Reached the signalling network from a ticket kiosk
A payment terminal on a station concourse turned out to share a VLAN with the operational network four hops away.
- client
- A national rail operator
- sector
- Transport / OT
- service
- Red teaming
- duration
- 7 weeks
The operator had segmented its corporate and operational networks years earlier and had the architecture diagrams to prove it. The diagrams were accurate. The estate was not — a decade of station refurbishments had quietly reconnected things nobody was tracking.
Transport / OT
Physical entry to three stations using contractor pretexts agreed in advance with the security director.
Implanted a monitored device behind a concourse ticket kiosk and left it for eleven days.
Mapped reachable services from that position and found a maintenance jump host trusted by the operational side.
Stopped at the boundary of the signalling network, evidenced reachability, and did not cross it.
| ref | finding | severity |
|---|---|---|
| DW-2601-01 | Flat VLAN shared between concourse payment and maintenance networks | critical |
| DW-2601-04 | Jump host trusted by operational domain with no MFA | critical |
| DW-2601-09 | Contractor badges not revoked after project completion | high |
| DW-2601-17 | No alerting on new MAC addresses in station switch closets | high |
We proved reachability, stopped, and handed the operator a segmentation programme with the four specific links that mattered ranked ahead of the ninety that did not. All four were closed within a quarter.
They found the thing we had been assured was impossible, then spent the last two weeks teaching our team to find it themselves.
tell us what you would least like us to reach
Scoping is a conversation with the people who own the systems, not a form. Twenty minutes is usually enough to tell whether we are the right practice for the problem.