Pen tester finds tobacco firm's product recipes on an open file share, then the company denies they existed
RESEARCHMetasploitredteam/daily · 1 source
- Severity
- Medium
- Sources
- 1
What happened
A red team engagement against a tobacco manufacturer found an SMB share (ports 139 and 445 open) with no access restrictions, exposing IT and HR records and a 'confidential' folder with product recipe documents readable by all staff. Trend Micro AV did not alert during Metasploit and Nmap scanning. The tester was asked to delete his downloaded copy, the client later denied the files existed, and the files were gone by the end of the engagement. The article gives no CVE or patch details; defenders should restrict anonymous and unauthenticated share access and review sensitive data placement.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Review network file shares and remove anonymous or unauthenticated access.
- Restrict access to sensitive folders such as confidential, HR and IT records to authorised users only.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
The Register (Security)
Who and what is in it
Products