Open SMB file share: tobacco company — confidential product recipes exposed to any employee via unauthenticated Windows share; pen tester's finding denied then files removed
Severity: medium · Patch status: no-fix-needed · Since 2026-11-05
During a penetration test of a tobacco company's network, red teamer Dahvid Schloss found the firm's Trend Micro antivirus failed to alert on loud Metasploit scanning. Guided to look for business-critical data, he discovered an unauthenticated Windows SMB file share (ports 139/445 open) accessible to every employee, containing a 'confidential' folder with files detailing tobacco product recipes — chemical percentages, weights and volumes — marked 'Confidential' and 'Do not share'. He downloaded one file but was made to delete it. The company's security team denied the recipes were real, disputed the finding for a year, and the files were later deleted or moved, implying they were genuine. No external breach is evidenced; the issue was internal misconfiguration and denial of findings.
What to do
- Audit all SMB shares for anonymous/unauthenticated access and restrict to least-privilege groups
- Move trade-secret and HR records off general-purpose shares into access-controlled repositories with auditing
- Enable detection and alerting on network scanning and reconnaissance tooling
- Establish a process to triage and remediate pen-test findings rather than disputing them
- Verify removal of exposed copies and check logs for prior internal access to the recipe files
Sources
All live incidents on Threat Watch
