ZX Security will review your presence on the Internet and your susceptibility to being compromised.

During testing we will determine whether your servers have the latest security updates installed and if they have any misconfigurations that could be taken advantage of by an attacker. Access to administrative interfaces, webmail and remote access portals will also be attempted by guessing passwords and testing those collected from recent data breaches.

An external penetration test differs in scope to a red-teaming exercise in that no correspondence is entered into with staff members (i.e. malicious phishing emails are not sent)

When conducting an internal penetration test our consultants are typically given a connection to the corporate network without any additional knowledge of the environment.

The goal of the consultant is to make their way through the network, obtain administrative permissions and determine if the security team monitoring the network have the ability to detect and/or stop the intrusion.

In some cases the client will provide ZX Security with a particular target, such as the CEO’s email inbox, or a database containing credit card data.

OT / SCADA Network

ZX Security has worked with a wide range of companies running Operational Technology (OT) or Supervisory Control and Data Acquisition (SCADA) networks. We understand the critically of these systems and the impact that may be realised if they are compromised.

We have extensive experience testing these systems and understand how delicately you need to tread when assessing them. Work can be scheduled outside of business hours to suit maintenance / outage windows, ensuring any potential business impact is minimised.

A red-team engagement has a very wide scope in that people, systems and buildings are tested for security weaknesses. The engagement is often undertaken by multiple consultants with only key personnel from the target organisation aware that testing is being conducted.

A red team may trigger active controls and countermeasures, also testing the operational security response to a real life intrusion.

As with an internal penetration test, a key objective for the engagement may be defined. This may be a particular target, such as the CEO’s email inbox, or a file share containing intellectual property.

A pre-defined scope of a particular website(s) is provided, and it is tested for common web application security vulnerabilities. Testing is typically unauthenticated in that the attacker does not have valid credentials. Authenticated testing can also be performed if the attacker with a username and password tries to access resources not permitted by their role.

If you are deploying a new API for your customers or third party integrators, we can review all methods for vulnerabilities, including the authentication mechanisms.

A mobile security review will take an application provided by your organisation and review it for security issues, insecure storage of information and the permissions it requires to operate.

ZX Security has capability to review both Android and Apple iOS mobile applications.

The code for your application is reviewed first using automated tools, then manually by a human to identify common coding issues, the presence of backdoors (malicious or otherwise) and security flaws. We have experience in a wide range of programming languages.

Guest, Mobile (or BYOD) and Corporate networks can be probed to determine if a rogue contractor or visitor can gain access to corporate resources. Your Wi-Fi network will be reviewed for weak or absent passwords, network-separation controls to ensure non-corporate users remain detached from the corporate network and that authentication has been robustly implemented.

A host configuration review will consist of multiple steps including:

• Ensuring that the GCSB Information Security Manual (NZISM) guidelines for server hardening have been applied (important for customers selling services to the NZ Government).
• Determining if all applicable software updates have been installed and that antivirus is working and updates scheduled.
• Ensuring any 3rd party applications installed on the server (e.g. backup agent) have had all applicable security updates installed
• Reviewing the use of administrative privileges on the server

Phishing is an attempt to obtain sensitive information such as usernames, passwords, and credit card details (and money), often for malicious reasons, by disguising as a trustworthy entity in an electronic communication. ZX Security runs sanctioned phishing campaigns with the goal of educating users to the dangers of these types of attacks. An email will be sent to staff which entices them into entering their corporate username and password. Once captured, statistics are collated and a report generated for the management team.

ZX Security recommends the phishing process occur multiple times over the course of a year. A continual cycle of planning, education, assessment, measurement and reinforcement are recognised by the industry as the most effective way to increase awareness.

We focus on practical, real-world attacks that are used by criminals at various degrees of sophistication to give you a deeper understanding of the exact security your system provides. We also use our traditional red teaming knowledge to attempt side-channel attacks that completely bypass these systems where possible. Our report will include detailed recommendations in order to mitigate or plan for any issues that arise from testing, along with a detailed approach that shows the full extent of all attacks attempted.

• Biometric Testing (facial & voice recognition, including liveness)
• Hardware Hacking (firmware reverse engineering, serial interface access, power glitching)

Radio Spectrum Hacking

ZX Security have a wide range of Software Defined Radios (SDRs’) which can emulate full duplex radio signals anywhere from 10Mhz to up to 6Ghz.

Common uses for this technology include:

• GSM base station emulation - this can be used to intercept and inspect GPRS traffic between a cellular device and the Internet. It can also be used to detect the effectiveness of IMSI catcher catchers.
• GPS emulation - for devices that rely on GPS to triangulate their location or synchronise time, we can test what happens when time rolls backwards or the GPS location is changed.