1
00:00:00,000 --> 00:00:04,820
Hi, everyone. We'd like to invite Brent White and Tim Roberts. Brent White is a senior

2
00:00:05,540 --> 00:00:10,780
security consultant at TrustedSec and Tim Roberts is a senior security consultant with NTT

3
00:00:10,780 --> 00:00:16,660
Security Threat Services Group. Both have spoken at ISSA International, DEF CON, Derby CON,

4
00:00:16,780 --> 00:00:21,140
and various B-Sides. Maybe not always together, but so we have them tonight together and we

5
00:00:21,140 --> 00:00:24,900
appreciate having them. Their theme is skills for a red team. Let's give them a hand.

6
00:00:30,000 --> 00:00:35,760
I thought that was going to fall over. I think we almost died. That would have been

7
00:00:35,760 --> 00:00:41,560
interesting, huh? Short talk, right? So as you mentioned, I'm Brent White. And I'm Tim

8
00:00:41,560 --> 00:00:46,240
Roberts. So as you can see, we're very mature. Yeah, as you can tell from this, we're

9
00:00:46,240 --> 00:00:52,300
extremely mature and highly professional. So hopefully you're not too disappointed at that.

10
00:00:52,440 --> 00:00:59,300
So, you know, the wonderful English, English over there. So all right, let's get into it.

11
00:01:00,400 --> 00:01:05,840
So what do you mean by red teamer? Red teamer is often a defined, it's kind of subjective in

12
00:01:05,840 --> 00:01:09,480
InfoSec. Like some people say, well, red teaming means this. Well, other people are like, no, it

13
00:01:09,480 --> 00:01:14,740
means this or whatever. And it becomes this butting head thing. For us, we're defining it

14
00:01:14,740 --> 00:01:20,600
specifically for this talk as attempting to covertly identify gaps. This includes physical and

15
00:01:20,600 --> 00:01:26,200
social engineering gaps, security awareness, in addition, often in addition to technical. Some

16
00:01:26,200 --> 00:01:29,980
clients prefer we don't touch their systems. We just get to their systems. So we're going to

17
00:01:29,980 --> 00:01:33,900
touch their systems and we have a proof of concept. But in this, we're going to focus primarily

18
00:01:33,900 --> 00:01:41,580
on the social aspects and the physical aspects. So therefore, red teamer means you're a member of

19
00:01:41,580 --> 00:01:47,680
a red team. So show of hands, who in here has ADD, ADHD? I mean, you're not going to hear

20
00:01:47,680 --> 00:01:52,760
anything we're going to say because of, you know, just a warning. You're going to in a few

21
00:01:52,760 --> 00:01:57,500
months go back and watch the video because you won't hear anything we say. So yeah, squirrel.

22
00:02:00,800 --> 00:02:09,500
So, okay. This is a very poor stand up comedy act, apparently. So, yeah, so we're going to talk

23
00:02:09,500 --> 00:02:13,220
about a few different assessment types, covert, overt, and hybrid, and we'll go ahead and jump

24
00:02:13,220 --> 00:02:19,880
into those. And something else, too, if anybody has any questions while we're talking, please

25
00:02:19,880 --> 00:02:23,540
raise your hand or just interrupt us so we can go ahead and. Or throw something at Brent.

26
00:02:23,720 --> 00:02:29,840
Yeah, money or something. What's your name? That is Theresa. She's really sweet. Yes.

27
00:02:29,980 --> 00:02:37,120
Nice lady. Has a mouth on her, though. All right. So, all right. See, I'm telling you, this is

28
00:02:37,120 --> 00:02:43,680
going bad. This is going to go awful. So covert, Tom Clancy, so you try to be all sneaky and

29
00:02:43,680 --> 00:02:48,400
covert, and we had some trolls. It's like, okay, the short guy reads too many Tom Clancy novels,

30
00:02:48,600 --> 00:02:54,360
and it's like, no, I don't. I try to be sneaky. So this is basically if the company has you come

31
00:02:54,360 --> 00:02:58,380
in, and it's like, okay, see what you can do as an attacker in an unauthenticated, or

32
00:02:59,240 --> 00:02:59,960
unauthenticated millennium. You're going to have to do this. You're going to have to do this. You're

33
00:02:59,960 --> 00:03:05,560
a malicious attacker. What can you do? Where can you go without, you know, without the approval

34
00:03:05,560 --> 00:03:11,320
of being there? So we'll talk about some methods about staying covert, trying to avoid detection,

35
00:03:11,660 --> 00:03:15,680
and so on. You know, and some of these terms are kind of interchangeable, too, depending on

36
00:03:15,680 --> 00:03:20,200
what pen testing group you work for or whatever. I mean, we're pen testers, so like some of the

37
00:03:20,200 --> 00:03:25,740
service offerings we offer, we use verbiage like covert, overt, hybrid. It's easy to understand

38
00:03:25,740 --> 00:03:29,580
for clients when they're thinking, you know, how do we want these guys to approach their assessment?

39
00:03:29,580 --> 00:03:33,860
Do they want to do a walk-through and hold our hand and tell us the issues that they have, or do

40
00:03:33,860 --> 00:03:38,020
they want us to actually take the role of, you know, criminal?

41
00:03:38,440 --> 00:03:43,360
And that also depends on the maturity of the company's security program, too.

42
00:03:43,580 --> 00:03:44,600
And the client relationship.

43
00:03:44,980 --> 00:03:45,140
Yep.

44
00:03:47,280 --> 00:03:51,900
So the covert assessments, we've got a couple different pictures in here from actual assessments.

45
00:03:52,160 --> 00:03:57,640
Oftentimes we will wear body cams or just have a camera with us. That way we can, the client

46
00:03:57,640 --> 00:03:59,560
requests, hey, can you guys film this person?

47
00:03:59,580 --> 00:04:02,680
Can you do this interaction or this bypass or something like that?

48
00:04:03,100 --> 00:04:05,780
Because they don't get to see it. They just kind of take your word of mouth.

49
00:04:05,960 --> 00:04:10,460
As soon as they get the report, oh, it says you bypassed this or that, how did you do this?

50
00:04:11,060 --> 00:04:14,340
Well, it says in the report, well, but how did you actually do it?

51
00:04:14,380 --> 00:04:15,720
We want to see how you did it.

52
00:04:15,820 --> 00:04:19,840
So oftentimes we'll wear body cams. Sometimes we'll just take still photos.

53
00:04:20,320 --> 00:04:21,960
This top right one is pretty funny.

54
00:04:23,220 --> 00:04:24,480
It's a human resource office.

55
00:04:25,160 --> 00:04:26,740
And they had like a dimple lock.

56
00:04:27,180 --> 00:04:28,960
We were able to pick it, get into it.

57
00:04:29,580 --> 00:04:30,860
And there was all these cubicles around.

58
00:04:31,180 --> 00:04:37,040
And the cubicle walls are so high that nobody could see their closet that had all the employee records in it.

59
00:04:37,160 --> 00:04:37,520
Or me.

60
00:04:37,680 --> 00:04:38,420
Or Brent.

61
00:04:38,680 --> 00:04:38,860
Yeah.

62
00:04:39,320 --> 00:04:41,140
I had to cut it a little shorter.

63
00:04:41,380 --> 00:04:44,200
But nobody could see us pick this lock.

64
00:04:44,420 --> 00:04:47,080
And so we're right beside a cubicle, literally probably here.

65
00:04:47,380 --> 00:04:54,240
At the end of the hallway, too, you look down the hallway, at the end of it was a meeting room with glass doors.

66
00:04:54,340 --> 00:04:55,780
And they were in a meeting.

67
00:04:55,900 --> 00:04:57,880
And, you know, people were kind of looking around.

68
00:04:57,880 --> 00:05:00,480
But it was funny because we got into the HR room.

69
00:05:00,600 --> 00:05:02,400
All these employees' records and files.

70
00:05:02,680 --> 00:05:04,000
Got the point of contact record.

71
00:05:04,380 --> 00:05:06,680
And we ended up putting it on his desk later on that day.

72
00:05:06,760 --> 00:05:08,220
It was kind of trolling him.

73
00:05:08,520 --> 00:05:09,960
But, yeah.

74
00:05:10,360 --> 00:05:18,040
So for these covert assessments I was talking before, social engineering and physical or, you know, they're kind of driving factors for a lot of this.

75
00:05:18,320 --> 00:05:23,480
One of the number one, as most people in here know, compromises is through social engineering.

76
00:05:23,960 --> 00:05:26,400
Whether it's onsite, phishing, vishing, something like that.

77
00:05:26,400 --> 00:05:30,580
So what we do onsite is we really implement the social engineering.

78
00:05:30,660 --> 00:05:32,640
We push to test their instant response.

79
00:05:32,820 --> 00:05:37,280
We push to test the security awareness and the overall security culture in the company.

80
00:05:37,780 --> 00:05:45,100
So in this we'll really push the limits and the boundaries of what we do from anything to trying to sneak in, okay, well, we got from A to B.

81
00:05:45,140 --> 00:05:46,000
We already did this.

82
00:05:46,120 --> 00:05:55,380
Now let's go troll the security guards or let's go, you know, talk to some people and ask them for information or to let us into sensitive areas or let us touch different things.

83
00:05:55,480 --> 00:05:55,620
So.

84
00:05:56,800 --> 00:05:57,660
Electronic things.

85
00:05:57,800 --> 00:05:58,720
Electronic things.

86
00:05:59,120 --> 00:05:59,380
Yeah.

87
00:05:59,420 --> 00:06:03,560
So we actually have a talk that we do called security guards, LOL.

88
00:06:04,040 --> 00:06:05,400
And it's, yeah.

89
00:06:06,300 --> 00:06:08,940
And so we're not knocking security guards.

90
00:06:09,020 --> 00:06:22,080
The whole reason we do that talk and you'll see we'll actually mention a few of those things is because there are so many companies that will have these large facilities and their entire physical security program minus a few biometric, you know, sensors or something like that.

91
00:06:23,720 --> 00:06:26,120
They put it all on like one or two.

92
00:06:26,120 --> 00:06:27,740
They put it all on like one or two minimum wage security guards.

93
00:06:27,940 --> 00:06:44,240
And so once we walk in and we establish a rapport with them, we have several times, especially an awesome story from Tim where one of the security guards actually handed over their entire set of keys to him in exchange for his keys, which was a ring of bump keys.

94
00:06:44,740 --> 00:06:46,760
You know, yeah, I'll come back and get these later.

95
00:06:46,940 --> 00:06:50,160
So you'll hear some of the stories with that, too.

96
00:06:51,180 --> 00:06:53,640
So physical security bypassing methods.

97
00:06:53,640 --> 00:06:59,100
One of the things that we always focus on when we do this is we like to use tools that are available to the public.

98
00:06:59,320 --> 00:07:03,700
So like the under the door tool, which is available, I think, from Rift Recon and a few other places.

99
00:07:03,980 --> 00:07:05,060
Pretty easy to make, too.

100
00:07:05,120 --> 00:07:06,520
Like $40 or $50.

101
00:07:06,840 --> 00:07:10,000
And then the shove knife, which is, I think, $15 or $20.

102
00:07:10,680 --> 00:07:14,360
Bump keys, they're $10 to $20, depending on which set you get.

103
00:07:14,600 --> 00:07:16,080
Canned air is like $1.

104
00:07:16,280 --> 00:07:16,360
Yeah.

105
00:07:16,520 --> 00:07:19,340
The shrum tool is $2.50.

106
00:07:19,940 --> 00:07:23,580
A piece of plastic that is made to go between strikes.

107
00:07:23,580 --> 00:07:26,280
Strike plates and things to bypass locks, $10.

108
00:07:26,500 --> 00:07:28,640
Or no, it's $5 for a 10-pack.

109
00:07:28,680 --> 00:07:29,780
Or you use your hotel room key.

110
00:07:30,040 --> 00:07:30,440
Yeah.

111
00:07:30,600 --> 00:07:31,680
Or a credit card.

112
00:07:31,940 --> 00:07:36,020
So the point is we always make sure that we use things that are so easy to get.

113
00:07:36,180 --> 00:07:39,520
And we can show you, okay, we had no access.

114
00:07:39,700 --> 00:07:43,260
Now we're in your data center using, you know, $50 worth of tools.

115
00:07:43,600 --> 00:07:50,160
So, yeah, that picture is me reaching really high.

116
00:07:51,720 --> 00:07:52,180
Keyboard.

117
00:07:52,180 --> 00:07:57,060
That was the whole keyboard, whole system for the security access.

118
00:07:57,480 --> 00:07:59,700
It showed all the security cameras and everything.

119
00:08:00,020 --> 00:08:03,680
So, yeah, it was fun getting a shell on that and doing whatever I wanted to.

120
00:08:03,720 --> 00:08:05,280
Turning the cameras off if I wanted to.

121
00:08:05,540 --> 00:08:08,080
And having our way about the building.

122
00:08:10,260 --> 00:08:12,120
So what can you do and cannot do?

123
00:08:12,740 --> 00:08:17,460
You know, oftentimes during the kickoff call, when you're discussing your rules of engagement,

124
00:08:17,640 --> 00:08:19,680
how you're going to do things, what you're going to do,

125
00:08:19,680 --> 00:08:25,180
I don't like to go in specific details because, you know, that way if I decide to do something,

126
00:08:25,380 --> 00:08:26,980
I don't have to go.

127
00:08:27,120 --> 00:08:28,900
You know, it's better to ask for forgiveness kind of thing, right?

128
00:08:29,860 --> 00:08:33,280
But it is important when you're talking about, like, after hours, for example.

129
00:08:34,300 --> 00:08:36,300
Do you want us to do after hours assessments?

130
00:08:36,620 --> 00:08:37,720
Do you have cleaning crew?

131
00:08:37,920 --> 00:08:39,540
Do they prop open the doors at night?

132
00:08:40,440 --> 00:08:41,560
How do they handle that?

133
00:08:41,700 --> 00:08:43,680
Do you guys have after hours workers coming in?

134
00:08:43,780 --> 00:08:45,300
Do you have execs coming in and out?

135
00:08:45,820 --> 00:08:49,660
These are things that are important to ask because oftentimes people just focus on doing that.

136
00:08:49,680 --> 00:08:50,720
They're doing it during business hours.

137
00:08:51,940 --> 00:08:55,460
The windows we like to do most of these assessments on are during lunchtime,

138
00:08:55,680 --> 00:08:59,060
during close of business when a lot of people are coming in and out of the building.

139
00:08:59,240 --> 00:08:59,920
A lot of foot traffic.

140
00:09:00,260 --> 00:09:00,340
Yeah.

141
00:09:00,460 --> 00:09:03,600
And then after hours, depending on if they have armed security guards,

142
00:09:04,360 --> 00:09:08,720
we like to try to avoid after hours for that because some people are trigger-happy security guards.

143
00:09:08,800 --> 00:09:08,900
Yeah.

144
00:09:08,900 --> 00:09:14,000
Breaking into a building at night with armed security guards is not a good idea.

145
00:09:14,160 --> 00:09:14,500
Right.

146
00:09:15,540 --> 00:09:18,720
And then a friend of mine, during a report review,

147
00:09:18,720 --> 00:09:25,960
at TrustedSec was talking about how one of the assessments they did that the security guard said,

148
00:09:26,120 --> 00:09:30,480
yes, if we would have seen you in that facility, we would have fired at you.

149
00:09:30,640 --> 00:09:38,940
So from that point on, they no longer do the physicals at night after hours when there are armed security guards.

150
00:09:39,060 --> 00:09:40,800
So something to keep in mind for sure.

151
00:09:41,740 --> 00:09:42,940
You know, we were talking before.

152
00:09:43,100 --> 00:09:46,100
You know, we're primarily discussing physical and social aspects.

153
00:09:46,240 --> 00:09:47,680
But, you know, it's hacking in scope.

154
00:09:47,680 --> 00:09:48,860
I get into the building.

155
00:09:49,080 --> 00:09:50,060
I get into the server room.

156
00:09:50,180 --> 00:09:51,180
Can I plug into the core switch?

157
00:09:51,480 --> 00:09:52,420
What's off limits?

158
00:09:52,500 --> 00:09:53,300
What's not off limits?

159
00:09:53,540 --> 00:09:59,160
I think having no scope is best for these types of assessments because it's more reality-based.

160
00:09:59,280 --> 00:10:00,560
It's more scenario-based or whatever.

161
00:10:00,880 --> 00:10:07,500
It's okay to be like, all right, well, we just want you to focus on getting from here to, I don't know, the CTO's office.

162
00:10:08,540 --> 00:10:10,100
We want you to try to get on his system.

163
00:10:10,240 --> 00:10:11,780
Well, of course, that's a limited scope there.

164
00:10:12,240 --> 00:10:16,560
But if it's pretty open, you want to try to sway the client to buy into that.

165
00:10:16,720 --> 00:10:17,660
No scope at all.

166
00:10:17,680 --> 00:10:18,620
Let us go in.

167
00:10:18,800 --> 00:10:19,520
Let us do our thing.

168
00:10:20,020 --> 00:10:27,420
If we didn't know anything, this is like not a full disclosure or partial disclosure assessment type, but it's kind of going in blindly.

169
00:10:27,820 --> 00:10:29,380
You know, are these the things we can do?

170
00:10:29,780 --> 00:10:30,860
Can we pick locks?

171
00:10:31,140 --> 00:10:40,020
Some clients don't like us touching their locks or trying to bypass things because they're afraid, you know, well, it might damage it or it might do this or that, especially electronic locks.

172
00:10:40,180 --> 00:10:44,020
Sometimes they don't like us touching any of the electronics on those locks or security systems.

173
00:10:44,400 --> 00:10:44,480
Yeah.

174
00:10:44,980 --> 00:10:47,660
Or if you see a laptop or an external device.

175
00:10:47,660 --> 00:10:47,680
Yeah.

176
00:10:47,680 --> 00:10:51,620
Or an external hard drive or USB, you know, can we grab that and take it out with us, things like that.

177
00:10:53,280 --> 00:10:57,620
So I know that penetration testing is a large part of a lot of these assessments.

178
00:10:57,740 --> 00:11:03,880
And so because this is Social Engineering Village, we're going to focus mostly on the physical part of things.

179
00:11:04,540 --> 00:11:11,460
But something to keep in mind when you do get inside and you are able to plug in and gain access to the network, you know, you want to try to stay covert.

180
00:11:11,620 --> 00:11:17,640
You want to do things like half open TCP scans where you're not having that full connection to potentially alert an IP address.

181
00:11:19,120 --> 00:11:26,600
You know, if you do gain access to a system, you know, what PowerShell scripts or things are you running?

182
00:11:26,700 --> 00:11:28,500
Are you trying to add a user?

183
00:11:28,600 --> 00:11:34,120
Are you trying to brute force an admin level user or something that could potentially set off alarms?

184
00:11:34,620 --> 00:11:43,220
So, you know, those are things you want to keep in mind if you do get access that you're not, you know, freaking out the admins at, you know, whatever time of day you got into their system.

185
00:11:43,500 --> 00:11:46,980
So those are things, those evasion techniques are things to keep in mind.

186
00:11:46,980 --> 00:11:51,440
You know, and a part of this too, it's kind of, this is a real quick story, but did a Red Team assessment.

187
00:11:52,300 --> 00:11:54,380
We had gained access to the facility.

188
00:11:55,320 --> 00:11:58,500
We plugged in a rogue access point, put it near the window.

189
00:11:58,740 --> 00:12:02,600
We were sitting in the parking lot in a van in a hotel right across the street.

190
00:12:03,300 --> 00:12:04,060
By the river?

191
00:12:04,220 --> 00:12:04,680
By the river.

192
00:12:06,440 --> 00:12:10,120
We had this high gain, you know, DBI antenna pointing up there.

193
00:12:10,160 --> 00:12:11,040
We were able to connect to it.

194
00:12:11,420 --> 00:12:15,220
From there, we were able to, you know, compromise some SQL databases, dump some tables.

195
00:12:15,320 --> 00:12:16,160
We did a bunch of stuff.

196
00:12:16,640 --> 00:12:17,880
Completely owned these people.

197
00:12:18,400 --> 00:12:25,640
And then when we gave them the report, they were so upset with the report that we did not report from a Nessus finding that they found a telnet was open.

198
00:12:25,940 --> 00:12:28,120
And they're like, you didn't add this to a report.

199
00:12:28,520 --> 00:12:29,860
Well, this is a Red Team assessment.

200
00:12:30,120 --> 00:12:31,700
We're not going to look at every little...

201
00:12:32,180 --> 00:12:32,580
Priorities.

202
00:12:32,760 --> 00:12:33,160
Priority.

203
00:12:33,180 --> 00:12:36,100
Plus it was an internal, you know, telnet's open internally.

204
00:12:36,460 --> 00:12:39,580
I mean, that's kind of a deal, I guess.

205
00:12:39,720 --> 00:12:45,340
But to, you know, to express that to a client and to say, listen, this is a...

206
00:12:45,340 --> 00:12:46,880
We're the bad guys here.

207
00:12:46,960 --> 00:12:48,100
We're not doing a bone scan.

208
00:12:48,340 --> 00:12:51,080
We're not doing, you know, reporting on every little thing.

209
00:12:51,240 --> 00:12:52,660
We're going from A to B.

210
00:12:53,000 --> 00:12:57,540
If you want a more overview or a bigger, broader overview, then, you know, you need to be specific about that.

211
00:12:57,600 --> 00:12:57,700
Yeah.

212
00:12:57,740 --> 00:13:00,320
We try to make it more like a real world scenario.

213
00:13:00,920 --> 00:13:01,280
So...

214
00:13:03,520 --> 00:13:05,620
Is incident response a part of the assessment?

215
00:13:06,920 --> 00:13:10,340
You know, oftentimes what we do is we'll try to be obvious.

216
00:13:11,660 --> 00:13:13,120
We'll wear bright colors.

217
00:13:14,420 --> 00:13:16,180
We'll go to the security guard.

218
00:13:16,420 --> 00:13:18,740
You know, Brent mentioned this story.

219
00:13:19,120 --> 00:13:19,820
So I...

220
00:13:19,820 --> 00:13:21,340
We had already been around the facility.

221
00:13:21,700 --> 00:13:22,840
Did a whole bunch of stuff.

222
00:13:22,960 --> 00:13:26,900
We found a security control room that had access to printing off badges.

223
00:13:27,160 --> 00:13:28,640
It had access to a lot of different things.

224
00:13:28,760 --> 00:13:30,640
They had keys in there to their company vehicles.

225
00:13:30,980 --> 00:13:31,900
They had keys...

226
00:13:31,900 --> 00:13:33,600
Hard keys to the entire facility.

227
00:13:33,720 --> 00:13:35,680
An aluminum box that had a wafer core on it.

228
00:13:36,420 --> 00:13:41,240
They also had badges from employees that were just recently terminated.

229
00:13:41,520 --> 00:13:42,240
And they were still active.

230
00:13:42,240 --> 00:13:42,360
Yeah.

231
00:13:42,440 --> 00:13:46,800
The cards were still active, but they had them securely hidden under a keyboard.

232
00:13:47,160 --> 00:13:47,440
So...

233
00:13:47,440 --> 00:13:48,300
Super safe.

234
00:13:49,440 --> 00:13:52,940
So we get to this security control room, and we couldn't get in it.

235
00:13:52,980 --> 00:13:53,820
We couldn't pick the lock.

236
00:13:54,600 --> 00:13:56,660
And it was heavily congested.

237
00:13:56,700 --> 00:13:58,160
A lot of people walking by.

238
00:13:58,860 --> 00:13:59,880
So I'm like, you know what?

239
00:13:59,960 --> 00:14:01,980
I'm just going to go up to the security guard, and I'm going to ask you for keys.

240
00:14:02,540 --> 00:14:03,420
Brent's like, okay.

241
00:14:03,820 --> 00:14:05,740
So we go over there, and we'd already...

242
00:14:05,740 --> 00:14:06,000
He's like, we're done.

243
00:14:06,080 --> 00:14:06,940
We're screwed.

244
00:14:07,120 --> 00:14:07,560
Thanks, Tim.

245
00:14:07,660 --> 00:14:07,740
Yeah.

246
00:14:07,760 --> 00:14:11,180
And we had already done quite a bit of compromise, right?

247
00:14:11,180 --> 00:14:12,600
We'd already gathered what we needed.

248
00:14:12,840 --> 00:14:15,940
But at this point, the client was really concerned about their security guards.

249
00:14:16,260 --> 00:14:18,200
You know, they were concerned about, are they doing their job?

250
00:14:18,260 --> 00:14:18,880
Their due diligence?

251
00:14:19,000 --> 00:14:19,740
Are they following through?

252
00:14:20,480 --> 00:14:21,580
Can you guys test this?

253
00:14:21,740 --> 00:14:22,800
So I walk up.

254
00:14:22,900 --> 00:14:24,480
I have those keys in my hand.

255
00:14:24,620 --> 00:14:28,160
I was like, hey, yeah, I'm doing inventory, and I need to do an inventory of hard keys

256
00:14:28,600 --> 00:14:30,700
in some of the servers in the security control room.

257
00:14:31,260 --> 00:14:32,600
But my key's not working.

258
00:14:32,760 --> 00:14:35,120
The key John gave me apparently doesn't work.

259
00:14:35,200 --> 00:14:35,680
I called him.

260
00:14:35,720 --> 00:14:36,660
He said, I could just use your keys.

261
00:14:36,780 --> 00:14:37,120
Is that cool?

262
00:14:37,180 --> 00:14:37,700
I'll bring them right back.

263
00:14:38,060 --> 00:14:39,580
In fact, I will leave my keys here.

264
00:14:39,580 --> 00:14:40,900
That way you know I will bring them back.

265
00:14:41,060 --> 00:14:41,660
The bump keys.

266
00:14:41,900 --> 00:14:42,060
Right.

267
00:14:42,080 --> 00:14:47,800
And so she's like, oh, well, just as long as you bring them back before 5, because I

268
00:14:47,800 --> 00:14:48,660
have to lock up the building.

269
00:14:49,080 --> 00:14:49,400
Absolutely.

270
00:14:49,860 --> 00:14:50,340
All right.

271
00:14:50,800 --> 00:14:51,120
Cool.

272
00:14:51,340 --> 00:14:52,280
Not a minute later.

273
00:14:52,380 --> 00:14:52,900
Thank you.

274
00:14:53,080 --> 00:14:53,260
Yeah.

275
00:14:53,300 --> 00:14:54,120
So we had these keys.

276
00:14:54,240 --> 00:14:55,160
We ended up going down there.

277
00:14:55,220 --> 00:14:57,420
We ended up getting into a lot more stuff.

278
00:14:58,060 --> 00:15:02,400
But that was, you know, we really pushed the envelope there, and she gave us, the security

279
00:15:02,400 --> 00:15:03,540
guard gave us her keys.

280
00:15:03,960 --> 00:15:06,300
And it was to multiple facilities, not just this one.

281
00:15:06,340 --> 00:15:09,240
So if we wanted to leave and go to another facility after hours or whatever.

282
00:15:09,580 --> 00:15:11,060
In one of their company vehicles, even.

283
00:15:11,120 --> 00:15:11,760
In one of their, yeah.

284
00:15:12,680 --> 00:15:13,820
With one of their badges.

285
00:15:13,920 --> 00:15:14,120
Yeah.

286
00:15:15,740 --> 00:15:17,780
So this picture is kind of funny.

287
00:15:18,220 --> 00:15:19,160
The one with the.

288
00:15:19,360 --> 00:15:19,840
This one?

289
00:15:20,180 --> 00:15:20,500
Yeah.

290
00:15:20,540 --> 00:15:21,240
The obfuscated.

291
00:15:21,240 --> 00:15:21,720
And this one?

292
00:15:23,040 --> 00:15:23,440
There.

293
00:15:23,900 --> 00:15:26,520
So we walk over to this lady, and she prints badges.

294
00:15:26,720 --> 00:15:32,420
And she also, I think she does like scheduling or paychecks or something like that.

295
00:15:32,640 --> 00:15:36,520
But this was near a cash kind of area where they handle a lot of money.

296
00:15:36,960 --> 00:15:38,500
We ended up walking over to her.

297
00:15:38,560 --> 00:15:39,560
I told her, hey, you know, I have a lot of money.

298
00:15:39,560 --> 00:15:44,300
Hey, I'm doing some inventory, and I'm also doing some network tests, just scanning for,

299
00:15:44,420 --> 00:15:46,600
I think I said something like network connectivity.

300
00:15:46,980 --> 00:15:50,280
A lot of times what we use is, hey, we're just doing some network connectivity.

301
00:15:50,420 --> 00:15:51,520
I'll be right, real quick.

302
00:15:51,800 --> 00:15:52,180
We heard your, yeah.

303
00:15:52,180 --> 00:15:54,540
And then just kind of show up under their desk and say, I'll be just a minute.

304
00:15:54,640 --> 00:15:56,800
Just, you know, and they don't, they just move out of the way.

305
00:15:56,960 --> 00:15:57,200
Yep.

306
00:15:57,340 --> 00:15:58,680
So that's exactly what she did.

307
00:15:58,760 --> 00:15:59,660
She rolled out of the way.

308
00:16:00,040 --> 00:16:02,380
And Brynn's sitting there talking to her, asking her about her day.

309
00:16:02,440 --> 00:16:04,240
She had some pictures of her kids on her desk.

310
00:16:04,280 --> 00:16:08,480
Yeah, I felt awful because I started talking to her about her grandkid being in soccer.

311
00:16:08,560 --> 00:16:09,300
And I was like, oh yeah.

312
00:16:09,560 --> 00:16:10,580
Yeah, that's a great sport.

313
00:16:10,840 --> 00:16:13,340
And, you know, how many goals has she scored?

314
00:16:13,380 --> 00:16:14,020
Like all this stuff.

315
00:16:14,180 --> 00:16:19,740
The whole time Tim's stealing credentials and stuff and just awful, awful.

316
00:16:19,840 --> 00:16:21,660
See, it's funny because you can see me doing it.

317
00:16:21,860 --> 00:16:24,740
And then I have, I think I plugged in a key logger.

318
00:16:24,760 --> 00:16:27,040
And I was like, well, this is just going to test the network connectivity.

319
00:16:27,700 --> 00:16:28,280
It's USB.

320
00:16:28,920 --> 00:16:29,880
And I plug it in.

321
00:16:30,040 --> 00:16:32,260
And I was like, actually, before I do this, could you lock your system?

322
00:16:32,360 --> 00:16:33,220
So she locks her system.

323
00:16:33,440 --> 00:16:34,240
I plug it in.

324
00:16:34,300 --> 00:16:35,820
I was like, actually, can you log back in now?

325
00:16:35,940 --> 00:16:36,800
So she logs back in.

326
00:16:36,920 --> 00:16:37,940
Get her domain credentials.

327
00:16:38,040 --> 00:16:38,360
Done.

328
00:16:38,360 --> 00:16:40,720
And now I'm on there and I'm doing my thing.

329
00:16:40,960 --> 00:16:45,260
And then I have this clipboard, which we have another story we're probably going to get into.

330
00:16:45,420 --> 00:16:47,020
But I want to go ahead and talk about this because it's funny.

331
00:16:47,760 --> 00:16:49,460
Look at those shoes right there.

332
00:16:49,560 --> 00:16:49,680
Man.

333
00:16:49,740 --> 00:16:50,340
Nice shoes.

334
00:16:50,500 --> 00:16:51,280
Whose shoes are those?

335
00:16:51,860 --> 00:16:55,400
So I have this clipboard that I've got a Raspberry Pi in it.

336
00:16:55,560 --> 00:16:58,020
I've got a wireless stick on it so you can SSH into it.

337
00:16:58,100 --> 00:17:02,240
So what Brent can do from his phone is SSH into this and see whatever I'm scanning of the badges.

338
00:17:02,480 --> 00:17:05,780
So I've got all these sensors on here to scan badges.

339
00:17:06,160 --> 00:17:08,340
So what I was doing with this is I had this.

340
00:17:08,340 --> 00:17:10,120
I had this inventory sheet.

341
00:17:10,700 --> 00:17:11,700
It gets worse.

342
00:17:11,860 --> 00:17:12,800
I promise you.

343
00:17:13,080 --> 00:17:13,560
What's your name?

344
00:17:13,560 --> 00:17:14,200
It gets much worse.

345
00:17:14,480 --> 00:17:15,320
Can I see your badge?

346
00:17:15,380 --> 00:17:17,980
And she gives me her badge and I put it on there and I'm writing her name down.

347
00:17:18,240 --> 00:17:20,000
No, you don't just put it on there.

348
00:17:21,060 --> 00:17:27,360
So when you read this thing, it doesn't, you can't, you know, you can't just like set it on there like this.

349
00:17:27,440 --> 00:17:30,120
You have to do this.

350
00:17:31,500 --> 00:17:32,980
So that is not a joke.

351
00:17:33,300 --> 00:17:34,920
It's like, yeah, can I see your badge?

352
00:17:35,140 --> 00:17:36,520
I just need to write down a few things.

353
00:17:36,520 --> 00:17:37,520
Like that's pretty creepy.

354
00:17:39,260 --> 00:17:40,420
She didn't ask any questions.

355
00:17:40,500 --> 00:17:41,120
She's like, okay.

356
00:17:41,960 --> 00:17:44,040
Yeah, so go youth soccer, right?

357
00:17:46,860 --> 00:17:49,380
So where, I'm totally just, yeah.

358
00:17:49,480 --> 00:17:56,500
Yeah, well, this next one where Brent is on the right there, this was another assessment we did where we walked straight through the mail room.

359
00:17:56,760 --> 00:18:00,160
We had tailgated behind some people, walked straight through there.

360
00:18:00,300 --> 00:18:05,900
And they had all this, all these cabinets containing like, I think it was like some PCI data.

361
00:18:05,900 --> 00:18:07,600
PHI, something like that.

362
00:18:08,100 --> 00:18:09,720
I think it was actually a healthcare company.

363
00:18:10,140 --> 00:18:16,380
But we actually walked through and Brent just opens the door and we're just kind of walking.

364
00:18:16,380 --> 00:18:16,700
No lock.

365
00:18:16,880 --> 00:18:18,780
We're trying to purposely get caught at this point.

366
00:18:18,900 --> 00:18:20,280
Didn't have a lock or anything like that.

367
00:18:20,420 --> 00:18:23,380
And this was the room where they stored, they had all their backups.

368
00:18:23,860 --> 00:18:27,720
So they had tons of hard printed off backups, boxes and things like that.

369
00:18:27,800 --> 00:18:28,700
We're picking up boxes.

370
00:18:28,840 --> 00:18:31,900
We're being really absurd trying to be like, really?

371
00:18:32,000 --> 00:18:35,400
What do we have to do for you guys to ask what are we doing?

372
00:18:36,180 --> 00:18:37,220
Excuse me, ma'am.

373
00:18:37,240 --> 00:18:38,120
I'm not supposed to be here.

374
00:18:38,180 --> 00:18:38,920
Could you question me?

375
00:18:41,180 --> 00:18:42,700
What state was it in?

376
00:18:42,800 --> 00:18:43,880
We're not at liberty to say that.

377
00:18:44,300 --> 00:18:44,700
Yeah.

378
00:18:44,860 --> 00:18:45,260
Sorry.

379
00:18:45,520 --> 00:18:45,640
Yeah.

380
00:18:46,000 --> 00:18:51,380
But we will tell you that we were not allowed to use audio or video recordings in any way because it's against state law.

381
00:18:51,720 --> 00:18:53,580
And they had armed security guards.

382
00:18:53,680 --> 00:18:56,360
So that's why we focused on the sweet lady and the cubicles.

383
00:18:56,660 --> 00:18:57,580
So funny story.

384
00:18:57,700 --> 00:18:59,560
So this is during the covert part.

385
00:18:59,740 --> 00:19:02,120
And later on we actually did the overt assessment.

386
00:19:02,320 --> 00:19:04,680
And as we were going through the HR ladies.

387
00:19:04,680 --> 00:19:08,200
Even though we were being escorted by the point of contact.

388
00:19:08,380 --> 00:19:10,600
The HR lady was like, I'm sorry.

389
00:19:10,680 --> 00:19:11,700
You guys can't go in there.

390
00:19:11,800 --> 00:19:12,580
And we're like, okay.

391
00:19:13,800 --> 00:19:14,580
Even though we had.

392
00:19:14,920 --> 00:19:15,960
We had already been in there.

393
00:19:16,220 --> 00:19:16,980
All right.

394
00:19:18,040 --> 00:19:19,140
I've already seen that room.

395
00:19:19,200 --> 00:19:19,540
Yeah.

396
00:19:19,540 --> 00:19:19,920
We're good.

397
00:19:21,580 --> 00:19:24,280
So usually wait until the end to try and get caught.

398
00:19:24,460 --> 00:19:25,920
You know, try to do our sneaky stuff first.

399
00:19:26,180 --> 00:19:32,180
So there was one time where there was another coworker.

400
00:19:32,280 --> 00:19:34,100
And so we actually got into this building.

401
00:19:34,100 --> 00:19:35,920
And they're like, oh, yeah, there's security guards.

402
00:19:36,040 --> 00:19:37,100
And he monitors remotely.

403
00:19:37,360 --> 00:19:38,060
And we're like, cool.

404
00:19:38,300 --> 00:19:44,680
So we walk around for an hour looking at the camera the whole time trying to get, you know, give them the benefit of the doubt.

405
00:19:44,760 --> 00:19:49,800
Because, again, we don't do these assessments to come and say, look how bad you guys, you know, look how bad you are.

406
00:19:49,960 --> 00:19:53,560
We like to give them an opportunity to catch us for a teaching moment.

407
00:19:53,560 --> 00:19:56,380
Especially after we've identified some really critical vulnerabilities.

408
00:19:56,720 --> 00:19:57,160
Yeah.

409
00:19:57,340 --> 00:19:58,940
They suck.

410
00:19:59,300 --> 00:19:59,640
Yeah.

411
00:19:59,700 --> 00:20:00,020
It's awful.

412
00:20:00,020 --> 00:20:01,980
And at that point it's like, okay.

413
00:20:02,140 --> 00:20:03,940
We really need to see it.

414
00:20:03,940 --> 00:20:05,020
What point is that?

415
00:20:05,120 --> 00:20:08,500
And that's why we do the whole push kind of thing to really push the bounds.

416
00:20:08,660 --> 00:20:08,920
Yeah.

417
00:20:09,000 --> 00:20:13,320
Try to make people uncomfortable where hopefully they'll say, like, what are you doing?

418
00:20:13,520 --> 00:20:14,560
You know, get out of my face.

419
00:20:14,820 --> 00:20:17,020
So we were at this place.

420
00:20:17,140 --> 00:20:18,440
And, you know, we had gone around.

421
00:20:18,540 --> 00:20:20,140
We found all this stuff.

422
00:20:20,540 --> 00:20:27,360
And they had these double glass doors at the front that had enough physical gap where you could actually, you know, put tools through it.

423
00:20:27,480 --> 00:20:28,820
So I had a coat hanger.

424
00:20:29,080 --> 00:20:31,540
Took my time looking at the camera behind me.

425
00:20:31,580 --> 00:20:32,460
The glass door is right here.

426
00:20:32,600 --> 00:20:33,920
So I'm looking at the camera.

427
00:20:34,580 --> 00:20:35,760
Straightening this thing out.

428
00:20:36,360 --> 00:20:37,600
This is not a joke.

429
00:20:37,700 --> 00:20:40,340
This is a walk over to the receptionist table.

430
00:20:40,460 --> 00:20:42,200
Get a handful of napkins.

431
00:20:42,300 --> 00:20:43,260
Starbucks napkins.

432
00:20:43,280 --> 00:20:43,420
Yeah.

433
00:20:43,540 --> 00:20:50,360
And I tied them into a big, you know, like flower, like a poorly arts and crafts flower thing around.

434
00:20:50,520 --> 00:20:54,700
So I put it through the door because they had a request to exit sensor on the other side.

435
00:20:54,760 --> 00:20:57,300
So my whole goal was to see if I could trip that.

436
00:20:57,520 --> 00:20:59,320
And so I'm looking at the thing.

437
00:20:59,340 --> 00:21:03,900
And so I'm literally, like, going like this all the way up and down trying to get it to work.

438
00:21:03,900 --> 00:21:05,800
And then I get to the trip and no one came.

439
00:21:06,240 --> 00:21:10,140
So I look at the co-worker and I was like, okay, we've been here an hour.

440
00:21:10,200 --> 00:21:12,120
Like, you know, what's going on?

441
00:21:12,300 --> 00:21:14,280
He's like, okay, what are we going to do next?

442
00:21:14,440 --> 00:21:16,140
And I was like, jumping jacks?

443
00:21:16,140 --> 00:21:17,180
And he was like, okay, that's cool.

444
00:21:17,480 --> 00:21:22,400
So we turn around and we look at the camera and we do jumping jacks for at least 20 seconds and the guy never came.

445
00:21:22,880 --> 00:21:24,460
So, yeah.

446
00:21:24,880 --> 00:21:25,220
Fail.

447
00:21:25,440 --> 00:21:25,900
Very secure.

448
00:21:26,700 --> 00:21:27,160
All right.

449
00:21:27,180 --> 00:21:27,740
Let's move along.

450
00:21:28,340 --> 00:21:29,020
All right.

451
00:21:29,060 --> 00:21:30,280
So the overt assessments.

452
00:21:32,320 --> 00:21:36,060
Yeah, I'll let you look at these pictures because they're funny at first and kind of use your imaginations.

453
00:21:36,420 --> 00:21:40,580
So before you get into it, so you see that?

454
00:21:40,760 --> 00:21:42,240
Can you see that right there?

455
00:21:42,500 --> 00:21:43,240
There's a hole there.

456
00:21:43,540 --> 00:21:45,260
Can you over here on this side?

457
00:21:46,740 --> 00:21:48,460
It's a gigantic hole.

458
00:21:48,820 --> 00:21:50,380
It's for a forklift, by the way.

459
00:21:50,460 --> 00:21:53,700
So a forklift can pick up their confidential data bin and move it around.

460
00:21:53,920 --> 00:21:59,180
So the bin is this tall and I think it was about three and a half feet wide.

461
00:21:59,560 --> 00:21:59,960
Yeah.

462
00:22:00,280 --> 00:22:01,540
And they had a best lock on it.

463
00:22:01,620 --> 00:22:04,200
One of those really nice best locks on it.

464
00:22:04,780 --> 00:22:06,380
Holding it, holding the flat.

465
00:22:06,580 --> 00:22:06,800
Yeah.

466
00:22:06,880 --> 00:22:07,860
And so, yeah.

467
00:22:08,000 --> 00:22:15,020
And so you could put your stuff in there but you could also, we actually, we call it shredder bin bingo is what we ended up calling it.

468
00:22:15,120 --> 00:22:19,140
So you stick your arm in there and you pull out however many papers you want.

469
00:22:19,220 --> 00:22:20,800
A passport photo.

470
00:22:20,820 --> 00:22:20,960
Yeah.

471
00:22:20,960 --> 00:22:25,580
We found some passports, some background check forms, a bunch of other stuff.

472
00:22:25,760 --> 00:22:27,040
I mean, it was ridiculous.

473
00:22:27,120 --> 00:22:28,120
A loan for a house.

474
00:22:28,320 --> 00:22:28,680
Yeah.

475
00:22:28,800 --> 00:22:30,060
A home loan application.

476
00:22:30,060 --> 00:22:30,260
Yeah.

477
00:22:30,260 --> 00:22:32,840
And so we're like, are you serious right now?

478
00:22:32,960 --> 00:22:35,080
And yeah, so you could do that on both sides.

479
00:22:35,580 --> 00:22:36,140
Oh, yeah.

480
00:22:36,260 --> 00:22:43,680
And this is also Tim on top of a vending machine going through the ceiling during the covert part in a major hallway and no one stops.

481
00:22:44,040 --> 00:22:44,720
Well, there's, okay.

482
00:22:44,820 --> 00:22:45,540
So the funny thing.

483
00:22:45,560 --> 00:22:46,620
Seriously, no one stopped.

484
00:22:46,860 --> 00:22:47,660
They're like, where's God?

485
00:22:47,700 --> 00:22:48,620
On top of the vending machine.

486
00:22:48,660 --> 00:22:48,900
Yeah, on top of here.

487
00:22:49,000 --> 00:22:52,100
But the funny thing is, is that the other side of that wall is their data center.

488
00:22:52,240 --> 00:22:52,580
Yeah.

489
00:22:52,640 --> 00:22:54,680
And they didn't have floor to ceiling walls.

490
00:22:55,040 --> 00:22:56,340
They didn't have an IDS on top.

491
00:22:56,520 --> 00:22:58,860
They didn't have any kind of screen or fence or anything.

492
00:22:59,060 --> 00:22:59,320
Yeah.

493
00:22:59,360 --> 00:23:00,240
So, and, but they, you know, they didn't have any kind of screen or fence or anything.

494
00:23:00,240 --> 00:23:02,660
They conveniently had an Aquafina machine.

495
00:23:03,180 --> 00:23:03,580
Yeah.

496
00:23:04,440 --> 00:23:05,980
That let me get up and over.

497
00:23:06,120 --> 00:23:06,300
Yeah.

498
00:23:06,300 --> 00:23:06,380
So.

499
00:23:07,600 --> 00:23:08,340
Thanks, water.

500
00:23:09,680 --> 00:23:10,080
Okay.

501
00:23:10,200 --> 00:23:13,040
So, yeah, this is just a quick demo.

502
00:23:13,160 --> 00:23:21,600
You know, and this is part, we start getting into, we're going to start talking about the overt part where you walk through and the methodologies and stuff that we developed.

503
00:23:21,860 --> 00:23:24,020
But before we, yeah, before we talk, show the video though.

504
00:23:24,700 --> 00:23:26,720
So again, this goes back to what I was saying before.

505
00:23:26,800 --> 00:23:28,360
Sometimes we'll have body cams.

506
00:23:28,360 --> 00:23:30,220
But if it's an overt, sometimes we'll, LV.

507
00:23:30,240 --> 00:23:30,440
Yeah.

508
00:23:30,440 --> 00:23:35,020
We'll escort the client or the point of contact through the facility as we're doing these things and pointing them out.

509
00:23:35,180 --> 00:23:35,440
Yeah.

510
00:23:35,440 --> 00:23:37,840
Or we'll do a covert prior to doing that.

511
00:23:38,120 --> 00:23:43,200
And then after we give them, you know, kind of an overview of what we found, they'll say, okay, well, can you kind of show me?

512
00:23:43,440 --> 00:23:44,780
So we'll walk around and show them.

513
00:23:44,920 --> 00:23:54,580
Well, for the sake of time, because oftentimes we only do these assessments, we only have like a week, maybe two weeks max, we'll just show them a video and that's kind of all.

514
00:23:54,600 --> 00:23:54,700
Yeah.

515
00:23:54,980 --> 00:23:58,500
So in this situation, this highly secure facility.

516
00:23:59,280 --> 00:24:00,180
But in their back.

517
00:24:00,240 --> 00:24:01,080
I forgot the air quotes.

518
00:24:01,180 --> 00:24:02,240
Highly secure facility.

519
00:24:02,760 --> 00:24:03,240
There you go.

520
00:24:03,640 --> 00:24:05,000
They had two points of entry.

521
00:24:05,220 --> 00:24:09,540
The front door, the lobby where a rotating door is, some security guards.

522
00:24:09,700 --> 00:24:16,620
And then the back door where nothing is except for a big gap and a badge reader.

523
00:24:16,860 --> 00:24:18,800
And a camera that didn't even really cover the door.

524
00:24:18,860 --> 00:24:21,160
And a camera that was, it was actually fogged over.

525
00:24:21,240 --> 00:24:27,680
So it was one of those PTZ cameras, but it had the dome was like weather warned and it was fogged.

526
00:24:27,680 --> 00:24:28,220
It was bad.

527
00:24:28,220 --> 00:24:30,680
So I'm like, there's no way they're seeing me do this right now.

528
00:24:30,680 --> 00:24:31,180
High definition.

529
00:24:32,840 --> 00:24:33,460
So, yeah.

530
00:24:33,820 --> 00:24:34,540
Click that.

531
00:24:37,560 --> 00:24:37,960
So.

532
00:24:41,840 --> 00:24:43,780
No, we're good.

533
00:24:43,980 --> 00:24:45,040
The audio is not a big deal.

534
00:24:45,360 --> 00:24:45,920
So, yeah.

535
00:24:46,080 --> 00:24:47,160
It's just Brent talking.

536
00:24:47,280 --> 00:24:47,940
Nobody wants to hear that.

537
00:24:47,940 --> 00:24:48,140
Yeah.

538
00:24:48,200 --> 00:24:49,320
That sounds stupid.

539
00:24:49,780 --> 00:24:51,500
So you can see it's locked.

540
00:24:51,640 --> 00:24:53,900
Tim's outside in his cool taxi hat.

541
00:24:55,900 --> 00:24:57,300
And just a shove knife.

542
00:24:57,380 --> 00:24:58,200
And the 15 bucks.

543
00:24:58,200 --> 00:24:58,640
15 bucks for that?

544
00:24:58,760 --> 00:24:59,720
Like seconds.

545
00:24:59,960 --> 00:25:00,540
He's, yeah.

546
00:25:00,700 --> 00:25:04,100
Well, they didn't have like, so their plate, too, was deviated on the outside.

547
00:25:04,480 --> 00:25:09,460
So you could get the shove knife over it and just kind of wiggle it around and open the door.

548
00:25:09,560 --> 00:25:11,080
And it was very quick and very easy.

549
00:25:11,300 --> 00:25:16,100
That's the same facility that, so the previous year we had done a similar assessment.

550
00:25:16,220 --> 00:25:19,140
And they're like, oh, yeah, this year, you know, we installed dimple locks.

551
00:25:19,460 --> 00:25:20,960
And, you know, good luck.

552
00:25:21,080 --> 00:25:21,580
And I'm like, okay.

553
00:25:21,760 --> 00:25:25,480
So we get to the server room where the new dimple locks were.

554
00:25:25,480 --> 00:25:29,520
And the strike plate wasn't.

555
00:25:29,520 --> 00:25:30,580
Oh, it was on the office's side.

556
00:25:30,940 --> 00:25:31,180
Yeah.

557
00:25:32,360 --> 00:25:36,780
So, but the lock was a bit tough because they had it kind of backwards.

558
00:25:37,000 --> 00:25:38,100
It was kind of hard to explain.

559
00:25:38,320 --> 00:25:42,080
So when I used my shove knife and I almost had it.

560
00:25:42,120 --> 00:25:43,280
So Tim's like, all right, hold on.

561
00:25:43,440 --> 00:25:45,960
And he brings his shove knife over the top.

562
00:25:46,180 --> 00:25:51,540
And within a few seconds of both of us like pushing our shove knives in there, we were right in the data center.

563
00:25:51,780 --> 00:25:54,740
And so that picture, I think it's a couple slides.

564
00:25:55,020 --> 00:25:55,460
Yeah.

565
00:25:55,480 --> 00:25:56,060
Back.

566
00:25:56,080 --> 00:25:56,700
Let me see.

567
00:25:58,180 --> 00:25:59,020
Where is it at?

568
00:26:00,160 --> 00:26:04,280
So that was on the other side of their, you know, new dimple lock door.

569
00:26:04,600 --> 00:26:05,840
So that was, you know.

570
00:26:05,900 --> 00:26:10,540
That's where they had their security stuff, inside the data center.

571
00:26:11,820 --> 00:26:12,460
All right.

572
00:26:12,540 --> 00:26:13,080
Let's see.

573
00:26:13,640 --> 00:26:14,240
Go ahead.

574
00:26:14,440 --> 00:26:19,560
So oftentimes if we're not able to clone badge or anything like that, we'll just make fake badges.

575
00:26:19,760 --> 00:26:21,140
And we talk about this a lot in our talks.

576
00:26:22,140 --> 00:26:23,800
We'll just, these are kind of the dimensions.

577
00:26:23,800 --> 00:26:25,920
But we'll just go to our hotel.

578
00:26:26,160 --> 00:26:27,040
We have a little printer.

579
00:26:27,640 --> 00:26:32,000
We'll get some blank HID badges or whatever, PVC, if we see that they've got that.

580
00:26:32,060 --> 00:26:32,660
We'll print them on PVC.

581
00:26:33,180 --> 00:26:37,340
But we ended up, you know, just Photoshopping our badges and making some generic badges.

582
00:26:38,240 --> 00:26:45,140
You know, we gather this information during the pretexting and kind of our passive reconnaissance when we're driving around.

583
00:26:45,380 --> 00:26:47,100
Oftentimes we'll go the day before.

584
00:26:47,660 --> 00:26:52,480
And as people are leaving, we'll drive by the facility or go around the parking lot because cars are coming and going.

585
00:26:52,480 --> 00:26:54,280
And we're not sticking out at that point.

586
00:26:54,440 --> 00:26:56,320
And then we'll get a good look at their badges.

587
00:26:56,540 --> 00:26:57,560
Go back to the hotel.

588
00:26:57,700 --> 00:26:58,460
Play arts and crafts.

589
00:26:58,840 --> 00:27:02,220
And then, you know, make some fake badges that we just piggyback and tailgate in.

590
00:27:02,360 --> 00:27:03,480
Because that's the easiest thing.

591
00:27:03,560 --> 00:27:10,580
You don't even have to have, you don't have to have like a Proxmark 3 or some badge cloning or repeater or anything like that.

592
00:27:10,780 --> 00:27:12,240
It doesn't have to be fancy at all.

593
00:27:12,440 --> 00:27:14,020
You just walk in behind people as they're coming up.

594
00:27:14,200 --> 00:27:14,300
Yeah.

595
00:27:14,320 --> 00:27:22,040
And one thing that we love are company barbecues because, you know, social media like, oh, let's show how cool our company is.

596
00:27:22,040 --> 00:27:24,400
Put pictures of the barbecue online.

597
00:27:24,760 --> 00:27:25,600
And they do.

598
00:27:25,820 --> 00:27:27,340
And people are wearing their badges.

599
00:27:27,600 --> 00:27:28,680
And so we Zoom in.

600
00:27:29,100 --> 00:27:31,460
And we usually try to schedule our assessments around that time.

601
00:27:31,580 --> 00:27:33,660
That way we can have some barbecue before we get into the facility.

602
00:27:33,880 --> 00:27:33,980
Yeah.

603
00:27:34,040 --> 00:27:37,920
Seriously, two times we've gone to companies and they've had the barbecue.

604
00:27:38,080 --> 00:27:42,040
So we've gone into the barbecue, fed ourselves, and tailgated in right in.

605
00:27:42,960 --> 00:27:45,080
So that is not a joke.

606
00:27:45,440 --> 00:27:48,180
Oh, we should have put that picture.

607
00:27:48,360 --> 00:27:48,740
Oh.

608
00:27:48,800 --> 00:27:51,760
Because it was like they had this big thing, you know, synergy.

609
00:27:51,800 --> 00:27:52,020
Yeah.

610
00:27:52,040 --> 00:27:53,760
So we had our barbecue.

611
00:27:54,860 --> 00:27:55,820
We tailgated in.

612
00:27:55,940 --> 00:27:57,220
And they're like, do you guys want a group photo?

613
00:27:57,460 --> 00:27:57,940
And we're like, sure.

614
00:27:58,120 --> 00:27:58,760
So Tim and I.

615
00:27:58,760 --> 00:27:59,640
I thought we were employees.

616
00:27:59,760 --> 00:28:00,580
So we're standing there.

617
00:28:00,880 --> 00:28:03,060
And it's an actual, like, employee.

618
00:28:03,240 --> 00:28:04,520
And I guess he kind of got caught in.

619
00:28:04,540 --> 00:28:05,460
He didn't want to be rude.

620
00:28:05,620 --> 00:28:06,040
You know?

621
00:28:06,220 --> 00:28:08,400
So it's Tim and I and then an actual employee.

622
00:28:08,620 --> 00:28:09,260
And we're like this.

623
00:28:09,480 --> 00:28:09,660
You know?

624
00:28:09,760 --> 00:28:10,840
It's like synergy.

625
00:28:11,280 --> 00:28:12,740
And I was like, whoa, dude.

626
00:28:13,140 --> 00:28:13,500
Yeah.

627
00:28:13,560 --> 00:28:14,440
It's like, excuse us.

628
00:28:14,460 --> 00:28:14,680
Yeah.

629
00:28:14,940 --> 00:28:15,300
Yeah.

630
00:28:16,960 --> 00:28:22,020
So it was so funny because, you know, and it worked out perfect because we didn't know that.

631
00:28:22,020 --> 00:28:23,460
The barbecue was going on at that time.

632
00:28:23,540 --> 00:28:26,000
It was just like, you know, a free gift for us.

633
00:28:26,200 --> 00:28:26,340
So.

634
00:28:26,800 --> 00:28:27,380
Free food.

635
00:28:27,580 --> 00:28:28,980
So, you know, we had free food.

636
00:28:29,060 --> 00:28:30,220
We got, you know, free entrance.

637
00:28:30,380 --> 00:28:33,160
And we got a photo, which they printed out on the spot.

638
00:28:33,260 --> 00:28:36,080
So it's our cool little keepsake that we have now.

639
00:28:36,260 --> 00:28:36,480
So.

640
00:28:36,680 --> 00:28:38,560
We included that photo in the report, by the way.

641
00:28:38,640 --> 00:28:38,860
Yeah.

642
00:28:38,940 --> 00:28:39,340
Yeah.

643
00:28:39,520 --> 00:28:42,240
And that was the reaction right there.

644
00:28:43,320 --> 00:28:44,240
It was great.

645
00:28:44,560 --> 00:28:45,280
It was perfect.

646
00:28:47,800 --> 00:28:48,600
Any friends?

647
00:28:49,060 --> 00:28:49,460
Friends?

648
00:28:50,060 --> 00:28:50,460
Fans?

649
00:28:50,740 --> 00:28:51,420
Show friends?

650
00:28:52,020 --> 00:28:52,460
Show friends.

651
00:28:52,800 --> 00:28:52,840
Yeah.

652
00:28:52,900 --> 00:28:53,500
Some of you guys.

653
00:28:53,600 --> 00:28:54,700
You guys are all friends.

654
00:28:55,080 --> 00:28:55,240
Yeah.

655
00:28:55,360 --> 00:28:55,500
Yeah.

656
00:28:55,680 --> 00:28:56,680
I'm Ken Adams.

657
00:28:56,820 --> 00:28:57,240
So, yeah.

658
00:28:57,420 --> 00:29:00,640
And then I know Tim uses Mr. Robot.

659
00:29:00,780 --> 00:29:00,940
What's it?

660
00:29:01,040 --> 00:29:01,820
Elliot Alderson.

661
00:29:01,880 --> 00:29:02,100
Yeah.

662
00:29:02,100 --> 00:29:06,580
Oftentimes I'll put Elliot Alderson on the badge or like Bruce Willis or something.

663
00:29:06,880 --> 00:29:07,280
Stupid.

664
00:29:07,360 --> 00:29:07,620
Stupid.

665
00:29:07,760 --> 00:29:09,180
Like if I'm trying to get caught.

666
00:29:09,320 --> 00:29:13,080
I mean, I'm not going to do this if it's covert or I'm really not trying to get caught.

667
00:29:13,260 --> 00:29:14,140
I'll use a legitimate.

668
00:29:14,160 --> 00:29:14,320
Yeah.

669
00:29:14,320 --> 00:29:17,940
Co-worker Drew Culbertson, he always uses a picture of Alec Baldwin.

670
00:29:17,980 --> 00:29:19,260
He kind of looks like Alec Baldwin.

671
00:29:19,400 --> 00:29:19,500
Yeah.

672
00:29:19,520 --> 00:29:22,000
So we're like, we're going to use Alec Baldwin's face on here.

673
00:29:23,340 --> 00:29:23,700
Okay.

674
00:29:24,640 --> 00:29:26,000
We'll talk about overt assessments.

675
00:29:26,300 --> 00:29:29,960
As we already mentioned, this is where, you know, you're being escorted by the client.

676
00:29:30,060 --> 00:29:31,040
So you have a lot more freedom.

677
00:29:31,220 --> 00:29:35,500
So something like an under-the-door tool that's usually, you know, very loud.

678
00:29:35,780 --> 00:29:37,680
Has anybody used an under-the-door tool in here?

679
00:29:38,060 --> 00:29:39,200
They're loud, aren't they?

680
00:29:39,360 --> 00:29:41,200
So you're not sneaky with those.

681
00:29:41,520 --> 00:29:45,400
So if you try to go into a room and you don't know what's on the other door, I mean, or

682
00:29:45,400 --> 00:29:51,260
on the other side of the door, just imagine like, what the hell is going on?

683
00:29:51,380 --> 00:29:51,980
You know, it's like you're in a room and you don't know what's on the other door.

684
00:29:52,000 --> 00:29:54,700
You hear this loud scraping and it's like, yeah, I'm maintenance.

685
00:29:54,820 --> 00:29:55,760
I'm fixing your doors.

686
00:29:55,860 --> 00:29:56,160
You know.

687
00:29:56,320 --> 00:30:01,900
But anyway, you have a lot more liberty to try that or bump keys or something, which

688
00:30:01,900 --> 00:30:05,280
we kind of, we don't really recommend bump keys because those are destructive.

689
00:30:05,520 --> 00:30:05,660
Yeah, we don't really use those anymore.

690
00:30:07,400 --> 00:30:11,460
But, you know, the thing that we do with the overt assessment is we have a checklist that

691
00:30:11,460 --> 00:30:11,780
we make.

692
00:30:12,200 --> 00:30:15,120
Basically, it's just best practices for things.

693
00:30:15,300 --> 00:30:18,320
We don't, we're not doing like, you know, compliance junk.

694
00:30:18,620 --> 00:30:20,800
We're just saying, here's what we normally attack.

695
00:30:21,320 --> 00:30:21,760
Timeout.

696
00:30:22,000 --> 00:30:22,980
Compliance is not junk.

697
00:30:23,300 --> 00:30:24,360
Compliance is not junk.

698
00:30:24,380 --> 00:30:24,660
I'm sorry.

699
00:30:24,700 --> 00:30:27,240
Sorry, go ahead.

700
00:30:28,200 --> 00:30:29,520
That's why I do my pen test.

701
00:30:29,920 --> 00:30:30,400
What's that?

702
00:30:30,700 --> 00:30:32,000
You mean the bare minimum, right?

703
00:30:32,000 --> 00:30:32,280
Yeah.

704
00:30:32,300 --> 00:30:32,580
Yeah.

705
00:30:32,640 --> 00:30:32,880
Yeah.

706
00:30:33,560 --> 00:30:35,740
Limited number of flare for these guys.

707
00:30:36,920 --> 00:30:38,500
So, we'll use this checklist.

708
00:30:38,740 --> 00:30:39,580
I mean, just kind of go through.

709
00:30:39,780 --> 00:30:41,160
But we also demonstrate tools.

710
00:30:41,420 --> 00:30:43,000
I was kind of saying before in that video.

711
00:30:43,340 --> 00:30:48,420
In this picture on the left with me and my awesome man bun, we're using the under the

712
00:30:48,420 --> 00:30:51,300
door tool, showing the client, hey, here's how we got into here.

713
00:30:51,580 --> 00:30:51,980
And we're going to show you how we got into here.

714
00:30:51,980 --> 00:30:54,220
Because they didn't know what it was and it just blew their mind.

715
00:30:54,860 --> 00:30:58,720
The picture on the right is funny because the request for exit sensor is there.

716
00:30:58,900 --> 00:30:59,680
We found a

717
00:30:59,680 --> 00:31:01,400
Can you see the steam?

718
00:31:01,800 --> 00:31:02,100
Yeah.

719
00:31:02,140 --> 00:31:02,940
I don't know if you can see that.

720
00:31:03,560 --> 00:31:04,160
The steam.

721
00:31:04,180 --> 00:31:07,200
Right here on the side that's shooting through the door.

722
00:31:07,440 --> 00:31:07,820
Sorry.

723
00:31:07,880 --> 00:31:08,080
Go ahead.

724
00:31:08,540 --> 00:31:09,160
Quit interrupting.

725
00:31:09,480 --> 00:31:10,340
I'm a jerk.

726
00:31:10,520 --> 00:31:10,840
Yeah.

727
00:31:11,660 --> 00:31:16,400
Now, we found some canned air and we ended up using that to bypass the request for exit

728
00:31:16,400 --> 00:31:16,680
sensor.

729
00:31:16,840 --> 00:31:17,880
So, we had a gap there.

730
00:31:18,500 --> 00:31:20,480
Turned the canned air upside down and just sprayed in there.

731
00:31:20,680 --> 00:31:21,960
It was enough to try.

732
00:31:21,980 --> 00:31:24,620
So, that's us doing that.

733
00:31:24,720 --> 00:31:26,360
On the bottom is us opening the door.

734
00:31:27,280 --> 00:31:33,180
This was actually the same exact spot that as soon as we got into this area behind this

735
00:31:33,180 --> 00:31:34,560
door over here.

736
00:31:35,640 --> 00:31:37,080
And this is overt, by the way.

737
00:31:37,180 --> 00:31:38,820
This is after we had already done the covert stuff.

738
00:31:39,140 --> 00:31:44,980
Well, when we had broken into this before, a guy, during the covert stuff, a guy comes

739
00:31:44,980 --> 00:31:47,600
up to Tim and he looks at him and he's like, let me see your badge.

740
00:31:47,760 --> 00:31:48,360
And Tim's like, okay.

741
00:31:48,620 --> 00:31:50,980
And he goes, you're not an employee.

742
00:31:51,200 --> 00:31:51,960
You don't work here.

743
00:31:51,980 --> 00:31:53,200
And Tim's like, yeah, I do.

744
00:31:53,340 --> 00:31:54,720
And he's like, no, you don't.

745
00:31:54,740 --> 00:31:55,540
Let me see your badge.

746
00:31:55,700 --> 00:31:58,280
And it was just a paper badge on top of an actual badge.

747
00:31:58,280 --> 00:31:59,400
We did it really quick.

748
00:31:59,520 --> 00:32:02,180
So, we just had to print it off like very quickly and arrive there.

749
00:32:02,220 --> 00:32:03,380
So, we just shoved it on a sleeve.

750
00:32:03,500 --> 00:32:06,180
I didn't even have like an HID or hardback or anything like that.

751
00:32:06,320 --> 00:32:06,920
So, just kind of.

752
00:32:06,940 --> 00:32:08,620
Yeah, just a piece of paper slipped in.

753
00:32:08,820 --> 00:32:12,420
So, the funny thing was this guy was so sure he was catching us.

754
00:32:12,440 --> 00:32:14,160
I think he knew we were going to be there or something.

755
00:32:14,480 --> 00:32:16,300
But he was like, that's not a real badge.

756
00:32:16,340 --> 00:32:16,940
Let me see it.

757
00:32:17,020 --> 00:32:18,500
So, Tim's like, all right, here you go.

758
00:32:19,440 --> 00:32:21,280
Rips up the badge in front of Tim.

759
00:32:21,280 --> 00:32:22,740
Hands it back to him.

760
00:32:22,800 --> 00:32:23,800
And then walks off.

761
00:32:25,520 --> 00:32:26,160
No joke.

762
00:32:26,480 --> 00:32:26,920
That's it?

763
00:32:26,980 --> 00:32:29,000
So, that went in the report.

764
00:32:29,280 --> 00:32:30,300
You know, thanks, jerk guy.

765
00:32:30,540 --> 00:32:31,000
There you go.

766
00:32:31,040 --> 00:32:31,900
Got your name on the report.

767
00:32:32,320 --> 00:32:35,020
So, not that we try to single out people or anything.

768
00:32:35,320 --> 00:32:37,160
But, you know, come on.

769
00:32:37,180 --> 00:32:38,680
You come to find out this guy was an exec, too.

770
00:32:38,860 --> 00:32:40,280
So, he didn't know who we were.

771
00:32:40,280 --> 00:32:40,840
He was like, you don't belong here.

772
00:32:40,840 --> 00:32:41,960
He wasn't in the kickoff calls.

773
00:32:42,100 --> 00:32:44,280
He wasn't in any of the preliminary planning or anything like that.

774
00:32:44,340 --> 00:32:46,920
He was just the guy that was like, you've got a man bun.

775
00:32:47,060 --> 00:32:47,700
You don't belong here.

776
00:32:47,800 --> 00:32:47,980
Yeah.

777
00:32:48,360 --> 00:32:51,000
But it was so odd because I was like, okay.

778
00:32:51,000 --> 00:32:51,520
We're done.

779
00:32:53,320 --> 00:32:54,200
Thanks, Tim.

780
00:32:54,460 --> 00:32:55,760
He didn't do anything bad.

781
00:32:56,120 --> 00:32:57,280
But, you know, it's like, all right.

782
00:32:57,320 --> 00:32:57,680
We're done.

783
00:32:57,940 --> 00:33:00,560
And then he rips it up and hands it back and walks off.

784
00:33:00,700 --> 00:33:02,340
And Tim and I are just like, seriously?

785
00:33:03,260 --> 00:33:04,440
Is he coming back?

786
00:33:04,980 --> 00:33:05,620
Can we?

787
00:33:05,800 --> 00:33:06,240
Okay.

788
00:33:06,380 --> 00:33:07,040
Let's keep going.

789
00:33:07,300 --> 00:33:07,860
So, we did.

790
00:33:08,040 --> 00:33:09,300
For like two more hours.

791
00:33:09,500 --> 00:33:10,080
So, yeah.

792
00:33:10,180 --> 00:33:10,740
Thank you.

793
00:33:11,260 --> 00:33:15,080
Oh, those requests for exit sensors, you know, you guys have probably seen the videos

794
00:33:15,080 --> 00:33:18,140
like Debian Olimp using Whiskey to open it.

795
00:33:18,220 --> 00:33:19,280
Right there.

796
00:33:19,500 --> 00:33:19,660
Yeah.

797
00:33:19,660 --> 00:33:20,780
Dave Kennedy.

798
00:33:20,960 --> 00:33:20,980
Yeah.

799
00:33:21,000 --> 00:33:21,020
So, yeah.

800
00:33:21,020 --> 00:33:21,460
We are going to be using the device.

801
00:33:21,460 --> 00:33:21,640
We're going to be using a vape.

802
00:33:22,000 --> 00:33:25,880
You know, some of them are kind of the neat heat.

803
00:33:26,020 --> 00:33:29,140
So, you're going to get more creative with that like hand warmers and stuff like that.

804
00:33:29,380 --> 00:33:29,500
Yeah.

805
00:33:32,800 --> 00:33:33,840
Hybrid security assessments.

806
00:33:34,180 --> 00:33:35,500
We're not going to go too much into this.

807
00:33:35,620 --> 00:33:39,800
But basically what these are is a combination of both covert and overt.

808
00:33:40,240 --> 00:33:43,640
If there's a large facility or there's multiple facilities, sometimes they'll say, hey, on

809
00:33:43,640 --> 00:33:46,000
this facility we want you to covertly try to enter.

810
00:33:46,160 --> 00:33:50,040
And on this next one we want you to walk through and kind of repeat what you did but with the

811
00:33:50,040 --> 00:33:50,400
client.

812
00:33:51,000 --> 00:33:51,560
We're not escorting you.

813
00:33:52,140 --> 00:33:52,160
Yeah.

814
00:33:52,300 --> 00:33:55,640
You know, you don't repeat the social engineering in this, but this is mostly like the physical

815
00:33:55,640 --> 00:33:57,240
stuff and how we got into the facility.

816
00:33:57,940 --> 00:34:02,400
And then oftentimes it will be social engineering if we go back and revisit the facility that

817
00:34:02,400 --> 00:34:03,040
we just compromised.

818
00:34:03,480 --> 00:34:05,020
So, they'll be like, let's go through.

819
00:34:05,240 --> 00:34:08,780
And then we'll walk past people we just lied to and convince them to do stuff.

820
00:34:08,980 --> 00:34:11,420
It's an opportunity to discuss things with them.

821
00:34:11,600 --> 00:34:16,740
It's an opportunity to kind of blow up their security awareness to be like, hey, yeah,

822
00:34:16,840 --> 00:34:18,300
so these guys are here doing an assessment.

823
00:34:19,600 --> 00:34:21,200
I think you met them.

824
00:34:22,040 --> 00:34:22,760
And yeah.

825
00:34:22,880 --> 00:34:25,160
And then we say, yeah, we're the guys that lied to you and stuff like that.

826
00:34:25,280 --> 00:34:27,300
But here's what you did a good job on.

827
00:34:27,620 --> 00:34:28,880
Here's what you can improve on.

828
00:34:29,060 --> 00:34:31,220
And it's a security awareness training in addition to.

829
00:34:31,440 --> 00:34:34,900
So, that's kind of what the hybrid assessment model is for us.

830
00:34:35,120 --> 00:34:35,440
Yeah.

831
00:34:35,520 --> 00:34:40,860
And then, you know, if we also obtain creds from doing a web app assessment or an external,

832
00:34:41,980 --> 00:34:46,540
then whoever's in charge of that will say, you know, hey, here's a set of usernames,

833
00:34:46,540 --> 00:34:46,940
passwords.

834
00:34:46,940 --> 00:34:52,400
That way if you get inside, you can try to log in, you know, to the domain or whatever.

835
00:34:52,500 --> 00:34:53,480
That's like partial disclosure.

836
00:34:53,800 --> 00:34:55,460
It's not like you're not going in blindly.

837
00:34:55,660 --> 00:34:56,980
It's not a black box kind of assessment.

838
00:34:59,980 --> 00:35:01,600
When is it appropriate to keep pushing?

839
00:35:01,740 --> 00:35:03,420
So, we're talking about being bold versus safe.

840
00:35:03,660 --> 00:35:07,180
It's appropriate when you get to that point where you're like, okay, I've exhausted all my efforts.

841
00:35:07,420 --> 00:35:08,160
I've done what I can.

842
00:35:08,360 --> 00:35:09,440
I have all of my stuff.

843
00:35:10,660 --> 00:35:11,220
Now what?

844
00:35:11,320 --> 00:35:11,660
I'm bored.

845
00:35:12,980 --> 00:35:14,600
This is one of my favorite stories, Bo.

846
00:35:14,860 --> 00:35:16,380
So, we're walking around.

847
00:35:16,960 --> 00:35:18,180
You'll see a security guard there.

848
00:35:18,240 --> 00:35:23,260
I wish I could, like, unhide her face because she's cracking up because I'm such a funny man.

849
00:35:24,440 --> 00:35:27,280
So, this is her and those are her hands.

850
00:35:27,460 --> 00:35:30,180
And in a minute you'll see why that is just so bad.

851
00:35:30,380 --> 00:35:34,820
So, I walk over to her and I was like, yeah, he had a fake contractor badge on.

852
00:35:34,980 --> 00:35:36,800
Or, no, I had a fake contractor badge on.

853
00:35:36,860 --> 00:35:38,520
He had a fake employee badge on.

854
00:35:38,720 --> 00:35:38,920
Yep.

855
00:35:39,080 --> 00:35:44,100
Because when you don't look like you belong there, like, I was growing my hair out for, like, a role.

856
00:35:44,440 --> 00:35:46,360
And I didn't look like I belonged there.

857
00:35:46,380 --> 00:35:49,140
It wasn't ‑‑ it didn't adhere to kind of their dress code.

858
00:35:49,300 --> 00:35:49,820
I had a beard.

859
00:35:50,040 --> 00:35:51,060
But I'm a contractor.

860
00:35:51,340 --> 00:35:55,640
So, it's a little bit easier to do that as a consultant or a contractor.

861
00:35:55,860 --> 00:36:00,540
So, Brent had, like, a suit on or, like, a button up and some nice outfit on.

862
00:36:00,720 --> 00:36:01,680
So, he was ‑‑

863
00:36:01,680 --> 00:36:02,440
Thank you, Tim.

864
00:36:02,580 --> 00:36:03,360
He looked good.

865
00:36:04,340 --> 00:36:12,440
He was escorting me around as a contractor because I was there doing their policies on how they handle badges and keys.

866
00:36:16,620 --> 00:36:16,980
Yeah.

867
00:36:17,100 --> 00:36:18,060
It gets awful.

868
00:36:18,300 --> 00:36:18,540
Yeah.

869
00:36:18,620 --> 00:36:18,980
Wait for it.

870
00:36:18,980 --> 00:36:25,080
I walk over to her and I was like, hey, yeah, we're doing a ‑‑ I think it was off the top of my head.

871
00:36:25,200 --> 00:36:28,740
So, I was like, yeah, we're doing, like, an S853 enterprise security assessment.

872
00:36:28,940 --> 00:36:31,080
And we're just kind of looking to look at some of your policies.

873
00:36:31,460 --> 00:36:34,820
Specifically, I wanted to ask you more about your employee replacement badges.

874
00:36:35,180 --> 00:36:35,420
Yeah.

875
00:36:35,440 --> 00:36:36,120
And I jumped in.

876
00:36:36,200 --> 00:36:37,020
You know, it's fine.

877
00:36:37,580 --> 00:36:38,460
Security guard name.

878
00:36:38,680 --> 00:36:39,260
Insert here.

879
00:36:40,000 --> 00:36:41,020
Elliot is with me.

880
00:36:41,080 --> 00:36:41,620
And it's fine.

881
00:36:41,840 --> 00:36:42,080
He can ‑‑

882
00:36:42,080 --> 00:36:42,840
He signed an NDA.

883
00:36:43,020 --> 00:36:43,260
Yeah.

884
00:36:43,260 --> 00:36:45,320
And she's like, oh, okay.

885
00:36:46,220 --> 00:36:47,200
Yeah, it's only going to take a minute.

886
00:36:47,320 --> 00:36:47,660
Okay.

887
00:36:47,820 --> 00:36:48,180
Sure.

888
00:36:48,600 --> 00:36:51,160
So, how do you handle when employees forget their badges at home?

889
00:36:51,520 --> 00:36:53,480
Well, in fact, we have a binder here.

890
00:36:54,240 --> 00:36:56,200
And all of these badges are active.

891
00:36:56,340 --> 00:36:57,500
And they can get around the facility.

892
00:36:58,480 --> 00:36:59,800
And let me show you.

893
00:36:59,920 --> 00:37:01,580
So, she drew a huge binder.

894
00:37:01,660 --> 00:37:03,800
Probably had, like, 50 badges in it.

895
00:37:03,940 --> 00:37:07,880
All these active ‑‑ I think they were called, like, replacement badges or whatever.

896
00:37:07,940 --> 00:37:08,040
Yeah.

897
00:37:08,060 --> 00:37:08,720
One day badges.

898
00:37:09,680 --> 00:37:11,140
That she gives to the employees.

899
00:37:11,300 --> 00:37:12,220
And they sign their name.

900
00:37:12,460 --> 00:37:13,240
They put the badges in.

901
00:37:13,260 --> 00:37:13,920
They put the badge number on it.

902
00:37:13,960 --> 00:37:14,840
And that's how they track it.

903
00:37:14,940 --> 00:37:16,920
And they have to return it at the end of the day.

904
00:37:17,700 --> 00:37:18,760
So, I'm like, oh, okay.

905
00:37:18,860 --> 00:37:21,840
Well, I'm just going to go through here and kind of do inventory and get the numbers off

906
00:37:21,840 --> 00:37:22,420
the back of them.

907
00:37:22,620 --> 00:37:24,200
And she's like, oh, okay.

908
00:37:24,620 --> 00:37:28,580
And Brent's like, hey, Elliot, that's probably going to take you a while.

909
00:37:28,760 --> 00:37:28,920
Yeah.

910
00:37:28,980 --> 00:37:29,900
It's taking you a while.

911
00:37:29,960 --> 00:37:30,960
Do you mind if he sits down?

912
00:37:31,180 --> 00:37:32,280
Oh, no, that's fine.

913
00:37:32,380 --> 00:37:32,860
Come on.

914
00:37:32,980 --> 00:37:35,680
So, she lets me come around the security guard desk and sit down beside her.

915
00:37:36,220 --> 00:37:41,680
So, we have a picture that we couldn't show because it would, like, you know, reasons.

916
00:37:41,680 --> 00:37:48,220
So, basically, Tim, you can see him on the left behind the security desk opening the binder.

917
00:37:48,400 --> 00:37:51,980
You see her, like, oh, let me show you where the contractor badges start.

918
00:37:52,480 --> 00:37:59,640
And then we also have a picture of him, like, leaning back with his feet propped up on the counter while he's sitting there.

919
00:37:59,760 --> 00:38:00,680
That's when I started being absurd.

920
00:38:00,900 --> 00:38:01,700
I don't do that.

921
00:38:01,900 --> 00:38:05,600
So, as our clients, I don't just go drop my feet on the security guard desk.

922
00:38:05,840 --> 00:38:08,440
Reminder of this the whole time.

923
00:38:09,280 --> 00:38:10,100
Set it down.

924
00:38:10,160 --> 00:38:11,080
Pick up another one.

925
00:38:11,680 --> 00:38:14,120
The whole time he's, like, you know, creeper look.

926
00:38:14,360 --> 00:38:15,520
I'm just talking to her.

927
00:38:15,640 --> 00:38:15,860
She's happy.

928
00:38:15,860 --> 00:38:18,760
When you're going to say something, you know, awful.

929
00:38:21,460 --> 00:38:22,720
So, this is good.

930
00:38:22,820 --> 00:38:23,580
This isn't good.

931
00:38:23,760 --> 00:38:25,140
So, this was good, right?

932
00:38:25,460 --> 00:38:29,420
What isn't good is when the security guard comes over to you and is, like, what are you doing?

933
00:38:30,300 --> 00:38:31,380
I'm supposed to be here.

934
00:38:31,960 --> 00:38:33,220
Or I'm doing whatever.

935
00:38:34,560 --> 00:38:41,580
Testing the physical security latches or I'm looking at your sprinkler heads to make sure that there's a recall on them.

936
00:38:41,580 --> 00:38:41,660
Yeah.

937
00:38:43,940 --> 00:38:44,500
So, no.

938
00:38:44,620 --> 00:38:45,380
What are you doing here?

939
00:38:45,480 --> 00:38:46,700
And the security guards get angry.

940
00:38:46,900 --> 00:38:47,120
Yeah.

941
00:38:47,540 --> 00:38:48,940
And they want to punch me in the throat.

942
00:38:50,040 --> 00:38:52,000
So, at that point, I'm going to change my tactics, right?

943
00:38:52,100 --> 00:38:54,100
I'm not going to sit there and just keep using the same line.

944
00:38:54,780 --> 00:38:55,940
And we're going to get into this.

945
00:38:56,000 --> 00:38:57,520
And I may be jumping ahead, but I don't care.

946
00:38:58,260 --> 00:39:00,220
We use a fake letter of authorization quite a bit.

947
00:39:00,280 --> 00:39:02,280
If you've heard our other talks, we discuss this.

948
00:39:02,840 --> 00:39:11,660
So, basically, what this is, is we have because when I first started using this, I thought, well, if I were a bad guy and I wanted to get into a facility in the middle of the day, I'm going to do this.

949
00:39:12,940 --> 00:39:13,960
What would I do?

950
00:39:14,340 --> 00:39:15,700
Well, I'm here for a security assessment.

951
00:39:17,080 --> 00:39:18,260
I'm with whatever.

952
00:39:19,040 --> 00:39:22,680
So, what we do is wrote up a fake letter of authorization.

953
00:39:23,020 --> 00:39:24,460
On the top, it's got the White House's address.

954
00:39:24,780 --> 00:39:24,980
Yep.

955
00:39:25,500 --> 00:39:27,180
And it says, it has our company.

956
00:39:27,280 --> 00:39:30,680
Like, I think we were calling ourselves, like, I don't know, Fish Nugget Security or something.

957
00:39:30,860 --> 00:39:31,040
Yeah.

958
00:39:31,680 --> 00:39:32,040
Yeah.

959
00:39:32,660 --> 00:39:33,380
Fish Nugget.

960
00:39:33,420 --> 00:39:33,780
Yep.

961
00:39:33,860 --> 00:39:37,500
And through it, it has Brent's name at the bottom as the point of contact.

962
00:39:37,680 --> 00:39:40,960
He is the CISO himself from this company.

963
00:39:41,140 --> 00:39:41,640
Still has the CISO.

964
00:39:41,660 --> 00:39:43,880
I haven't received a paycheck from that company, by the way.

965
00:39:44,680 --> 00:39:47,240
I've got Easter eggs hidden in it just to make sure that they're paying attention.

966
00:39:47,660 --> 00:39:51,680
And this is how we also test our incident response, too, or their incident response, rather.

967
00:39:52,320 --> 00:39:53,480
Are they following up?

968
00:39:53,520 --> 00:39:54,400
Are they doing their due diligence?

969
00:39:54,660 --> 00:39:56,580
Are they calling that point of contact?

970
00:39:56,720 --> 00:39:59,880
And is that point of contact indeed the person that would authorize this?

971
00:40:00,000 --> 00:40:01,000
Do they even work there?

972
00:40:03,400 --> 00:40:06,860
So, that's kind of what I use when security guards get angry.

973
00:40:07,060 --> 00:40:08,640
At one point, I was picking a lock.

974
00:40:09,000 --> 00:40:10,060
I didn't hear this guy.

975
00:40:10,200 --> 00:40:11,640
Really big guy, which surprised me.

976
00:40:11,660 --> 00:40:12,980
And I was sitting there.

977
00:40:13,080 --> 00:40:14,280
I'm trying to get into this door.

978
00:40:14,400 --> 00:40:15,220
And it comes up behind me.

979
00:40:15,300 --> 00:40:16,440
He's like, what are you doing?

980
00:40:17,320 --> 00:40:17,780
Turn around.

981
00:40:17,900 --> 00:40:18,300
He's armed.

982
00:40:18,740 --> 00:40:19,700
He's like, oh, hey, buddy.

983
00:40:21,660 --> 00:40:23,620
And he's like, what are you doing?

984
00:40:23,900 --> 00:40:24,760
I was like, oh, I'm testing.

985
00:40:24,980 --> 00:40:25,660
He's like, I'm with facilities.

986
00:40:25,920 --> 00:40:26,940
I'm helping facilities out.

987
00:40:27,180 --> 00:40:28,280
We're going to replace these cores.

988
00:40:28,460 --> 00:40:29,500
And we just want to make sure they're good.

989
00:40:30,480 --> 00:40:31,380
Just off the top of my head.

990
00:40:31,940 --> 00:40:32,940
He's like, no, you're not.

991
00:40:33,320 --> 00:40:34,360
I'm like, all right.

992
00:40:34,400 --> 00:40:34,820
He caught me.

993
00:40:35,740 --> 00:40:36,420
Here's my letter.

994
00:40:36,680 --> 00:40:38,080
And I give him the fake letter of authorization.

995
00:40:38,420 --> 00:40:39,240
And he reads through it.

996
00:40:39,300 --> 00:40:40,140
He doesn't even look at it.

997
00:40:40,180 --> 00:40:40,980
He doesn't read through it.

998
00:40:41,040 --> 00:40:41,640
He glances at it.

999
00:40:41,640 --> 00:40:43,020
And he's like, oh.

1000
00:40:43,380 --> 00:40:43,880
Well, cool.

1001
00:40:44,040 --> 00:40:44,580
And he gives it to me.

1002
00:40:44,600 --> 00:40:46,840
And I've told this story before if you've heard some of our other talks.

1003
00:40:46,920 --> 00:40:47,400
But it's hilarious.

1004
00:40:47,640 --> 00:40:49,680
And it's part of our security guards LOL talk.

1005
00:40:50,040 --> 00:40:50,880
He goes, oh, OK.

1006
00:40:50,980 --> 00:40:51,380
Here you go.

1007
00:40:51,480 --> 00:40:52,040
You can have it back.

1008
00:40:52,980 --> 00:40:54,160
Actually, I'm with security, too.

1009
00:40:54,340 --> 00:40:54,700
And I was like.

1010
00:40:54,840 --> 00:40:54,940
Yeah.

1011
00:40:54,960 --> 00:40:55,460
Now they're buddies.

1012
00:40:55,840 --> 00:40:56,120
Yeah.

1013
00:40:56,320 --> 00:40:56,600
Obviously.

1014
00:40:56,800 --> 00:40:57,720
You are with security.

1015
00:40:57,860 --> 00:40:58,300
Now we're buddies.

1016
00:40:58,360 --> 00:40:59,060
We established a rapport.

1017
00:40:59,780 --> 00:41:01,720
And I was like, well, you know what, man?

1018
00:41:01,780 --> 00:41:03,060
I'm going to be here for a couple more hours.

1019
00:41:03,240 --> 00:41:07,220
Could you do me a favor and let the other guards know that I'm going to be testing some

1020
00:41:07,220 --> 00:41:07,460
stuff?

1021
00:41:07,500 --> 00:41:08,440
That way they don't bother me.

1022
00:41:09,020 --> 00:41:09,920
He's like, oh, yeah.

1023
00:41:09,920 --> 00:41:10,140
Sure.

1024
00:41:11,860 --> 00:41:12,760
Right away, sir.

1025
00:41:12,880 --> 00:41:13,080
Yeah.

1026
00:41:13,900 --> 00:41:14,220
Score.

1027
00:41:14,700 --> 00:41:15,260
It's great.

1028
00:41:16,940 --> 00:41:19,940
Or, you know, something to keep in mind, the fake letter.

1029
00:41:20,220 --> 00:41:23,220
So if you do get caught and someone's like, what are you doing?

1030
00:41:23,280 --> 00:41:24,120
You're not supposed to be here.

1031
00:41:24,220 --> 00:41:24,700
And you're like, OK.

1032
00:41:24,760 --> 00:41:25,400
Here's my letter.

1033
00:41:25,540 --> 00:41:27,180
And they look at it and they're like, nope.

1034
00:41:27,340 --> 00:41:28,440
You don't work at the White House.

1035
00:41:28,540 --> 00:41:29,260
What are you doing here?

1036
00:41:29,480 --> 00:41:31,280
If you try to pull out another letter.

1037
00:41:32,720 --> 00:41:33,420
So, yeah.

1038
00:41:33,800 --> 00:41:35,060
I got another one, too.

1039
00:41:35,080 --> 00:41:36,220
It's like David Copperfield.

1040
00:41:36,400 --> 00:41:37,480
How many do you need, sir?

1041
00:41:38,500 --> 00:41:39,900
But that's seriously something that you can do.

1042
00:41:39,920 --> 00:41:42,340
Something to keep in mind because it could go really bad.

1043
00:41:42,600 --> 00:41:46,740
And you strongly want to encourage them, look at the point of contact.

1044
00:41:47,100 --> 00:41:50,500
You'll see that that is legit if you have to go to your global directory and pull up

1045
00:41:50,500 --> 00:41:52,480
their phone number and call them right now before you call the police.

1046
00:41:52,680 --> 00:41:52,800
Yeah.

1047
00:41:52,840 --> 00:41:53,640
Please don't shoot me.

1048
00:41:53,700 --> 00:41:54,260
Please read.

1049
00:41:54,520 --> 00:41:55,980
Or I'll read it for you if you can't.

1050
00:41:56,820 --> 00:41:57,540
I mean, you know.

1051
00:41:57,880 --> 00:41:58,640
That was awful.

1052
00:41:58,800 --> 00:41:59,300
Why did I say that?

1053
00:42:00,320 --> 00:42:00,640
Wow.

1054
00:42:01,020 --> 00:42:01,340
Yeah.

1055
00:42:01,500 --> 00:42:02,300
And squirrel.

1056
00:42:02,580 --> 00:42:02,860
Yeah.

1057
00:42:05,400 --> 00:42:07,000
So let's say you do get caught.

1058
00:42:07,220 --> 00:42:09,300
And I'll try to keep on track here.

1059
00:42:09,300 --> 00:42:10,520
So you do get caught.

1060
00:42:10,920 --> 00:42:12,640
You know, it's okay if you get caught.

1061
00:42:12,740 --> 00:42:15,200
If you're supposed to be there and you get caught, it's okay.

1062
00:42:15,260 --> 00:42:15,640
It happens.

1063
00:42:16,360 --> 00:42:19,840
So don't try to be cool and run away from the security guards.

1064
00:42:20,040 --> 00:42:20,380
Parkour.

1065
00:42:20,540 --> 00:42:20,840
Yeah.

1066
00:42:20,920 --> 00:42:24,300
Because all they're going to do, hey, we had a guy that wasn't in here.

1067
00:42:24,440 --> 00:42:24,800
Police.

1068
00:42:24,940 --> 00:42:25,360
You know.

1069
00:42:25,820 --> 00:42:26,960
This is what he looks like.

1070
00:42:27,000 --> 00:42:27,680
Go find him.

1071
00:42:27,680 --> 00:42:29,160
Now there's a manhunt for you.

1072
00:42:29,340 --> 00:42:34,920
So then if you get arrested by the police or worse, you know, then you've got all this

1073
00:42:34,920 --> 00:42:35,960
explaining to do.

1074
00:42:36,140 --> 00:42:39,280
It's like, okay, well, if you were supposed to be there, why are you running?

1075
00:42:39,300 --> 00:42:41,340
Why were you running away like an idiot?

1076
00:42:42,240 --> 00:42:47,240
So if you get caught and you're supposed to be there, say, okay, you caught me.

1077
00:42:47,380 --> 00:42:49,460
Like Tim said, please call the number.

1078
00:42:49,780 --> 00:42:52,880
I'll comply with whatever request that you make.

1079
00:42:53,000 --> 00:42:53,540
You know.

1080
00:42:53,580 --> 00:42:56,300
And it should deescalate the situation.

1081
00:42:56,560 --> 00:43:01,620
You know, and it's awesome if you're like some, you know, incredible parkour person, right?

1082
00:43:02,220 --> 00:43:02,700
Great.

1083
00:43:03,120 --> 00:43:04,820
Use that to get to places.

1084
00:43:04,920 --> 00:43:06,320
Don't use it to try to get away.

1085
00:43:06,660 --> 00:43:07,840
Because there's a risk.

1086
00:43:07,840 --> 00:43:09,060
You're going to hurt yourself.

1087
00:43:09,540 --> 00:43:10,700
Somebody's running at you.

1088
00:43:10,760 --> 00:43:11,740
They're going to slip and fall.

1089
00:43:12,160 --> 00:43:14,260
Or down the fire escape or something like that.

1090
00:43:14,440 --> 00:43:15,080
If they're armed.

1091
00:43:15,360 --> 00:43:15,480
Yeah.

1092
00:43:15,540 --> 00:43:15,860
You're not.

1093
00:43:15,920 --> 00:43:17,720
You didn't do anything wrong.

1094
00:43:17,960 --> 00:43:19,180
So there's no reason for you to run.

1095
00:43:19,320 --> 00:43:20,280
When you're caught, you're caught.

1096
00:43:20,480 --> 00:43:20,640
Right?

1097
00:43:20,800 --> 00:43:20,960
Yeah.

1098
00:43:22,280 --> 00:43:22,760
So yeah.

1099
00:43:22,820 --> 00:43:23,480
Just use your brain.

1100
00:43:23,560 --> 00:43:28,740
Don't try to be cool and manhunt and, you know, five stars on Grand Theft Auto and all that stuff.

1101
00:43:28,860 --> 00:43:30,320
So not worth it.

1102
00:43:31,420 --> 00:43:31,960
All right.

1103
00:43:32,000 --> 00:43:32,460
Let's see.

1104
00:43:32,500 --> 00:43:33,620
I think we've got a few more minutes.

1105
00:43:33,660 --> 00:43:35,020
I want to make sure we have time for questions.

1106
00:43:37,060 --> 00:43:37,420
Yeah.

1107
00:43:39,720 --> 00:43:40,040
Again.

1108
00:43:40,320 --> 00:43:40,940
Don't do that to my boss.

1109
00:43:40,940 --> 00:43:41,240
Squirrel.

1110
00:43:41,560 --> 00:43:41,680
Yeah.

1111
00:43:43,600 --> 00:43:45,220
So lockpicking bypass methods.

1112
00:43:45,480 --> 00:43:48,520
So make sure that you know what you're doing before you go inside.

1113
00:43:48,740 --> 00:43:57,040
If you don't know what you're doing with lockpicking and you're nervous and you're trying to get in somewhere and you have no idea about how to use the tensioner and all that stuff and you break it.

1114
00:43:57,040 --> 00:43:58,120
Breaking the crap out of it.

1115
00:43:58,200 --> 00:43:58,480
Yeah.

1116
00:43:58,560 --> 00:44:02,400
Or you break it off in the lock or, you know, use bump keys and damage it.

1117
00:44:02,580 --> 00:44:04,520
All that's going to do is upset the client.

1118
00:44:04,620 --> 00:44:07,020
And you're going to have to, you know, pay to replace that and all that stuff.

1119
00:44:07,020 --> 00:44:09,560
And, you know, you look stupid.

1120
00:44:09,720 --> 00:44:12,660
So just know what you're doing before you do it.

1121
00:44:12,760 --> 00:44:14,680
So same with running exploits and stuff.

1122
00:44:14,880 --> 00:44:16,320
Well, the same with social engineering, too, right?

1123
00:44:16,400 --> 00:44:16,480
Yeah.

1124
00:44:16,480 --> 00:44:22,860
If you're not good at improv or lying to people, maybe practice that before you go inside.

1125
00:44:23,140 --> 00:44:24,040
Before you sweat.

1126
00:44:24,200 --> 00:44:24,380
Yeah.

1127
00:44:24,620 --> 00:44:25,060
Hey.

1128
00:44:25,460 --> 00:44:26,140
Let me .

1129
00:44:26,140 --> 00:44:26,680
Yeah.

1130
00:44:26,680 --> 00:44:26,980
I'm good.

1131
00:44:27,480 --> 00:44:29,300
I'm Todd from accounting.

1132
00:44:29,700 --> 00:44:29,940
Yeah.

1133
00:44:31,420 --> 00:44:32,240
Or you walk up.

1134
00:44:32,240 --> 00:44:32,640
No, you're not.

1135
00:44:32,900 --> 00:44:33,520
Walk around.

1136
00:44:33,700 --> 00:44:34,740
Sir, can I help you?

1137
00:44:34,920 --> 00:44:35,340
No.

1138
00:44:37,020 --> 00:44:37,200
Yeah.

1139
00:44:37,280 --> 00:44:38,460
It's like they caught me.

1140
00:44:38,500 --> 00:44:38,660
Yeah.

1141
00:44:39,140 --> 00:44:39,840
They're really good.

1142
00:44:39,920 --> 00:44:40,720
They're very secure.

1143
00:44:40,780 --> 00:44:41,300
Here's my letter.

1144
00:44:43,480 --> 00:44:44,440
Call my mom.

1145
00:44:45,760 --> 00:44:46,120
Yeah.

1146
00:44:46,240 --> 00:44:46,560
Exactly.

1147
00:44:46,820 --> 00:44:48,340
He was really good at interrogating me.

1148
00:44:48,360 --> 00:44:49,040
I buckled him.

1149
00:44:49,080 --> 00:44:49,360
Yeah.

1150
00:44:49,480 --> 00:44:49,840
Yeah.

1151
00:44:50,260 --> 00:44:50,620
Yeah.

1152
00:44:50,620 --> 00:44:51,480
That guy was good.

1153
00:44:52,040 --> 00:44:53,960
He had a knife to my throat.

1154
00:44:54,020 --> 00:44:54,440
I promise.

1155
00:44:54,920 --> 00:44:55,500
So, yeah.

1156
00:44:55,880 --> 00:44:57,240
Talking about improv and stuff.

1157
00:44:58,320 --> 00:45:02,600
When we do our recon, we always pack several sets of clothes, whether it's suits, T-shirts,

1158
00:45:02,600 --> 00:45:02,960
or whatever.

1159
00:45:03,480 --> 00:45:04,520
Just do your recon.

1160
00:45:04,700 --> 00:45:05,260
Figure it out.

1161
00:45:05,320 --> 00:45:06,000
You know, you want to fit in.

1162
00:45:06,000 --> 00:45:06,460
The dress code.

1163
00:45:06,460 --> 00:45:06,620
Yeah.

1164
00:45:06,740 --> 00:45:07,820
Figure out the dress code.

1165
00:45:09,040 --> 00:45:14,540
And then if you're not good with lying to people, go sit down at the mall next to some

1166
00:45:14,540 --> 00:45:18,740
random stranger, strike up a conversation, and never tell them the truth about yourself.

1167
00:45:19,120 --> 00:45:20,860
Or do it during DEFCON.

1168
00:45:20,920 --> 00:45:22,000
That's a perfect place to do it.

1169
00:45:22,300 --> 00:45:22,700
Yeah.

1170
00:45:22,700 --> 00:45:22,820
Oh, yeah.

1171
00:45:22,840 --> 00:45:23,700
Like total BS.

1172
00:45:23,700 --> 00:45:23,860
I'm calling.

1173
00:45:24,140 --> 00:45:26,880
I'm from Dublin, Ireland, and I'm here, blah, blah, blah.

1174
00:45:27,060 --> 00:45:27,320
Yeah.

1175
00:45:27,320 --> 00:45:27,380
Yeah.

1176
00:45:27,380 --> 00:45:31,300
You know, and it's like you just make up stuff, and you just practice rolling with

1177
00:45:31,300 --> 00:45:33,980
it and filling in the gaps and letting them fill in the gaps.

1178
00:45:34,140 --> 00:45:35,540
Oh, you have an accent.

1179
00:45:35,540 --> 00:45:36,120
Where are you from?

1180
00:45:36,700 --> 00:45:37,140
Guess.

1181
00:45:37,520 --> 00:45:37,860
Yeah.

1182
00:45:37,940 --> 00:45:38,040
Guess.

1183
00:45:38,600 --> 00:45:39,040
Yeah.

1184
00:45:40,520 --> 00:45:40,960
Yeah.

1185
00:45:41,060 --> 00:45:41,400
Guess.

1186
00:45:42,420 --> 00:45:43,180
You're right.

1187
00:45:43,600 --> 00:45:44,460
My name's James.

1188
00:45:45,080 --> 00:45:46,460
I'm glad you guys could come.

1189
00:45:46,720 --> 00:45:51,480
I'm going to talk to you about how I'm the four-time world NBA slam dunk champion.

1190
00:45:52,280 --> 00:45:55,200
And, yeah, so we'll talk about the training and stuff.

1191
00:45:55,540 --> 00:45:55,980
Yeah.

1192
00:45:56,020 --> 00:45:56,380
That is.

1193
00:45:56,380 --> 00:45:56,540
Yeah.

1194
00:45:56,580 --> 00:45:57,840
That's a far-fetched lie, man.

1195
00:45:59,600 --> 00:46:01,620
So, and that's the reason I say that.

1196
00:46:01,660 --> 00:46:03,320
It's like, you know, don't be an idiot about it.

1197
00:46:03,360 --> 00:46:03,480
Right?

1198
00:46:03,980 --> 00:46:07,140
You know, we also talk about improv quite a bit in our talks as well.

1199
00:46:07,680 --> 00:46:13,480
You know, I think it's great to go into an acting community or some kind of acting guild

1200
00:46:13,480 --> 00:46:16,460
or group, an improv group, practice.

1201
00:46:16,640 --> 00:46:19,900
That is perfect for social engineering, and I think most of the people in here would probably

1202
00:46:19,900 --> 00:46:20,500
agree with that.

1203
00:46:20,720 --> 00:46:23,940
I like, I do a lot of acting and stuff, and that has helped me tremendously.

1204
00:46:24,160 --> 00:46:27,900
I was actually a street magician, too, and that has helped me tremendously with these

1205
00:46:27,900 --> 00:46:28,160
things.

1206
00:46:28,320 --> 00:46:28,840
And a stripper.

1207
00:46:29,160 --> 00:46:29,520
Huh?

1208
00:46:29,880 --> 00:46:30,240
Nothing.

1209
00:46:30,360 --> 00:46:30,480
What?

1210
00:46:30,480 --> 00:46:30,780
Nothing.

1211
00:46:31,020 --> 00:46:31,200
What?

1212
00:46:32,780 --> 00:46:37,560
And so that helps contribute to the manipulation, too, and being able to just roll with the

1213
00:46:37,560 --> 00:46:40,060
punches and lie and like it's natural.

1214
00:46:40,340 --> 00:46:40,600
Yep.

1215
00:46:40,760 --> 00:46:41,160
So.

1216
00:46:41,580 --> 00:46:45,180
So, I know we have a few more slides, but it's mostly to talk about, you know, what's

1217
00:46:45,180 --> 00:46:47,080
the main, what's the main point of the assessment?

1218
00:46:47,260 --> 00:46:49,480
Is it to get into the domain, the, the.

1219
00:46:50,280 --> 00:46:50,900
Data center.

1220
00:46:51,000 --> 00:46:51,440
Data center.

1221
00:46:51,540 --> 00:46:52,560
Yeah, not domain controller.

1222
00:46:52,600 --> 00:46:53,540
It's internal.

1223
00:46:53,620 --> 00:46:53,880
Oh, that's.

1224
00:46:53,880 --> 00:46:59,160
Anyway, so is it to get into the data center or is it to get to, you know, employee files?

1225
00:47:00,220 --> 00:47:03,660
Yeah, or is there something that's even more sensitive to this company?

1226
00:47:03,900 --> 00:47:09,040
So make sure that whatever you're going after that you understand what would be the worst

1227
00:47:09,040 --> 00:47:11,840
thing to happen to this company and go after that.

1228
00:47:11,960 --> 00:47:13,340
It's not always the data center.

1229
00:47:13,540 --> 00:47:17,660
Could be, but it, you know, there could be things that could be a lot more detrimental

1230
00:47:17,660 --> 00:47:18,420
to the company.

1231
00:47:18,620 --> 00:47:21,100
You know, and another thing to consider, too, when you're doing these kinds of assessments

1232
00:47:21,100 --> 00:47:24,760
is, is, they're not safety assessments, but keep that in mind when you're doing them.

1233
00:47:24,880 --> 00:47:28,400
If I were somebody wanting to hurt a bunch of people.

1234
00:47:28,780 --> 00:47:29,740
Then how would I do that?

1235
00:47:29,840 --> 00:47:31,040
Okay, well, I've gotten in here.

1236
00:47:31,400 --> 00:47:32,520
They let me in with a bag.

1237
00:47:32,980 --> 00:47:33,840
A huge bag.

1238
00:47:34,160 --> 00:47:35,180
Or they let me in with this.

1239
00:47:35,320 --> 00:47:36,260
I got into this area.

1240
00:47:36,960 --> 00:47:39,240
You know, where the power supply is.

1241
00:47:39,320 --> 00:47:41,140
Or the backup generators and all that stuff.

1242
00:47:41,380 --> 00:47:41,440
Yeah.

1243
00:47:42,320 --> 00:47:42,640
Elevators.

1244
00:47:42,640 --> 00:47:44,380
You know, think about that kind of thing, too.

1245
00:47:44,400 --> 00:47:47,840
Not just, hey, I found a, a switch and I was able to plug in.

1246
00:47:47,920 --> 00:47:52,040
Or I found, you know, the, the network department and I was able to, to get a bunch of stuff.

1247
00:47:52,280 --> 00:47:53,160
And check my email.

1248
00:47:53,360 --> 00:47:54,120
And check my email.

1249
00:47:54,220 --> 00:47:54,960
And get on Facebook.

1250
00:47:55,160 --> 00:47:55,340
Yep.

1251
00:47:55,860 --> 00:47:58,020
So, again, isn't it response testing?

1252
00:47:58,020 --> 00:47:58,360
You know?

1253
00:47:58,380 --> 00:47:59,500
So is that part of it?

1254
00:48:00,320 --> 00:48:00,680
Yeah.

1255
00:48:01,020 --> 00:48:01,380
Sorry.

1256
00:48:03,500 --> 00:48:05,920
We like pictures and GIFs.

1257
00:48:06,080 --> 00:48:06,280
Yeah.

1258
00:48:06,320 --> 00:48:06,580
Yeah.

1259
00:48:06,740 --> 00:48:10,780
So, you know, if you get in somewhere, you know, how absurd do you have to be to give

1260
00:48:10,780 --> 00:48:13,920
them the benefit of the doubt to see, okay, what do I have to do to get caught?

1261
00:48:14,160 --> 00:48:18,220
And then once you do get caught, you work backwards from there to help secure, you know,

1262
00:48:18,240 --> 00:48:21,860
help strengthen their security posture as far as physical goes.

1263
00:48:22,080 --> 00:48:22,200
So.

1264
00:48:22,460 --> 00:48:25,800
You know, and also, like, with this incident response stuff, I know we kind of talked about

1265
00:48:25,800 --> 00:48:26,360
that quite a bit.

1266
00:48:26,440 --> 00:48:28,000
But it's, it's also important to ask questions.

1267
00:48:28,020 --> 00:48:31,540
And even before, during the kickoff call, say, hey, what is your procedures?

1268
00:48:31,680 --> 00:48:32,480
How do you guys do this?

1269
00:48:32,740 --> 00:48:34,940
And then compare it to what they actually do.

1270
00:48:35,060 --> 00:48:35,340
Yep.

1271
00:48:35,340 --> 00:48:36,920
Are they actually following escalation procedures?

1272
00:48:37,320 --> 00:48:37,520
Yep.

1273
00:48:38,580 --> 00:48:39,840
Practical versus impractical.

1274
00:48:39,920 --> 00:48:41,340
I know we only have about two minutes left.

1275
00:48:41,500 --> 00:48:43,340
So sorry for having to speed through this.

1276
00:48:43,460 --> 00:48:47,500
But if you are on site and you're trying to be covert, you know, it's probably not the

1277
00:48:47,500 --> 00:48:52,320
best to wear some gigantic tactical bag with Hack the Planet stickers and stuff all over

1278
00:48:52,320 --> 00:48:52,520
it.

1279
00:48:52,620 --> 00:48:52,680
So.

1280
00:48:53,260 --> 00:48:54,640
Looking at you, Jason Street.

1281
00:48:54,800 --> 00:48:55,060
Yeah.

1282
00:48:55,240 --> 00:48:56,680
You don't think he's in here right now.

1283
00:48:56,740 --> 00:48:56,860
But.

1284
00:48:58,020 --> 00:48:58,460
Just be mindful.

1285
00:48:58,760 --> 00:49:02,160
Like, I know whenever we're going on site, if it's a more professional thing, I have

1286
00:49:02,160 --> 00:49:06,480
a leather, sounds stupid saying it, but it's like a briefcase.

1287
00:49:06,540 --> 00:49:06,780
Yeah.

1288
00:49:06,780 --> 00:49:07,940
But it's leather, you know, that opens.

1289
00:49:08,520 --> 00:49:10,920
And I use these gridded things.

1290
00:49:13,280 --> 00:49:14,540
So I have a few of these.

1291
00:49:15,120 --> 00:49:21,900
And so it's like a filing system for either my backpack or the little side bag that I

1292
00:49:21,900 --> 00:49:22,060
have.

1293
00:49:22,120 --> 00:49:25,920
That way, if I need to grab something really quick, it's all right there and I can just

1294
00:49:25,920 --> 00:49:26,480
get what I need.

1295
00:49:26,480 --> 00:49:28,100
And I'm not having to dig through a man purse.

1296
00:49:28,340 --> 00:49:29,780
The same thing with lockpicks, too.

1297
00:49:29,900 --> 00:49:36,660
Like, I had this made just so I could easily access it and then have different tools.

1298
00:49:37,820 --> 00:49:39,980
So it's handy to have that readily available.

1299
00:49:40,260 --> 00:49:40,820
Oh, sorry.

1300
00:49:42,900 --> 00:49:44,760
It's handy to have things like that readily available.

1301
00:49:44,860 --> 00:49:50,480
That way you're not unzipping your southward lockpick set and dumping tensioners all over

1302
00:49:50,480 --> 00:49:50,880
the place.

1303
00:49:51,060 --> 00:49:51,900
Oh, crap.

1304
00:49:52,160 --> 00:49:53,000
Excuse me, officer.

1305
00:49:53,100 --> 00:49:54,640
Let me find my single pick first.

1306
00:49:54,640 --> 00:49:54,960
Yeah.

1307
00:49:55,660 --> 00:49:57,020
That doesn't go over well.

1308
00:49:57,360 --> 00:49:58,380
But, you know, it is great.

1309
00:49:58,540 --> 00:50:01,300
I know we only have a couple minutes or a minute here.

1310
00:50:01,440 --> 00:50:06,180
And so it's really important that you guys, when you're doing this, you get a proper bag.

1311
00:50:06,600 --> 00:50:08,620
You know, we jest about the patches and stuff.

1312
00:50:08,700 --> 00:50:11,780
It's great to have patches and stuff on your bag when you're at cons and walking around.

1313
00:50:11,940 --> 00:50:14,680
But when you're actually on site doing these assessments, they are loud.

1314
00:50:14,840 --> 00:50:17,560
Unless you want attention, then it's probably best to avoid that.

1315
00:50:18,560 --> 00:50:20,320
You guys can go back and look through all this.

1316
00:50:20,400 --> 00:50:20,660
Yeah.

1317
00:50:20,660 --> 00:50:21,440
Pause the video.

1318
00:50:21,780 --> 00:50:22,140
Sorry.

1319
00:50:22,140 --> 00:50:23,900
Here's some Red Team Toolkit examples.

1320
00:50:24,200 --> 00:50:25,580
These are kind of what we have in the bag.

1321
00:50:25,820 --> 00:50:29,940
If we go back to this first slide with the image here, all of that fits in that little

1322
00:50:29,940 --> 00:50:30,440
bag there.

1323
00:50:30,860 --> 00:50:33,360
And there's tons of little gadgets and things there.

1324
00:50:34,160 --> 00:50:35,420
And a PEZ dispenser.

1325
00:50:35,660 --> 00:50:38,300
And a PEZ dispenser and a Game Boy.

1326
00:50:38,600 --> 00:50:38,940
Yeah.

1327
00:50:39,620 --> 00:50:40,460
Miscellaneous considerations.

1328
00:50:40,620 --> 00:50:43,160
We'll let you guys review that on your own.

1329
00:50:43,800 --> 00:50:44,860
Some travel tips.

1330
00:50:44,980 --> 00:50:46,160
You know, things you can consider.

1331
00:50:46,380 --> 00:50:48,120
Keeping some TSA-approved items.

1332
00:50:48,440 --> 00:50:48,540
Yeah.

1333
00:50:48,960 --> 00:50:52,120
Don't, you know, know what to bring in, what not to bring in.

1334
00:50:52,140 --> 00:50:53,140
And, yeah.

1335
00:50:53,840 --> 00:50:54,240
We're rushing.

1336
00:50:54,420 --> 00:50:54,740
Yeah.

1337
00:50:54,940 --> 00:50:55,700
So we'll...

1338
00:50:56,380 --> 00:50:56,700
Yeah.

1339
00:50:56,820 --> 00:50:57,180
We're good.

1340
00:50:57,260 --> 00:50:57,480
All right.

1341
00:50:57,560 --> 00:50:58,940
So we'll hang out outside.

1342
00:50:59,040 --> 00:51:00,240
If you have questions, let us know.

1343
00:51:00,320 --> 00:51:00,680
Thank you.

1344
00:51:00,860 --> 00:51:01,340
Thank you.

1345
00:51:01,460 --> 00:51:02,120
Thank you, guys.