[Music]
all right we're going to go ahead and
get
started uh thanks everyone for for
coming to our talk uh thanks for the
cyphercon committee for picking our
abstract this is uh culmination of 5
years of physical penetration testing uh
between me and my cooworker here so uh
should be a good
time so who are we I am Ryan
zagrodnik uh I'm a penetration tester
with
centcom uh been with with him about four
years uh 12 years in cyber security
started off as a CIS adman did that for
about 4 years and uh I was an overworked
crushed soul and I realized I couldn't
do that the rest of my life uh saw you
know the security team's budget and uh
got my CP and I've been in security ever
since
so uh variety of Industries Health
Finance Big Data I co-founded dc608 org
local Defcon group uh Madison
Wisconsin with my wife here uh Ali and
this is my cooworker Chad fing
biner uh hey everyone um I'm also a
penetration tester at cercom with Brian
I've been uh with them for about 5 years
uh a little more than 15 in just the it
I information security industry uh
previously did defense and healthc Care
um and I am on the the Twitter's at Chad
administrator but no one cares about
that let's talk about why you're going
to stick around here and not go to the
happy hour
yeah yeah yeah there's free beer uh
somewhere somewh not here so please
don't all leave at
once uh so so why you should say uh we
actually want to give this talk uh I
wanted you know I love telling these
stories my wife's tired of hearing the
stories uh and honestly you know
thinking about it I never thought I
would be able to tell half of the stuff
because honestly it's
confidential um but we F kind of found a
way for now we'll see if this actually
gets published uh to YouTube uh but we
definitely like to talk about this we're
happy to talk about it afterwards in the
hallway uh I'm sure we'll be other talks
tonight so um also we want to inspire
and motivate right I kind of talked
about being overworked to crush Soul uh
you know it was uh I'm I'm 38 now it was
a long uh hard crawl up the ladder uh to
get here so um you know basically you
know if I can do it you can do it and
you know don't stop uh even though you
may fall down that l better uh more
often uh than not kind of like I did so
also free stuff we're giving away all of
our current tactic techniques and
procedures uh as well as our future so
lots of
value uh legal we're not lawmen uh you
know this is not legal advice we accept
no
responsibility for what you do with this
information uh the names have been
changed and pictures have been changed
uh obviously
uh and you
know uh please don't sue us you know if
you're familiar with one call that's all
you know that's uh it's in our speed
dial for every engagement so if you're
out there David guber uh please answer
my call
uh so physical penetration testing what
is it uh basically people pay us to
break in to their organization steal
things and write a report uh for us it's
normally during business hours you know
a lot of the uh cool podcast out there
talk about the after hour stuff so if
anybody wants to hire us for after hour
stuff we'd love to do that uh but
normally ours are during business hours
uh you know we also combine a lot of
these engagements with external internal
Wireless um so while I may be breaking
into the building my cooworker may be uh
breaking into the network so it's kind
of a team
effort Rules of Engagement are decided
beforehand uh we try to get very
detailed with this um you know like
exact address can we pick locks can we
bypass you know elevators stuff like
that so uh that's very important to do
during the kickoff
calls and objectives range from data
centers specific
floors uh spe specific offices uh even
specific
people uh we carry a get out of jail
letter this is very important uh I
forgot to bring this uh one time and I
actually to go my car and get it so this
is like the only thing that proves that
you were there you know to that you were
actually hired to be there and you're
supposed to be there so that you know
along with consent obviously uh is is
super important so U wrap it up thank
thanks to all those that came before us
you know in 2015 I was sitting in a
derbycon talk listening to Jason Street
and if you haven't seen his talks
they're awesome uh and he did some crazy
things and I just I couldn't believe
that this was a job that you could get
paid to do so uh so yeah thank you uh we
stand on the shoulders of
giants all right so this is my evil
backpack this is kind of what I carry in
every engagement think pads are super
handy it's carried on because a lot of
people they have ThinkPad docks uh cuz
they're you know they're the they're
generally used in uh in
business uh the tool up there is a under
the door tool I haven't got to actually
use that on engagement yet but I carry
it uh most of the time people are on the
other side of the doors so I try not to
freak people
out um the proxy card there is my gym
membership that's my most important tool
uh that's got me in the door of every
single company um as as we'll talk about
uh the rest of it really duct tape um I
found my S myself in a situation where I
went through like a stairwell and the
door closed behind me and then I was you
know I was stuck in the stairwell I had
to like rebre break into the the place
all over again uh so duct tape um super
important to carry and my headphones uh
you know basically I just pretend like
uh you know I'm busy I'm on my phone I'm
listening to music and taate people into
the building and it's it's been
surprisingly effective uh and then
obviously they get out of jail letter so
I'm take a break here and turn it over
to
Chad sure so uh some of the things that
I carry in my evil uh uh backpack you
know very similar to Ryan's I have a uh
a Raspberry Pi in the top left there if
uh if we're doing this in conjunction
with a network pentest uh some wireless
adapters because Wireless is uh usually
also in scope uh network cables some
some generic office keys uh for cabinets
or uh file drawers and things like that
I also have at the bottom of that uh
some uh Ford Fleet keys that I have
never had the opport opportunity to use
but I am dying to steal a truck or
something and just watch the rest of the
company meltdown it's going to be
amazing sorry
Brian um some uh some lockpicks which
are also uh you know not really a tool
of First Resort um when I was setting up
you know all this stuff on my bed and
I'm going to take a picture of this I
was noticing that uh the there's three
lock picks that have like this black
coating on them
and the the hook pick and the diamond
for single pin picking are just in
pristine condition and the rake is all
worn off because that's the only one to
ever use uh nothing else is really good
for a physical pen test uh compressed
air security bits um again not stuff
that I would necessarily bring on every
engagement uh but uh it's good to have
the option uh if I think it might be
useful Ryan's going to talk about
company hey yeah so we had to change
everything everything right so uh I
think we're allowed to talk about the
industry but we'll we'll refer to
everything vaguely uh so this is my
first
engagement um the objective was uh the
data center and I was uh completely
terrified so like the week leading up to
it I I listened to a lot of Dark Diary
podcasts or podcasts of how other people
uh did physical penetration tests I got
advice from my co-workers uh Beverly
Hills Ninja is one of my favorite movies
uh in Oceans 11 obviously um so I got
lucky and the previous year uh we had
the report so you know I kind of had
like a game plan to go on um you know if
I wouldn't have had that it would have
been it would have been a clown show
so uh and then I had a an RFID you know
badge cloner that I thought you know I
totally thought like I was going to
follow somebody to lunch and you know
clone their badge and sneak into the
building you know like a ninja uh and
that's not how it panned out
so uh in my boss's advice make the lie
as close to real life as possible and
airplane quote good luck we're all
counting on
you so uh the day before I drove to the
location checked the entrances looked
for smoking areas docks that kind of
stuff uh gener like to do this just to
kind of get a feel for you know the the
building and the parking lot and the
area uh looked for Chad will talk about
these request to exit sensors so you
know you can do this cool technique
where you spit through the door and the
or use compressed air uh and the door
will open so I like to look for those
things uh and then I went dumpster
diving so you know I put on uh plastic
gloves and you know it was a nice
sunshiny day in July and uh jumped into
a nice dumpster that you know was not so
pleasant uh but again I got lucky and
the first document out of there had like
a bunch of Socials on it and uh you know
like yeah I could not believe it uh so
so I got I took some photographs and and
uh we got out of there so that was a
good start
right uh tail getting we're going to
talk about that a lot uh my gym card uh
like I said is my favorite Tool uh but
basically this this company was business
casual So I dressed you know I tried to
blend in like the Homer Simpson meme uh
with like khakis and AP poloo um I I
printed off literally like a h hundred
of the get out of jail letters like I
had them in my shoes like like in my
socks like everywhere um so I was well
prepared there uh uh we'll find out you
know later that you'll also run into a
problems where your contacts don't
answer and that's a whole another uh
world of stress so uh so I got there you
know about 7:30 uh I kind of waited in
my car and observed people going in the
building um I got out and I followed uh
this person about halfway uh to the door
and I chickened out uh like I wouldn't
say I had a full on panic attack uh but
I definitely went uh to my car and spent
a good 15 minutes uh kind of like
repearing myself and uh another thing I
didn't note in the evil backpack that's
very important is a sweat towel uh cuz
you will need it so so I finally like
you know I listen to eye of the tiger
and like you know ped myself up uh and
got got out followed this uh these two
people in and got in not only through
the the regular doors but there was like
a man trap situation so I had to like
you know kind of badge in twice but um
people people often uh they hear the the
beep when you scan your proxy card and
they assume that you know that card is
valid uh and in this particular case you
know no it wasn't um people don't really
listen for the maglock to switch uh and
that's you know kind of what
we uh what we kind of train people in is
to look for that and also you know
something doesn't feel right right like
know how to report it so um tailgating
was my my method of Entry uh I headed
straight to the
bathroom uh and tried to calm down and
that sweat towel uh came in very handy
um but yeah I I I remember standing in
that bathroom thinking like I can't
believe uh that this worked and I'm I'm
in a I'm in a company I'm not supposed
to be in right so so yeah a lot of uh a
lot of emotions uh going through uh so
so at this point I I was I have I
usually have my phone with me and I can
message my co-workers thank God uh they
can kind of guide me through the next
steps uh this particular company I
decided to walk around uh I had like an
evil USB drive and I wasn't able to find
anybody that that had to unlock
workstation so I struck out there um go
through conference rooms printer areas
uh maybe I'll try to find mg D if I can
plug in we have some quick whims that
we'll try uh but in this particular case
I was quarantined
so uh striking out everywhere I I gave
pretty much gave up and I was like I'm
just going to ask somebody where the
data center is uh and you know thinking
I'm going to get caught right away and
uh the guy was like oh yeah yeah no
problem like here follow me and uh so it
ended up not being the data center the
data center actually not ended up not
being in the building um which which
they I I had like a kind of a choice of
three different buildings um before the
engagement started so in this particular
case data center wasn't even there um
but I I tried to get into the network
closet and ultimately failed so um but
still that was my first engagement and
uh you know I felt like I feel like went
pretty well so uh how to defend so
secure document storage is super
important also super important to train
your employees to use that uh I know
it's you know easy to throw your lunch
away with a whole packet of social
security numbers but like try and put it
in the proper
container um so also you know we kind of
in this particular situation we we
mentioned you know social engineering
right like someone should have like I I
had a fake kind of badge on but you know
if someone looks suspicious and is
hanging out in your building for 6 hours
uh you know you should someone should
have noticed and asked for my badge and
asked why I was looking for the data
center right so uh that was my first
engagement uh so my first engagement was
with Company B uh there were uh two uh
locations we're going to talk about
today uh the first location had a
problem with building security that
we're going to talk about
uh and well let's just start there uh so
I went to this uh building it was in a
large metropolitan area um kind of a
downtown area you had to you know go
through the front door and when you open
the door the entire floor is just a
completely open Lobby uh there's uh some
turn Styles in the Middle where you have
to badge in and it'll let you go past
and go about your day and between you
and the turn Styles is a desk for
security with two guards there um and
they were rather Vigilant uh I could not
talk my way in there I couldn't tell
them I was there to fix the wi-fi or the
air conditioning uh if my name wasn't on
the list I wasn't getting in uh so the
problem with you know not walking into
Mordor is
that well if that's the gate to Mor
door you just walk around the gate uh
the back door uh the the back of the
building had a you know a loading dock
or you know for deliveries and things
like that uh there was really no
security to speak of um there was a
person there who I think was a doc
manager uh but he sat in an office he
wasn't really out paying attention to
everything he had doc manager stuff to
attend to um you know it was a large
open space for like the FedEx truck or
the UPS truck to pull in
uh and he really didn't have good
visibility because I just put a FedEx
truck in between me and him and then I
sneak my way in the building and found
the freight elevator and you
know then I panicked because I actually
got into the building this was again my
very first physical penetration test uh
but it did work out and uh got up there
you know worked with the uh I think we
were doing a network pen test in
conjunction with that uh so I got up to
the floor I found an empty conference
room and hung out there and just kind of
calmed myself down talk to the talked to
the rest of the team tried to figure out
the next moves and uh it it ended up uh
working out really well I found an
unlocked workstation eventually and I
got on Microsoft teams and found my
point of contact and said hey I'm in the
building uh which was super super
cool uh the the way to defend you know
the main takeaway for this engagement
was that uh if you do have you know
human security uh and you know and it
you want to make sure that they're
posted in more than one place they had
the front entrance on lockdown uh but
those guards were stationary they didn't
roam the building they weren't you know
checking out you know different areas uh
to enter the building uh and those were
the only two guards they had so if you
can have more than just two at one at
one entrance you should do that or if
not uh make sure one of them is walking
around and checking other uh things
because uh you're never going to have a
building with only one way to get in or
out uh the other location that uh I had
for this
engagement uh with Company
B was another office building uh it was
really interesting they it was badge
access
only and as uh I don't know if this is
reverse tailgating but as someone was
leaving I had my fake uh uh Pro card and
I just put it up there there was no beep
it didn't work at all but she assumed
that I was you know doing the right
thing and running my badge through the
reader and she held the door open for me
and it was wonderful I got in uh met
some folks I told them that IID you know
this was uh in another city but I I knew
they had a data center in Milwaukee
because Ryan was doing the physical
pentest for that
location and uh the person I said that
to said oh really well I just
transferred from the Milwaukee Data
Center and I don't know you it did not
go well from
there um the next day was interesting
because uh I I went you know during the
daytime I figure you know last night I
was there I ran into some Executives
this is an office building with a SE
Suite you know folks are you know it's
business casual here right uh no no uh
this is how they were
dressed and when I was there with like
my Dockers and my buttondown shirt uh
this is what they
saw that was a
mistake uh but uh the main takeaway here
is you know security awareness uh for
your employees make sure they are
getting uh training make sure that they
have something to do when they see
someone tailgating uh they shouldn't
just be letting folks in uh they they
shouldn't have to wonder what to do you
know give them a process Empower them
give them a phone number to security or
someone else to call that says hey this
doesn't look
right all right so uh so my I think it
was my next engagement it was a big one
um it was three locations two br
branches in a in a corporate
office
uh things to note from the kickoff call
they had just been robbed and everybody
was spooked
so uh you know if something were to go
wrong and they were to call 911 I was to
remain on site so uh this kind of
spooked me a little bit cuz this was in
a larger City uh and you know I did not
want to end up in the drunk tank um
overnight or or through the weekend
right so uh so yeah I was a little I was
a little freaked out by that
um I I tried to go in to like through a
back door you know it wasn't going to
work uh I pretended to be there to
update the cameras and you know I I I
almost got in she uh
she had happened to be busy uh and you
know was about to let me in the back
room but uh she she followed procedure
and and you know basically asked me to
come back another time so so I had to
move on from there uh starting out with
a failure and going on to the next
location so uh the the next location you
know was was having to be
multi-tenant uh I tried to tail get
somebody in like for hours it felt like
uh they had an elevator access uh via
proxy car I didn't know which floors
they were on um I went out again like
into like the parking structure and was
chatting with my team and you know
finally got the the courage to try again
uh I got super lucky an employee was
coming off the
floor um was able to grab the door and
get onto the floor got into a empty desk
that happened to be a ThinkPad dock uh
got on the network you know ran
responder those types of things some of
our quick wins uh and then uh I had a
chance an employee got up and I had my
rubber ducky and plugged it in uh it I
did get a I ended up getting a shell uh
but there like something killed it by
the time I you know got back to my car
uh but I totally spooked the employee
next that was desk over and she you know
stood up and it's like you know who are
you what are you doing and you know I'm
like oh I'm here from my te you know
everything's good you know I'll see you
later so uh so so I got out of there
right like I did not want to this was
like I I think I still had another one
or two places to go and I did not want
to get delayed and get arrested at this
location so so yeah I thought you know
uh was good enough and uh I got out of
there and everybody was happy
so uh how to defend this one security
awareness tailgating again uh EDR not
EDR well EDR helps but like DLP right
like this particular case you know um
yes the rubber ducky is kind of
configured like a keyboard but still you
should be blocking you know data USB
drives uh if you have to allow them you
know have them on an isolated
environment or you know have additional
controls on those
things so the next place this was their
corporate HQ uh they had already
received their security team had already
received photos of me trying to get into
the last two locations which were like
in different states right so uh so I you
know I didn't know this at the time time
um so I'm walking around the corporate
office with a evil roller backpack um
and you know the the security team had
already ided me but you know they were
they were in on it right so they didn't
uh they didn't give me up so this one I
tailgated all the way up to the floor um
they had proxy C in the elevator and at
the door um but with the elevator and
it's weird uh you'll someone El swipe
you can swipe your empty or or gym card
and push the same button you would think
the elevator you know wouldn't wouldn't
work right but it just lit up and like
looked like it was it was an authorized
access so uh got on the floor was hang
out in an empty office and this you know
uh ad and assist or somebody came in and
uh gave me the annual calendar and I
thought for sure I was busted then right
cuz I was in this like empty office uh
sweaty again
uh and you know got got the calendar
thought I was thought it was over uh
ended up going dust to desk putting in
the the rubber ducky and some some poor
lady you know asked me what I was doing
I said I was you know updating the
phones or something and uh I had to
prend my get out of jail letter and in
this case they didn't answer and this is
the first time this has happened uh it
wasn't great but luckily my my uh
contacts were in the building and and it
was I did not end up in the drunk tank
so um how to defend again tailgating
you'll see the the common uh you see
that that's the common way to get in
right and in this case I I wasn't
expecting to get very far with the
elevators uh having the proxy cards as
well but uh once again you know I was
able to get in and uh you know and got
caught so move on to the next
one
all right so uh company
D I don't remember which company this
was uh they had they had uh two floors
of the uh of the building were in scope
so uh it got a little tricky once again
because the way to get to those two
floors I had to go through someone
else's building and they may not have
been clued into the penetration test uh
but it was fine because their security
just didn't care which is awesome for me
me uh they had uh they had badge access
on the elevators which I thought was
great you know you guys are doing a
wonderful job but they had turned it
off so that was not great uh we'll talk
about some request to exit sensors and
some work from home
Shenanigans uh here I hope the internet
works pretty well I couldn't get a video
from the actual pentest but if you're
familiar with uh Dev and Olaf
uh he gives a really interesting
demonstration on how uh these request to
exit sensors uh can be
vulnerable let me know if that's
plain so he's coming up to a bank here
the door is locked oh what to do so he's
got a glass of
whiskey and he just spits and boom the
sensor is looking for movement it's
looking for you know a difference in
heat or something like that sometimes uh
it's not very smart if it if it sees
that trigger it's going to unlock the
door uh and I was able to use uh that
very thing to get uh around their
building are we here we
go uh so request exit sensors if I
should have is everyone familiar with
the request exit
sensor you you have to badge in uh to
get into the secure side of the building
building or the room or wherever it is
uh but when you're leaving you don't
have to badge out uh it is it's a motion
sensor it's a heat sensor and you can
you know spit whiskey through the door
or you can use a can of compressed air
upside down and the motion of that uh
Mist uh the temperature differential
because it is so cold is enough to
trigger that sensor uh so either spend
the money on really high dollar sensors
that make sure it's an increase uh in
body temperature make sure it's looking
for motion from a shape that looks you
know mostly like a human or just buy a
button instead that someone has to push
that's a way lot
cheaper
yeah uh this was another fun one uh so
another again multilocation uh retail
stores in a corporate office uh they
were multi-tenant so I kind of had to
figure out you know which which part of
the building that we're in and that
always gets complicated right like uh uh
you know I'm allow am I allowed to pick
the lock on the back of like a mall
store right like the building is
technically owned by the mall these are
the things we talk about uh H our chest
during
engagements um so yeah it gets
complicated uh you kind of have to do
some Recon beforehand and and
during uh so this one again I tailgated
it someone through the front door use my
gym card uh got gets me in everywhere
um there was another door to get onto
the floor and I followed uh this
gentleman in and he stopped and he said
uh you know you're supposed to be here
right and and I was like thinking I'm
like I'm like it's over I'm totally
busted I'm like yeah you know totally
I'm totally supposed to be here um and
he's like okay good just check in
and so so again the sweat towel came in
very handy uh at that time cuz I thought
for sure I was busted
um in this particular case I found in
like an empty area photographed some
documents uh I don't know why I did this
cuz we already doing internal but I
decided to plug in to the netware and
start you know yoloing in map and you
know uh and so I happened to be found
out I was right next to the sock team uh
and they had you know so they had a nice
like TV playing like the prices right
and you know I'm like I'm not like doing
anything crazy but I'm setting off
alerts uh and I just hung out there for
a while um you know running responder uh
collecting hashes and stuff and you know
like they they noticed but they had no
no way to find like where it was coming
from so um so I spent a long time I was
wait basically was hoping that they
would you know track down the source of
the phone call coming from inside the
house but uh it didn't happened
and um I decided you know to YOLO it
once again and
head for the data center I figured I'd
you know got past one guy already I was
just going to my plan was to just go
knock on the data center door and hope
that someone just lets me in uh so so I
tried that nobody answered you know I
knocked louder nobody answered and then
finally an employee uh you know noticed
me trying to get in the data center and
you know asked me what I was doing there
uh and and I had to present my get out
of jail letter at that time so uh still
still a fun time
uh but got caught
again so um as we kind of talked about
the tail getting again um I didn't
really it wasn't really social engine
engineering you know I didn't feel like
uh that was like a particular finding in
that case even though I did technically
talk to somebody and lie to them um but
yeah like you can have your physical
security controls uh you know on the
outside of the building and then to get
into the floor and
they can still be easily bypassed by my
my gym
card so this was this was a fun one for
me I really enjoyed this uh I think I
can well I think I said Yep this is a
hospital
um when you're doing a physical
penetration test what before you get
started when you after you have your
kickoff call after you get the address
your target you need to do some
reconnaissance you know do a Google
image search uh you know maybe find
out how big the hospital is or if it's
in a large or small
town um I I used to work in healthcare
so I had a hospital badge uh my wife had
a
stethoscope uh the the lab coat was
something I always wanted to have anyway
and now I had a halfway decent excuse so
I went as uh Dr
Chad what I didn't realize was that this
was a very small town uh the hospital
that had two doctors in the house uh and
they knew both of them I was not either
of them so that wasn't going to work at
all uh I brought a fake badge with me
does any does anyone know the television
show
Firefly so my badge is you know I work
for the blue Sun uh Contracting uh
company uh this this is one of my
favorite I'm I'm going to ramble for
just a second
from the hotel to the hospital there was
this computer technology store and uh
one day I just was you know I'm done
working at the hospital trying to get in
for the day I'm just going to stop in
the store so I I go in I see what's
going on I chat up the guy uh and I'm
like you know so do you do you just do
consumer business do you do do you work
for any of the companies here do you
work for the hospital oh no no I you
know I used to work for the hospital but
uh you know then they started
Contracting with with uh this other
large company you know like one County
over oh really and well you Acme
Technical Services so the next day I
showed up there yeah I'm chatting with
blue Sun I'm a subcontractor with Acme
Technical Services do you I'm here to
fix printers and oh yeah you're totally
fine let me take you to the surgical
Suite or something stupid uh and and it
worked out uh I really uh and I never
would
have gotten that that far otherwise you
know I couldn't pretend to be some
doctor or uh technician uh I couldn't
tell him I worked in it because once
again there were three and a half people
in it and I wasn't any of those people
but if I was a subcontractor for a
subcontractor of a
subcontractor it's totally
believable uh one of the more
interesting things here was that you
know they kind of were you know paying
attention to things I couldn't get in
they had all of the security
in the world except they had a live
Network port on the outside of the
building that you know I was able to
cross a lot of things off the list that
day it was super cool and what a unique
finding
[Music]
um this may come as a surprise but the
way to defend is to not have live
Network cours outside of your
building
all right so uh this this was another
one of my favorites uh did some recon at
a corporate
headquarters uh you know kind of I was
able to see an employee walking in and
kind of make out you know what their
badge kind of looked like so so being
the resourceful guy that I am I drove to
Staples and bought the uh badge holder
and then I went home and printed this
picture I took of myself uh in the car
that
morning uh onto piece of
paper and it put the company logo on it
and like printed off the inkjet you can
kind of see in the image there like I
like punched the holes out crudely and
then uh behind that is my gym card again
so um so so I had that on uh I sate the
person in the front door but in this
case the front door wasn't even locked
and they their process they had the poor
receptionist you're supposed to like
hold up your card uh to them and you
know they give you a thumbs up or thumbs
down uh uh and they were like 50 ft away
so there's no way that you know anyone
was checking who was coming in the
building uh this elevator was uh proxy
card again so I kind of just hung out by
the elevator and with my headphones on
and waited for someone uh to get in the
elevator and I just followed them onto
the floor uh this particular engagement
I I had to the it was a multifloor
objective and then I was supposed to go
to like a certain guy's
office um so so luckily I learned from
previous engagements to tape the door uh
open if in case I need to get back in uh
I had forgotten my get out of jail
letter and I realized this you know as I
was standing on the third floor uh in
the building is not a good place to be
in so um luckily I had I talked to him
my contact and he wanted me to exit the
building anyway and come back in and try
to get to another floor so so I was able
to retrieve my get out of chair letter
from my car uh thank God uh so that that
one really ended you know uh in me
sitting at the contacts desk and uh you
know waiting for them to come out of a
meeting
so so wrapping that up how to defend
again the the
tailgating have dedicated security and
you know lock the front door right you
have the proxy cards just make people
swipe in and um you know if if you don't
have the budget for physical security
like you know at minimum like have a
have them have to push a button or
something to get in the building right
like um you know even the proxy card in
the elevator wasn't you know I think I
started that engagement at like 8 and I
achieved both objectives by like 8:30
that morning
so all right so
another another good one here this was
uh two locations I had to uh uh get in
they to the credit of the client here
they had some really uh good good
security policies and
procedures uh there was some room for
improvement uh on the execution of those
uh some more uh employee
education um and sometimes most times I
would rather be lucky than good
U once again you know I'm Chad from it
I'm always Chad from it and today I'm
here to fix the wi-fi um I stopped in
into this
location um I think I can say it was a
bank uh I I think that's fine there was
a receptionist there and I was telling
her hey I need I need to get in I need
to I need to look at your Wi-Fi it's
very important and she was like on the
ball I you know I can't let you in I
can't let you do anything you know we
have a process for vendors uh you are
not on my list sit over there let me
make some calls so this is already
started starting off very poorly uh
after a few minutes you know she's
making calls I go to check in with her
and she's just not she's not able to
figure it out I'm like okay well let me
let me call someone let me get on my
phone and uh see if I can call my boss
and we can figure this out um by my boss
I mean let me talk to the rest of the
team to see what I should do because I'm
about to get caught uh
eventually after what seemed like
forever maybe 10 or 15 minutes of her
trying to email people or message them
on teams or make phone calls um she gave
up and she took a little posted note and
she wrote down the name
of Steve McFarland and his phone number
and he she handed it to me and said you
need to call Steve and and you need to
figure this out and I said absolutely
I'm so sorry for the inconvenience I
will definitely call Steve who I
actually did call was Ryan and I said
Ryan I need you to be Steve right now
and I don't I don't actually know what
Ryan said what what what how'd that go
so so I answered the phone kind of I
kind of prepped a little bit for this uh
I was supposed to be this guy Greg I
said you know Chad's supposed to be
there update the
Wi-Fi uh and she said you know okay oh
you know thank God uh you I wasn't sure
I know I'm supposed to verify with you
you know that uh you know they are who
they say they are so I just wanted to
follow the procedure and uh after that I
had to go home and like you know part of
our job is lying to people it's it's
yeah it's trying to help them out but I
definitely you know feel like I need to
repent uh after that because this lady
sounded so nice and she was trying so
hard you know to follow the procedure
and I just completely lied to her and
you know KN still in disbelief that this
was working one and two that my
co-worker here was going to go in and
plug into you know their Network and and
you know write them up for it so so yeah
it was uh it was kind of an ad hoc thing
but I again I you know we got lucky and
I just like couldn't believe that that
worked I don't care about any of that
uh uh however the conversation went at
the end of it it seemed to be that Ryan
said yes this is Chad he's supposed to
be here give him whatever he wants and
so she had me she still was following
the procedure she had me sign into the
vendor law book I put my name in the
time once again blue Sun Technologies
that's who I am fixing the Wi-Fi and
then she took me to the the little
Network closet they had she unlocked the
door and said uh let me know when you're
done it was beautiful I loved
it um so I I always like to call out
good things at uh you know at the
clients when I see them and this lady
she was was trying she really was uh the
process and procedure she didn't have
was who to call when the processes and
procedures break down uh she couldn't
get a hold of anyone she didn't know
what to do I wasn't on the list but I
was insistent that I was supposed to be
there and she just uh she needed to know
who to call and uh you know figure out
what to do from there when the process
doesn't
work all right I think this is my uh my
last story uh this this I think is
probably my very favorite physical
penetration test I've ever done uh once
again Chad from my but I'm fixing
printers today it's totally
different uh once again it it's the same
company it's it's a it's a bank and I
had absolutely no plan I I was sitting
in the parking lot staring at this place
and had no idea what to
do um
I just said okay YOLO let's do this and
I just walked in as soon as I walk in
the door there's a little anti- room
foyer Lobby whatever uh and I see the
banking floor but to my left are some
stairs and I have no idea what I'm going
to do at the banking floor but the
stairs could be a new adventure so I
went up the
stairs uh again I'm here to fix the
printers and this executive assistant uh
lady uh greets me and is wondering why I
just walked up the stairs to their bank
that people don't do this uh but I told
her I was here to fix the printers and
she bought it hook line and sinker it
was
easy uh she took me over to the to one
of her printers and I just I'm just
pushing buttons I'm printing test Pages
or I don't know what I was
doing uh but I told her I was done asked
her if there were any more and she said
oh yeah we have some Prince downstairs
and I'll I'll I'll take you over to
them so now now I have a plan for
downstairs this is great great and I
don't have to say a word because uh
Rachel or whoever this lady was is
introducing me as Chad from it here to
fix the
printers this is
perfect well so she sends me over to
this printer in the
breakroom and in the
meantime uh this is important to note my
my point of contact for this location uh
was
upstairs and and he heard me talking to
her about the printer he doesn't know
anything about some guy coming to fix
printers so when she went back upstairs
he called her into his office I don't
know this yet but he calls her into his
office and says hey who who was that oh
no this is this Chad he's here to fix
the
printers and he says and he was super
cool he didn't he didn't say a word he
just said well is he on the vendor list
did you check him
in and I find out later I I think Rachel
was just trying to save face and she's
like um
[Music]
yes and then she goes back
downstairs so I'm I'm finishing up with
this second printer the third printer is
behind the teller line in the little
room where they interact with the the
drive-thru people and I'm trying to get
into uh I'm trying to get behind the
teller line that's my that's my
objective
today and uh she comes back down she and
she's talking to the manager downstairs
and the manager downstairs stops me he's
like well you know Chad you you didn't
sign into the vendor book you need to do
that uh you know we just need to verify
some things we need to follow the
processes oh yeah absolutely I'm I I
love processes I definitely want to do
all of these things for
you well the other thing that she did
was she got on the phone to some kind of
regional director who is not you know
clued into this physical p conentration
test and uh let's call that person
Elizabeth Elizabeth the director and she
gets her on the phone and says hey is
there is there someone here to you know
from it working today and Elizabeth says
no I don't know who this is bring him
into the office have me on speaker and
I'll get to the bottom of this I'll talk
to
him so they pull me into the office I
don't get to go behind the teller line
and it's all over for me it's it's
done and uh Elizabeth says you know who
are you again well I'm Chad from it te
I'm here to fix the
printers she says printers PR are you
here to update the firmware on the
printers
yes I am absolutely here to update the
firmware on the
printers oh yes I've had a ticket out
with your company for about 3 weeks been
waiting for you to come out and update
the printers yes Chad is supposed to be
here let him do whatever he
needs it's going to be fine
so I I go and No One Believes this
everybody's radar is pinging they are
scowling at me but this Regional
director said that I was allowed to go
behind the T line and update the
firmware on the
printers so at at the end of this the
thing that makes it my my very favorite
uh physical penetration test is
my point of contact the vice president
or whomever was upstairs that knew what
was going on who by the way after
Elizabeth said I was supposed to be
there Rachel runs back upstairs to her
boss and says we just checked out with
Elizabeth and he is
fine and I was I don't know this but I
imagine that guy was just face
palming so I I get done and uh a few
minutes later you
know he's he's asking me come upstairs
to maybe debrief him and let him know
what's going on and he was so interested
in exactly what I did and exactly how I
did it and how I lied to all of his
employees and said they're they're out
to lunch right now but can you come back
in like an hour and maybe just you know
explain to them what you just explained
to me and everyone was so interested
they really kind of hated me a lot at
the beginning of this explanation but at
the end they they really did seem to
understand and I love that I got
to in the moment explain you know the
sort of things that you know someone you
know with less Scruples might be able to
do and they need to stay
vigilant uh my takeaway here again is uh
processes and procedures um I don't
think I would have been able to get as
far as I did if that executive assistant
just had a way to say you know what I
think I messed up uh you know how do we
fix this uh I think she was just trying
trying to save face and it was awesome
for me but I think uh if you have your
staff if you give them a way to say hey
I think I messed something up you know
hey I accidentally let somebody you know
into the bank vault or clicked on an
fishing email or something like that
give them an opportunity don't make it
punitive uh this is how you know we all
do
better all right right so this this was
my first physical pent test back
basically from Co um you know it was a
weird a weird time so people are back to
the
office uh kickoff call
highlights I forgot uh uh to ask if the
guards were armed uh and they ended up
being armed so so put that in bold in
your kickoff call notes uh to make sure
that you ask that question uh they made
it sound like I had no chance you know
that the previous testers have all been
caught and you know I was going to fail
so I did some Recon the day before um I
ended up uh tailgating uh employee in uh
right when I walked
in the thing right in front of me was
the data center and I I could not
believe it so uh it happened to be
behind
a uh you know RFID Card a proxy card um
so I decided to go
upstairs uh I plugged in I got qu
quarantined I wasn't you know I was on a
smaller part of the network I ended up
finding a PR area uh and I got lucky
that particular Port had Knack like
disabled and I was fully on the network
so I was pretty happy with that and
decided to do YOLO rubber ducky time and
walk around uh I happened to get a
workstation this uh person got up and
went to the bathroom and I plugged in
and I didn't know to the time until I
went home and checked and uh actually
until the engagement was over but that
workstation that I shelled was a domain
admin and they had active sessions so
just won everything right hit the
jackpot um but I I didn't know it at the
time right
so uh another huge win I bought this
flipper zero thing and it's been like
completely worthless to me uh so you
know I was able to clone like some some
lower level cards in this case I a
employee had a badge on the desk and I
dropped the Flipper on and it like ding
you know successful and I could not
believe it uh I didn't get ended up
getting to use it uh cuz I end up
getting caught outside the data center
trying to talk my way in uh in which Cas
and in this particular event I got so
close like I I I said I was in the data
center I went to use the bathroom and I
came back and I got locked out and this
manager like was within inches of
swiping his card and letting me in the
data center and his spider sense you
know kind of went off and uh um those
are always really awkward moments right
when when you when you people realize
that you're lying to them and you know
they kind of freak out like uh he ended
up trying to check my backstory but
ended up summoning the armed guards and
you know who who were less than happy
with me uh at the time but but thank God
my at this time my contact uh answered
their call and you know all was well but
it it could have gone a lot worse so
conclusions so I know we're uh got to be
wrapping up here so conclusion is
everything we've been talking about um
security awareness training for your
employees uh you know tell them that
tailgating is bad social engineering is
bad and give them somebody to call when
they see it uh if you don't have uh
human security guards um give them some
number to call you don't want uh you
know Rachel the executive assistant
trying to tackle some guy getting behind
the teller line that's not her job and
she is ill equipped
to do it uh secure Document Handling you
know lock things up in a cabinet or a
file drawer network access
control uh if you have physical security
use them entry and exit controls don't
leave workstations unlocked we all all
know that uh and my biggest thing is
teamwork uh that guy at the bank who
didn't let the cat out of the bag uh
understood that this wasn't an US versus
them it was an us with them and he let
things play out because there was a
greater lesson to be learned and I
really did appreciate that um I'm going
to skip future tactics techniques and
procedures because we're we're getting
the cut off sign now but talk to us in
the hall we'd love to tell you all about
the things that we're doing today and
are doing tomorrow uh other talks Jason
Street Dev and Olaf Dark Knight Diaries
those guys are great thank you so much
for coming to our
[Applause]
[Music]
talk