Here’s proof it’s not just a vulnerability scan

Financial Services — Raxis initiated and approved funding transfers – Gaining access to a bank employee’s workstation, Raxis gathered other credentials that had previously been used to log in from that device. Our engineers then tested them on other systems we discovered. After gaining access to the domain, the team downloaded all the user password hashes and cracked most of them. Several of these worked on the employee banking system as well as the user workstations. As a result, a Raxis pentester used one set of discovered credentials to log in as a teller and initiate a transfer of funds and then logged in again as a manager to approve the transfer. (Don’t worry, the bank approved this proof of concept and watched the whole thing happen.)

Health Care – Raxis accessed systems using info from an unprotected file drive – While mapping out the internal network, the Raxis team discovered an interesting device in a lightly used subnet. Looking more closely, our testers found that it held an unsecured backup of the company’s main shared file drive. The team reviewed it carefully and realized that it not only contained information about critical internal systems and administrative interfaces, but it also included a spreadsheet with credentials for these critical systems as well.

Energy Production – Raxis accessed a nuclear reactor using default credentials – In one instance, Raxis even found a nuclear reactor controlled by an embedded device using a telnet service . . . and it used default credentials. Raxis backed away slowly from this one and alerted the customer immediately. Many systems have defaults that leave services such as telnet enabled, and such services often have default credentials enabled as well. With so many systems in place on most internal networks, these issues can be easy to miss.