Tobacco Firm's Lax Security Exposes Secret Recipes

"I'm running through this environment, and I'm basically just using the loudest toys and tools you can imagine," said Dahvid Schloss, describing a penetration test that exposed an unusually lax security posture at a tobacco company.

Dahvid Schloss's engagement and the silent defenses

Schloss, a professional pen tester and red teamer, was tasked with finding weaknesses on the tobacco company's network. He began with standard offensive tools, including Metasploit. According to Schloss, the company's Trend Micro antivirus produced no alerts during the scans — a silence he likened to "shooting a machine gun and having no one hear it." That lack of response set the tone for the engagement and convinced him the environment offered few barriers to discovery.

Discovery on an open SMB file share (ports 139 and 445)

Following the initial scans, Schloss searched for network file shares that allowed unauthenticated or anonymous access. He located an open share and scanned it with Nmap, which showed ports 139 and 445 open — indicators of the Windows SMB file sharing protocol. The share, the source reports, hosted sensitive IT and HR records but had no access restrictions and was effectively exposed to every employee in the company.

Recipes labeled "Confidential" and the deleted proof

Inside the exposed share Schloss found a folder named "confidential." Files bore names such as recipe, the product name, the sub product name, and the date. One file he opened contained explicit manufacturing details: how the tobacco product was made, the weight and volume, and the percentage of each chemical. The document itself was marked in red letters at the top "Confidential" and at the bottom "Do not share." Schloss told The Register, "I think we found a smoking gun here. This is pretty bad."

Because the file contained highly sensitive information, Schloss's manager instructed him to delete the copy he had downloaded rather than retain it as demonstrable evidence. That decision later constrained his ability to prove the file's existence to the company's security staff.

Company denial, disappearance of the files, and a year-long dispute

When Schloss reported the findings to the company's security team, the reaction was denial. His contact told him the recipes were not real and denied there was a security problem. Schloss pushed back: the files were in the expected department, in the expected folder structure, and named in a way anyone would consider indicative of a recipe. Despite that, the security people at the tobacco company "vehemently denied" the files were real. The dispute persisted for a year. Towards the end of the engagement Schloss checked the share again and discovered the files were gone — "deleted or moved, or something," he said — which the source presents as an implicit confirmation the files had been real yet no longer accessible.

What this means for technologists and security teams, the company's security staff, and red teamers

• Technologists and security teams: The case shows an exposed SMB share with open ports 139/445 and no access restrictions can host highly sensitive material. In this engagement, standard offensive and scanning tools produced clear, actionable findings while an installed endpoint product (Trend Micro) did not alert during active scanning.
• The tobacco company's security staff and management: The source documents a breakdown between a red team’s evidence and the company's acceptance of that evidence — a dispute that lasted a year and ended with the relevant files removed from the share. The company’s denial of the files' legitimacy, and the subsequent disappearance of those files, are key actions recorded in the engagement.
• External pen testers and red teamers: The engagement highlights a procedural tension: Schloss was ordered to delete his downloaded proof because the documents were "such sensitive information that he shouldn't retain a copy," yet that deletion later undermined the ability to demonstrate findings to the client. That sequence of events illustrates an operational trade-off between evidence preservation and handling sensitive customer data.

The record presented in the source paints a stark picture: an open SMB share holding documents explicitly labeled "Confidential" and "Do not share," a silent antivirus, a pen tester who found what he called a "smoking gun," and a year-long denial by the company that ended with the files removed. The engagement raises clear, concrete questions about how sensitive files were stored, how defenders verified claims of exposure, and why the company chose to contest and then remove the artifacts rather than lock down access and preserve evidence.

Original story: https://www.theregister.com/security/2026/11/05/tobacco-company-got-smoked-by-leaving-secret-recipes-on-a-file-share/5307704