M R Davis Library Report

Penetration Testing Report for M R Davis Public Library, Southaven

Enable passwords to be remembered is enabled.
Autofill forms is enabled.

Adobe flash update needed


26 malicious startup pages in Chrome
Malicious extensions enabled
GoGameGo extension results in malicious homepage with 3'rd party search engine they probably make a lot of money from.

THE VICTIM
R*** M********
re********'s Google account synced with Chrome
re********@gmail.com still logged in.  She uses SugarDaddyForMe, also recently applied for an extension on her utilities.  She also is now forwarding her e-mail to another account I see.  Wonder if that's the result of her being logged in to this computer.
Her Yahoo! mail account is also logged in, s****2007@yahoo.com.  At this time we find that she receives e-mails from casinos in Las Vegas.  Serious vulnerability.

There is a cookie for https://accessms.mdes.ms.gov/accessms/openAMLogin.do but their website is currently under maintenance.  Could actually allow access to someones account for a government website.  Serious vulnerability.

If the root or "admin" password is bypassed to modify settings, passwords can be shown in Chrome.  Potentially a vulnerability within the Chrome browser would show the passwords.

https://apply.adeccousa.com/job-seekers/pages/Application.aspx did not autofill R***'s personal information.  However it is highly likely that this information could still be obtained from this incident with sufficient effort and knowledge.

https://secure.indeed.com/account/login returned autofill data containing R***'s username and cloaked password allowing an attacker access to her Indeed.com personal information.  This allows an attacker to delete her account as well.  It immediately results in letting it be known to a stranger, "R*** M******* look for jobs in Hernando, MS., goes to the library and uses SugarDaddyForMe".


***

w***_a******@yahoo.com also returned autofill data.  His password was not immediately compromised but it is possible that with effort it could be obtained.

***