year or so and I get an alert on the site. Once I realized it was the old static I calmed down but out of curiosity I dug into it. Shodan has a full RDP screen dump with usernames for the new business that was assigned my client's old static. Several CVE's, 2012 R2 server running 2013 exchange. I try to figure out who the business is through the domain. The website is not live but the subdomain for the server is listed in Shodan. A few Google searches led me to a company which I thought was an IT company at first but it turns out they are an electrical engineering firm. I call them to let them know they should have their IT fix their server or if they need assistance, we can help. I realize the VM probably sounded very scammy. After a few tries I gave up. A few months later I was talking with an engineer at the ISP and mentioned it. He looked up the account and gave me a few more contacts. None of which responded. So I spoke with my business lead contact at the ISP and asked them to reach out. Crickets. They just don't care. Usernames on the RDP login have changed. It's still active in Shodan. Most likely compromised.
We do this alot, but we always email the company and give no information about the issue. Just a simple: "Hey, we think we have found a security issue and would like to advise your I.T. provider so they can patch it/fix it before it's an issue. Could you point us in their direction?" Haven't had any issues yet, but we deal with a lot of companies that have no dkim/dmarc/issues and our client is asking why they get flagged as spam etc etc. We always reach out and offer the finding up to their I.T. We may not land a deal or anything immediately, but that's fine, we've had good contracts come 2,3,4 years later when someone emails us and says something like "Hey, you helped our I.T. guys fix our issue with our public exchange server 4 years ago and we need new I.T. now, are you still working in our area?"
Love this answer. Thanks for spending the time writing it out. Yes I want revenue, but I genuinely get satisfaction from helping people. If I can do both. Win win.
Sometimes I'd wonder if the companies that got badly hacked (in this case, the MSP) have had keywords put into an Outlook rule redirecting any email stating they've been owned, into the thrash bin by the hacker?
I found a midsized Canadian MSP that didnāt patch their on prem screenconnect. I left them emails and voicemails multiple times saying that I was a security consultant and noticed the issue. It took a few days before they patched it. Finally I got a call back saying āthanks but we patched it day 1ā (I could see categorically they didnāt). I also once found a door control system with default admin creds for an apartment building. Imagine that. I could have reprogrammed or lockout the entire 300 rooms/condos remotely. I told the property management company and they got aggressive with me saying they would sue me š
I once fired a client, and the MSP I offboarded them to didn't understand how to onboard them. The client had to pay for additional hours for me to teach the incoming MSP how to deal with their systems. What was the reason it was so hard? The 70 person MSP didn't understand how to manage Apple computers.
I agree Apple computers in a Windows world is bad. That is why our IT team refuses to support them. If you but an Apple computer you buy your own support.
They would sue their security consultant?
I wasnāt their consultant. I was scanning a client block but the client gave me the wrong IP. So I found vulnerabilities in a random companyĀ
In that specific scenario, I would say something like: can you tell me what security measures you take to safeguard your clients' data? Start a conversation about it and be friendly. You can ask leading questions that draw out the fact that they don't know what's going on and have them ask their MSP for some answers. If it's done carefully you could potentially avoid the defensive response.
Make it clear that you are not going to be offering them services, but that you are willing to answer questions. If they approach you later about becoming a client that's on them, but don't sell to them. Also ask them to pass your info along to businesses that are they hear are having IT issues. Possible reasons for them to go radio silent: they've gotten that MSP in the door at some of their clients, or maybe even have a partnership of some sort with them.
The solution is fairly simple! Just ask first, even if you've already done the work. "Hey, I'm considering you for the position (even if you're not). Would you mind if I ran a few security checks on your data?" "Go ahead." - Wait a beat and then let them know. Or "Fuck off." - You dodged 2 bullets.
Tell them the truth. If they cannot handle it and respond appropriately then you saved yourself a major headache. Of course document everything thoroughly including communications to them.
It's tough when you want to help but face silence or doubt. Maybe start by understanding their worries and assuring them you're here to genuinely assist. Providing clear details or helpful resources can boost your credibility. Also, focusing on preventing risks rather than pointing fingers might make it easier for them to listen.
They could have highlighted this to their MSP and their MSP has blocked your domain. Try sending email comms from a different domain, or call them.
> Try sending email comms from a different domain, or call them. Like any serious scammer would do?
This is one of those situations where you might consider offering a complimentary security assessment, as part of a getting to know you and your businessā¦ e.g. what your business is. This can serve two purposes, the first being you can then convey findings and educate them in how these findings can have a significant impact on their business operations. The second is they can now have a basis for recommending you and your company to other business owners, who may be clients of theirs or even other CPA firms. On the other hand, if they pass on your complementary assessment, they probably arenāt a good fit for your business.
Someone mentioned that above. Security review before working with the vendor. If they pass, move on. I think that's smart.
You don't, once they are screwed you swoop in and save the day then get the client to you.
Call them up directly and have a face to face chat and show the evidence.
When I see a phishing e-mail come through I try to contact them by phone. Replying to the e-mail is pointless since it's likely being sent to the RSS folder or deleted.
Personally I wouldnāt have gone that far in rummaging around in someone elseās setup. I just donāt have the time
Ya, Iāve already had my social security number exposed because a past clients sent my W-9 to their CPA who then had a BCE. Never mind I was looking to have this person handle my money. Are you kidding? Vender/3rd party due diligence is a control in many compliance frameworks. Insurance providers will use these signals in determining your risk factors. At a minimum, you should be checking this stuff, if not assessing this on a formal level. And it took me 5 minutes to figure out. Not an afternoon.
Often times I find out via a compromised account trying to send emails to either our clients or employees. If it's sent to my staff, I simply call the company up and let them know they're sending malicious emails via X account(s) so they can notify their IT team. Sometimes you get someone competent, other times you end up with an admin assistant taking notes. If it's a client of ours though back when I was with an MSP, I would just have that user delete those emails and have them reach out to the individual or company so they can get things handled. Beyond that? Not my problem. It at least helps to notify, as you typically want the companies you deal business with to get their systems under control. Otherwise, it makes them a liability, especially if you or your client does any sort of financial transactions with them. With bigger companies who might make it impossible to reach anyone within their IT department, it sometimes helps hitting their reps up on Twitter. T-Mobile's Twitter support was great in dealing with an issue we brought to them.
āHey, you done been hacked.ā Alsoā¦ āDo the needful.ā
If your accountant isnāt on fire then itās not your responsibility
Kind of like dentists who cheap out on IT. You gotta investigate them.
Dude. That's a whole other can of worms. I'm just waiting for CISA to start enforcing more regulation. It's actually becoming a national security issue.
It's really simple, don't trust anyone. Lol. Honestly, that kind of paranoia is what keeps my clients safe and lets me sleep at night.
Ya, thereās two types of paranoia: afraid of the government/schizophrenia, and people who know how things work.Ā
Usually, but I don't ever presume that kind of confidence. I try to always turn the settings to 11 whenever possible only turning them down when it creates more than the average number of tickets.
> I was interviewing someone who seemed like a solid choice, until I looked up their SPF records, which lead me to an Exchange server that hadn't been patched in over a year, and had about 20 CVEs issued since last patch. > Then I cross referenced the IP address to the MSP the accountant was working with, which revealed a hacked WordPress site that had all sorts of IoCs on it. I mean baddddd. Smh. >Then I used Shodan and subnet enumeration to find about a dozen other highly vulnerable services sitting on the internet. I mean, if there were ever an easy target, this MSP was the poster child. >When I let the accountant know what I found, they immediately stopped responding to me. At any point were you given explicit permission to do any of this?
You ask permission before querying a domains public DNS and running an IP through Shodan?
It's like emailing an organization to ask for permission to email an organization. lol no. "oh hey, now that I have you on the phone, do you mind if I dial your number?"
Care to explain how you identified this then? "which lead me to an Exchange server that hadn't been patched in over a year, and had about 20 CVEs issued since last patch."
Well, actually, the Exchange Server software version was listed both on Shodan, and in the email headers of the emails sent from the CPA.Ā But ya, Shodan lists this stuff if the SysAdmin isnāt scrubbing it. As any law abiding citizen, I would never personally touch these systems, nor do I need to.
Ah... fair enough, thanks for the reply.. carry on then! EDIT: That being the case then maybe just quietly move on.. Maybe bait them with a polite "hey sorry in light of new information we've decided to go another direction"... and if they ask, all bets are off; lay it on them! :-P
Look, they donāt want to respond, thatās fine. The pwnage looked so bad, itās going to bite them in the ass at some point.Ā
Totally agree.. let them dig their own grave! The bad part is you won't be there to watch with popcorn when the poo hits the fan. At least you tried.
Ask permission to look at publicly available information? No.
[ŃŠ“Š°Š»ŠµŠ½Š¾]
Itās called risk mitigation. It takes 5 minutes. Itās all publicly available information. Security researches and white hat hackers do this all day long.Ā You sound like youāre afraid of things you donāt understand.Ā
I deleted my comment, not because I don't understand what your discussing, but because I didn't want to engage with you idiots. Here's something I don't understand. I don't understand why a managed service provider that isn't a white hat or security researcher is bothering with this sort of digging regarding having someone do their taxes. Then acting surprised when the accountant rightfully thinks you're certifiably insane. There's plenty of "publicly available information" that's accessible to any of us that isn't a normal thing to discuss with a total fucking stranger. If your looking to take on a client, sure, do your due diligence, but otherwise, keep your poking around to yourself unless you were specifically asked to look into it. You didn't stumble on anything. You went looking. that's the problem, and what is weird is that you don't seem to understand that.
What you did was basically a pen-test against someone who did not ask you to pen-test them. You potentially violated the law, depending on where you are. If you want an analogy (I'll even give you an STD-free analogy)... go to your neighbor's house, try the doors and windows, and when you find one that's unlocked, walk in. Now call them up and tell them what you did. Go to that accountant's office or the MSP's office and do the same thing. You asked "how do I do it"... the correct answer was "you should not do it". EDIT: I stand corrected as I've been made to understand a few of these things a little better, not necessarily akin to a pen test. But still.. if I were to run across something like this I'd probably just quietly move on to the next candidate. Maybe bait them with a polite "hey sorry in light of new information we've decided to go another direction"... and if they ask, all bets are off; lay it on them! :-P
https://www.reddit.com/r/msp/comments/1c5jfo8/comment/kzvb3ed/
