Hi, everyone. We'd like to invite Brent White and Tim Roberts. Brent White is a senior
security consultant at TrustedSec and Tim Roberts is a senior security consultant with NTT
Security Threat Services Group. Both have spoken at ISSA International, DEF CON, Derby CON,
and various B-Sides. Maybe not always together, but so we have them tonight together and we
appreciate having them. Their theme is skills for a red team. Let's give them a hand.
I thought that was going to fall over. I think we almost died. That would have been
interesting, huh? Short talk, right? So as you mentioned, I'm Brent White. And I'm Tim
Roberts. So as you can see, we're very mature. Yeah, as you can tell from this, we're
extremely mature and highly professional. So hopefully you're not too disappointed at that.
So, you know, the wonderful English, English over there. So all right, let's get into it.
So what do you mean by red teamer? Red teamer is often a defined, it's kind of subjective in
InfoSec. Like some people say, well, red teaming means this. Well, other people are like, no, it
means this or whatever. And it becomes this butting head thing. For us, we're defining it
specifically for this talk as attempting to covertly identify gaps. This includes physical and
social engineering gaps, security awareness, in addition, often in addition to technical. Some
clients prefer we don't touch their systems. We just get to their systems. So we're going to
touch their systems and we have a proof of concept. But in this, we're going to focus primarily
on the social aspects and the physical aspects. So therefore, red teamer means you're a member of
a red team. So show of hands, who in here has ADD, ADHD? I mean, you're not going to hear
anything we're going to say because of, you know, just a warning. You're going to in a few
months go back and watch the video because you won't hear anything we say. So yeah, squirrel.
So, okay. This is a very poor stand up comedy act, apparently. So, yeah, so we're going to talk
about a few different assessment types, covert, overt, and hybrid, and we'll go ahead and jump
into those. And something else, too, if anybody has any questions while we're talking, please
raise your hand or just interrupt us so we can go ahead and. Or throw something at Brent.
Yeah, money or something. What's your name? That is Theresa. She's really sweet. Yes.
Nice lady. Has a mouth on her, though. All right. So, all right. See, I'm telling you, this is
going bad. This is going to go awful. So covert, Tom Clancy, so you try to be all sneaky and
covert, and we had some trolls. It's like, okay, the short guy reads too many Tom Clancy novels,
and it's like, no, I don't. I try to be sneaky. So this is basically if the company has you come
in, and it's like, okay, see what you can do as an attacker in an unauthenticated, or
unauthenticated millennium. You're going to have to do this. You're going to have to do this. You're
a malicious attacker. What can you do? Where can you go without, you know, without the approval
of being there? So we'll talk about some methods about staying covert, trying to avoid detection,
and so on. You know, and some of these terms are kind of interchangeable, too, depending on
what pen testing group you work for or whatever. I mean, we're pen testers, so like some of the
service offerings we offer, we use verbiage like covert, overt, hybrid. It's easy to understand
for clients when they're thinking, you know, how do we want these guys to approach their assessment?
Do they want to do a walk-through and hold our hand and tell us the issues that they have, or do
they want us to actually take the role of, you know, criminal?
And that also depends on the maturity of the company's security program, too.
And the client relationship.
Yep.
So the covert assessments, we've got a couple different pictures in here from actual assessments.
Oftentimes we will wear body cams or just have a camera with us. That way we can, the client
requests, hey, can you guys film this person?
Can you do this interaction or this bypass or something like that?
Because they don't get to see it. They just kind of take your word of mouth.
As soon as they get the report, oh, it says you bypassed this or that, how did you do this?
Well, it says in the report, well, but how did you actually do it?
We want to see how you did it.
So oftentimes we'll wear body cams. Sometimes we'll just take still photos.
This top right one is pretty funny.
It's a human resource office.
And they had like a dimple lock.
We were able to pick it, get into it.
And there was all these cubicles around.
And the cubicle walls are so high that nobody could see their closet that had all the employee records in it.
Or me.
Or Brent.
Yeah.
I had to cut it a little shorter.
But nobody could see us pick this lock.
And so we're right beside a cubicle, literally probably here.
At the end of the hallway, too, you look down the hallway, at the end of it was a meeting room with glass doors.
And they were in a meeting.
And, you know, people were kind of looking around.
But it was funny because we got into the HR room.
All these employees' records and files.
Got the point of contact record.
And we ended up putting it on his desk later on that day.
It was kind of trolling him.
But, yeah.
So for these covert assessments I was talking before, social engineering and physical or, you know, they're kind of driving factors for a lot of this.
One of the number one, as most people in here know, compromises is through social engineering.
Whether it's onsite, phishing, vishing, something like that.
So what we do onsite is we really implement the social engineering.
We push to test their instant response.
We push to test the security awareness and the overall security culture in the company.
So in this we'll really push the limits and the boundaries of what we do from anything to trying to sneak in, okay, well, we got from A to B.
We already did this.
Now let's go troll the security guards or let's go, you know, talk to some people and ask them for information or to let us into sensitive areas or let us touch different things.
So.
Electronic things.
Electronic things.
Yeah.
So we actually have a talk that we do called security guards, LOL.
And it's, yeah.
And so we're not knocking security guards.
The whole reason we do that talk and you'll see we'll actually mention a few of those things is because there are so many companies that will have these large facilities and their entire physical security program minus a few biometric, you know, sensors or something like that.
They put it all on like one or two.
They put it all on like one or two minimum wage security guards.
And so once we walk in and we establish a rapport with them, we have several times, especially an awesome story from Tim where one of the security guards actually handed over their entire set of keys to him in exchange for his keys, which was a ring of bump keys.
You know, yeah, I'll come back and get these later.
So you'll hear some of the stories with that, too.
So physical security bypassing methods.
One of the things that we always focus on when we do this is we like to use tools that are available to the public.
So like the under the door tool, which is available, I think, from Rift Recon and a few other places.
Pretty easy to make, too.
Like $40 or $50.
And then the shove knife, which is, I think, $15 or $20.
Bump keys, they're $10 to $20, depending on which set you get.
Canned air is like $1.
Yeah.
The shrum tool is $2.50.
A piece of plastic that is made to go between strikes.
Strike plates and things to bypass locks, $10.
Or no, it's $5 for a 10-pack.
Or you use your hotel room key.
Yeah.
Or a credit card.
So the point is we always make sure that we use things that are so easy to get.
And we can show you, okay, we had no access.
Now we're in your data center using, you know, $50 worth of tools.
So, yeah, that picture is me reaching really high.
Keyboard.
That was the whole keyboard, whole system for the security access.
It showed all the security cameras and everything.
So, yeah, it was fun getting a shell on that and doing whatever I wanted to.
Turning the cameras off if I wanted to.
And having our way about the building.
So what can you do and cannot do?
You know, oftentimes during the kickoff call, when you're discussing your rules of engagement,
how you're going to do things, what you're going to do,
I don't like to go in specific details because, you know, that way if I decide to do something,
I don't have to go.
You know, it's better to ask for forgiveness kind of thing, right?
But it is important when you're talking about, like, after hours, for example.
Do you want us to do after hours assessments?
Do you have cleaning crew?
Do they prop open the doors at night?
How do they handle that?
Do you guys have after hours workers coming in?
Do you have execs coming in and out?
These are things that are important to ask because oftentimes people just focus on doing that.
They're doing it during business hours.
The windows we like to do most of these assessments on are during lunchtime,
during close of business when a lot of people are coming in and out of the building.
A lot of foot traffic.
Yeah.
And then after hours, depending on if they have armed security guards,
we like to try to avoid after hours for that because some people are trigger-happy security guards.
Yeah.
Breaking into a building at night with armed security guards is not a good idea.
Right.
And then a friend of mine, during a report review,
at TrustedSec was talking about how one of the assessments they did that the security guard said,
yes, if we would have seen you in that facility, we would have fired at you.
So from that point on, they no longer do the physicals at night after hours when there are armed security guards.
So something to keep in mind for sure.
You know, we were talking before.
You know, we're primarily discussing physical and social aspects.
But, you know, it's hacking in scope.
I get into the building.
I get into the server room.
Can I plug into the core switch?
What's off limits?
What's not off limits?
I think having no scope is best for these types of assessments because it's more reality-based.
It's more scenario-based or whatever.
It's okay to be like, all right, well, we just want you to focus on getting from here to, I don't know, the CTO's office.
We want you to try to get on his system.
Well, of course, that's a limited scope there.
But if it's pretty open, you want to try to sway the client to buy into that.
No scope at all.
Let us go in.
Let us do our thing.
If we didn't know anything, this is like not a full disclosure or partial disclosure assessment type, but it's kind of going in blindly.
You know, are these the things we can do?
Can we pick locks?
Some clients don't like us touching their locks or trying to bypass things because they're afraid, you know, well, it might damage it or it might do this or that, especially electronic locks.
Sometimes they don't like us touching any of the electronics on those locks or security systems.
Yeah.
Or if you see a laptop or an external device.
Yeah.
Or an external hard drive or USB, you know, can we grab that and take it out with us, things like that.
So I know that penetration testing is a large part of a lot of these assessments.
And so because this is Social Engineering Village, we're going to focus mostly on the physical part of things.
But something to keep in mind when you do get inside and you are able to plug in and gain access to the network, you know, you want to try to stay covert.
You want to do things like half open TCP scans where you're not having that full connection to potentially alert an IP address.
You know, if you do gain access to a system, you know, what PowerShell scripts or things are you running?
Are you trying to add a user?
Are you trying to brute force an admin level user or something that could potentially set off alarms?
So, you know, those are things you want to keep in mind if you do get access that you're not, you know, freaking out the admins at, you know, whatever time of day you got into their system.
So those are things, those evasion techniques are things to keep in mind.
You know, and a part of this too, it's kind of, this is a real quick story, but did a Red Team assessment.
We had gained access to the facility.
We plugged in a rogue access point, put it near the window.
We were sitting in the parking lot in a van in a hotel right across the street.
By the river?
By the river.
We had this high gain, you know, DBI antenna pointing up there.
We were able to connect to it.
From there, we were able to, you know, compromise some SQL databases, dump some tables.
We did a bunch of stuff.
Completely owned these people.
And then when we gave them the report, they were so upset with the report that we did not report from a Nessus finding that they found a telnet was open.
And they're like, you didn't add this to a report.
Well, this is a Red Team assessment.
We're not going to look at every little...
Priorities.
Priority.
Plus it was an internal, you know, telnet's open internally.
I mean, that's kind of a deal, I guess.
But to, you know, to express that to a client and to say, listen, this is a...
We're the bad guys here.
We're not doing a bone scan.
We're not doing, you know, reporting on every little thing.
We're going from A to B.
If you want a more overview or a bigger, broader overview, then, you know, you need to be specific about that.
Yeah.
We try to make it more like a real world scenario.
So...
Is incident response a part of the assessment?
You know, oftentimes what we do is we'll try to be obvious.
We'll wear bright colors.
We'll go to the security guard.
You know, Brent mentioned this story.
So I...
We had already been around the facility.
Did a whole bunch of stuff.
We found a security control room that had access to printing off badges.
It had access to a lot of different things.
They had keys in there to their company vehicles.
They had keys...
Hard keys to the entire facility.
An aluminum box that had a wafer core on it.
They also had badges from employees that were just recently terminated.
And they were still active.
Yeah.
The cards were still active, but they had them securely hidden under a keyboard.
So...
Super safe.
So we get to this security control room, and we couldn't get in it.
We couldn't pick the lock.
And it was heavily congested.
A lot of people walking by.
So I'm like, you know what?
I'm just going to go up to the security guard, and I'm going to ask you for keys.
Brent's like, okay.
So we go over there, and we'd already...
He's like, we're done.
We're screwed.
Thanks, Tim.
Yeah.
And we had already done quite a bit of compromise, right?
We'd already gathered what we needed.
But at this point, the client was really concerned about their security guards.
You know, they were concerned about, are they doing their job?
Their due diligence?
Are they following through?
Can you guys test this?
So I walk up.
I have those keys in my hand.
I was like, hey, yeah, I'm doing inventory, and I need to do an inventory of hard keys
in some of the servers in the security control room.
But my key's not working.
The key John gave me apparently doesn't work.
I called him.
He said, I could just use your keys.
Is that cool?
I'll bring them right back.
In fact, I will leave my keys here.
That way you know I will bring them back.
The bump keys.
Right.
And so she's like, oh, well, just as long as you bring them back before 5, because I
have to lock up the building.
Absolutely.
All right.
Cool.
Not a minute later.
Thank you.
Yeah.
So we had these keys.
We ended up going down there.
We ended up getting into a lot more stuff.
But that was, you know, we really pushed the envelope there, and she gave us, the security
guard gave us her keys.
And it was to multiple facilities, not just this one.
So if we wanted to leave and go to another facility after hours or whatever.
In one of their company vehicles, even.
In one of their, yeah.
With one of their badges.
Yeah.
So this picture is kind of funny.
The one with the.
This one?
Yeah.
The obfuscated.
And this one?
There.
So we walk over to this lady, and she prints badges.
And she also, I think she does like scheduling or paychecks or something like that.
But this was near a cash kind of area where they handle a lot of money.
We ended up walking over to her.
I told her, hey, you know, I have a lot of money.
Hey, I'm doing some inventory, and I'm also doing some network tests, just scanning for,
I think I said something like network connectivity.
A lot of times what we use is, hey, we're just doing some network connectivity.
I'll be right, real quick.
We heard your, yeah.
And then just kind of show up under their desk and say, I'll be just a minute.
Just, you know, and they don't, they just move out of the way.
Yep.
So that's exactly what she did.
She rolled out of the way.
And Brynn's sitting there talking to her, asking her about her day.
She had some pictures of her kids on her desk.
Yeah, I felt awful because I started talking to her about her grandkid being in soccer.
And I was like, oh yeah.
Yeah, that's a great sport.
And, you know, how many goals has she scored?
Like all this stuff.
The whole time Tim's stealing credentials and stuff and just awful, awful.
See, it's funny because you can see me doing it.
And then I have, I think I plugged in a key logger.
And I was like, well, this is just going to test the network connectivity.
It's USB.
And I plug it in.
And I was like, actually, before I do this, could you lock your system?
So she locks her system.
I plug it in.
I was like, actually, can you log back in now?
So she logs back in.
Get her domain credentials.
Done.
And now I'm on there and I'm doing my thing.
And then I have this clipboard, which we have another story we're probably going to get into.
But I want to go ahead and talk about this because it's funny.
Look at those shoes right there.
Man.
Nice shoes.
Whose shoes are those?
So I have this clipboard that I've got a Raspberry Pi in it.
I've got a wireless stick on it so you can SSH into it.
So what Brent can do from his phone is SSH into this and see whatever I'm scanning of the badges.
So I've got all these sensors on here to scan badges.
So what I was doing with this is I had this.
I had this inventory sheet.
It gets worse.
I promise you.
What's your name?
It gets much worse.
Can I see your badge?
And she gives me her badge and I put it on there and I'm writing her name down.
No, you don't just put it on there.
So when you read this thing, it doesn't, you can't, you know, you can't just like set it on there like this.
You have to do this.
So that is not a joke.
It's like, yeah, can I see your badge?
I just need to write down a few things.
Like that's pretty creepy.
She didn't ask any questions.
She's like, okay.
Yeah, so go youth soccer, right?
So where, I'm totally just, yeah.
Yeah, well, this next one where Brent is on the right there, this was another assessment we did where we walked straight through the mail room.
We had tailgated behind some people, walked straight through there.
And they had all this, all these cabinets containing like, I think it was like some PCI data.
PHI, something like that.
I think it was actually a healthcare company.
But we actually walked through and Brent just opens the door and we're just kind of walking.
No lock.
We're trying to purposely get caught at this point.
Didn't have a lock or anything like that.
And this was the room where they stored, they had all their backups.
So they had tons of hard printed off backups, boxes and things like that.
We're picking up boxes.
We're being really absurd trying to be like, really?
What do we have to do for you guys to ask what are we doing?
Excuse me, ma'am.
I'm not supposed to be here.
Could you question me?
What state was it in?
We're not at liberty to say that.
Yeah.
Sorry.
Yeah.
But we will tell you that we were not allowed to use audio or video recordings in any way because it's against state law.
And they had armed security guards.
So that's why we focused on the sweet lady and the cubicles.
So funny story.
So this is during the covert part.
And later on we actually did the overt assessment.
And as we were going through the HR ladies.
Even though we were being escorted by the point of contact.
The HR lady was like, I'm sorry.
You guys can't go in there.
And we're like, okay.
Even though we had.
We had already been in there.
All right.
I've already seen that room.
Yeah.
We're good.
So usually wait until the end to try and get caught.
You know, try to do our sneaky stuff first.
So there was one time where there was another coworker.
And so we actually got into this building.
And they're like, oh, yeah, there's security guards.
And he monitors remotely.
And we're like, cool.
So we walk around for an hour looking at the camera the whole time trying to get, you know, give them the benefit of the doubt.
Because, again, we don't do these assessments to come and say, look how bad you guys, you know, look how bad you are.
We like to give them an opportunity to catch us for a teaching moment.
Especially after we've identified some really critical vulnerabilities.
Yeah.
They suck.
Yeah.
It's awful.
And at that point it's like, okay.
We really need to see it.
What point is that?
And that's why we do the whole push kind of thing to really push the bounds.
Yeah.
Try to make people uncomfortable where hopefully they'll say, like, what are you doing?
You know, get out of my face.
So we were at this place.
And, you know, we had gone around.
We found all this stuff.
And they had these double glass doors at the front that had enough physical gap where you could actually, you know, put tools through it.
So I had a coat hanger.
Took my time looking at the camera behind me.
The glass door is right here.
So I'm looking at the camera.
Straightening this thing out.
This is not a joke.
This is a walk over to the receptionist table.
Get a handful of napkins.
Starbucks napkins.
Yeah.
And I tied them into a big, you know, like flower, like a poorly arts and crafts flower thing around.
So I put it through the door because they had a request to exit sensor on the other side.
So my whole goal was to see if I could trip that.
And so I'm looking at the thing.
And so I'm literally, like, going like this all the way up and down trying to get it to work.
And then I get to the trip and no one came.
So I look at the co-worker and I was like, okay, we've been here an hour.
Like, you know, what's going on?
He's like, okay, what are we going to do next?
And I was like, jumping jacks?
And he was like, okay, that's cool.
So we turn around and we look at the camera and we do jumping jacks for at least 20 seconds and the guy never came.
So, yeah.
Fail.
Very secure.
All right.
Let's move along.
All right.
So the overt assessments.
Yeah, I'll let you look at these pictures because they're funny at first and kind of use your imaginations.
So before you get into it, so you see that?
Can you see that right there?
There's a hole there.
Can you over here on this side?
It's a gigantic hole.
It's for a forklift, by the way.
So a forklift can pick up their confidential data bin and move it around.
So the bin is this tall and I think it was about three and a half feet wide.
Yeah.
And they had a best lock on it.
One of those really nice best locks on it.
Holding it, holding the flat.
Yeah.
And so, yeah.
And so you could put your stuff in there but you could also, we actually, we call it shredder bin bingo is what we ended up calling it.
So you stick your arm in there and you pull out however many papers you want.
A passport photo.
Yeah.
We found some passports, some background check forms, a bunch of other stuff.
I mean, it was ridiculous.
A loan for a house.
Yeah.
A home loan application.
Yeah.
And so we're like, are you serious right now?
And yeah, so you could do that on both sides.
Oh, yeah.
And this is also Tim on top of a vending machine going through the ceiling during the covert part in a major hallway and no one stops.
Well, there's, okay.
So the funny thing.
Seriously, no one stopped.
They're like, where's God?
On top of the vending machine.
Yeah, on top of here.
But the funny thing is, is that the other side of that wall is their data center.
Yeah.
And they didn't have floor to ceiling walls.
They didn't have an IDS on top.
They didn't have any kind of screen or fence or anything.
Yeah.
So, and, but they, you know, they didn't have any kind of screen or fence or anything.
They conveniently had an Aquafina machine.
Yeah.
That let me get up and over.
Yeah.
So.
Thanks, water.
Okay.
So, yeah, this is just a quick demo.
You know, and this is part, we start getting into, we're going to start talking about the overt part where you walk through and the methodologies and stuff that we developed.
But before we, yeah, before we talk, show the video though.
So again, this goes back to what I was saying before.
Sometimes we'll have body cams.
But if it's an overt, sometimes we'll, LV.
Yeah.
We'll escort the client or the point of contact through the facility as we're doing these things and pointing them out.
Yeah.
Or we'll do a covert prior to doing that.
And then after we give them, you know, kind of an overview of what we found, they'll say, okay, well, can you kind of show me?
So we'll walk around and show them.
Well, for the sake of time, because oftentimes we only do these assessments, we only have like a week, maybe two weeks max, we'll just show them a video and that's kind of all.
Yeah.
So in this situation, this highly secure facility.
But in their back.
I forgot the air quotes.
Highly secure facility.
There you go.
They had two points of entry.
The front door, the lobby where a rotating door is, some security guards.
And then the back door where nothing is except for a big gap and a badge reader.
And a camera that didn't even really cover the door.
And a camera that was, it was actually fogged over.
So it was one of those PTZ cameras, but it had the dome was like weather warned and it was fogged.
It was bad.
So I'm like, there's no way they're seeing me do this right now.
High definition.
So, yeah.
Click that.
So.
No, we're good.
The audio is not a big deal.
So, yeah.
It's just Brent talking.
Nobody wants to hear that.
Yeah.
That sounds stupid.
So you can see it's locked.
Tim's outside in his cool taxi hat.
And just a shove knife.
And the 15 bucks.
15 bucks for that?
Like seconds.
He's, yeah.
Well, they didn't have like, so their plate, too, was deviated on the outside.
So you could get the shove knife over it and just kind of wiggle it around and open the door.
And it was very quick and very easy.
That's the same facility that, so the previous year we had done a similar assessment.
And they're like, oh, yeah, this year, you know, we installed dimple locks.
And, you know, good luck.
And I'm like, okay.
So we get to the server room where the new dimple locks were.
And the strike plate wasn't.
Oh, it was on the office's side.
Yeah.
So, but the lock was a bit tough because they had it kind of backwards.
It was kind of hard to explain.
So when I used my shove knife and I almost had it.
So Tim's like, all right, hold on.
And he brings his shove knife over the top.
And within a few seconds of both of us like pushing our shove knives in there, we were right in the data center.
And so that picture, I think it's a couple slides.
Yeah.
Back.
Let me see.
Where is it at?
So that was on the other side of their, you know, new dimple lock door.
So that was, you know.
That's where they had their security stuff, inside the data center.
All right.
Let's see.
Go ahead.
So oftentimes if we're not able to clone badge or anything like that, we'll just make fake badges.
And we talk about this a lot in our talks.
We'll just, these are kind of the dimensions.
But we'll just go to our hotel.
We have a little printer.
We'll get some blank HID badges or whatever, PVC, if we see that they've got that.
We'll print them on PVC.
But we ended up, you know, just Photoshopping our badges and making some generic badges.
You know, we gather this information during the pretexting and kind of our passive reconnaissance when we're driving around.
Oftentimes we'll go the day before.
And as people are leaving, we'll drive by the facility or go around the parking lot because cars are coming and going.
And we're not sticking out at that point.
And then we'll get a good look at their badges.
Go back to the hotel.
Play arts and crafts.
And then, you know, make some fake badges that we just piggyback and tailgate in.
Because that's the easiest thing.
You don't even have to have, you don't have to have like a Proxmark 3 or some badge cloning or repeater or anything like that.
It doesn't have to be fancy at all.
You just walk in behind people as they're coming up.
Yeah.
And one thing that we love are company barbecues because, you know, social media like, oh, let's show how cool our company is.
Put pictures of the barbecue online.
And they do.
And people are wearing their badges.
And so we Zoom in.
And we usually try to schedule our assessments around that time.
That way we can have some barbecue before we get into the facility.
Yeah.
Seriously, two times we've gone to companies and they've had the barbecue.
So we've gone into the barbecue, fed ourselves, and tailgated in right in.
So that is not a joke.
Oh, we should have put that picture.
Oh.
Because it was like they had this big thing, you know, synergy.
Yeah.
So we had our barbecue.
We tailgated in.
And they're like, do you guys want a group photo?
And we're like, sure.
So Tim and I.
I thought we were employees.
So we're standing there.
And it's an actual, like, employee.
And I guess he kind of got caught in.
He didn't want to be rude.
You know?
So it's Tim and I and then an actual employee.
And we're like this.
You know?
It's like synergy.
And I was like, whoa, dude.
Yeah.
It's like, excuse us.
Yeah.
Yeah.
So it was so funny because, you know, and it worked out perfect because we didn't know that.
The barbecue was going on at that time.
It was just like, you know, a free gift for us.
So.
Free food.
So, you know, we had free food.
We got, you know, free entrance.
And we got a photo, which they printed out on the spot.
So it's our cool little keepsake that we have now.
So.
We included that photo in the report, by the way.
Yeah.
Yeah.
And that was the reaction right there.
It was great.
It was perfect.
Any friends?
Friends?
Fans?
Show friends?
Show friends.
Yeah.
Some of you guys.
You guys are all friends.
Yeah.
Yeah.
I'm Ken Adams.
So, yeah.
And then I know Tim uses Mr. Robot.
What's it?
Elliot Alderson.
Yeah.
Oftentimes I'll put Elliot Alderson on the badge or like Bruce Willis or something.
Stupid.
Stupid.
Like if I'm trying to get caught.
I mean, I'm not going to do this if it's covert or I'm really not trying to get caught.
I'll use a legitimate.
Yeah.
Co-worker Drew Culbertson, he always uses a picture of Alec Baldwin.
He kind of looks like Alec Baldwin.
Yeah.
So we're like, we're going to use Alec Baldwin's face on here.
Okay.
We'll talk about overt assessments.
As we already mentioned, this is where, you know, you're being escorted by the client.
So you have a lot more freedom.
So something like an under-the-door tool that's usually, you know, very loud.
Has anybody used an under-the-door tool in here?
They're loud, aren't they?
So you're not sneaky with those.
So if you try to go into a room and you don't know what's on the other door, I mean, or
on the other side of the door, just imagine like, what the hell is going on?
You know, it's like you're in a room and you don't know what's on the other door.
You hear this loud scraping and it's like, yeah, I'm maintenance.
I'm fixing your doors.
You know.
But anyway, you have a lot more liberty to try that or bump keys or something, which
we kind of, we don't really recommend bump keys because those are destructive.
Yeah, we don't really use those anymore.
But, you know, the thing that we do with the overt assessment is we have a checklist that
we make.
Basically, it's just best practices for things.
We don't, we're not doing like, you know, compliance junk.
We're just saying, here's what we normally attack.
Timeout.
Compliance is not junk.
Compliance is not junk.
I'm sorry.
Sorry, go ahead.
That's why I do my pen test.
What's that?
You mean the bare minimum, right?
Yeah.
Yeah.
Yeah.
Limited number of flare for these guys.
So, we'll use this checklist.
I mean, just kind of go through.
But we also demonstrate tools.
I was kind of saying before in that video.
In this picture on the left with me and my awesome man bun, we're using the under the
door tool, showing the client, hey, here's how we got into here.
And we're going to show you how we got into here.
Because they didn't know what it was and it just blew their mind.
The picture on the right is funny because the request for exit sensor is there.
We found a
Can you see the steam?
Yeah.
I don't know if you can see that.
The steam.
Right here on the side that's shooting through the door.
Sorry.
Go ahead.
Quit interrupting.
I'm a jerk.
Yeah.
Now, we found some canned air and we ended up using that to bypass the request for exit
sensor.
So, we had a gap there.
Turned the canned air upside down and just sprayed in there.
It was enough to try.
So, that's us doing that.
On the bottom is us opening the door.
This was actually the same exact spot that as soon as we got into this area behind this
door over here.
And this is overt, by the way.
This is after we had already done the covert stuff.
Well, when we had broken into this before, a guy, during the covert stuff, a guy comes
up to Tim and he looks at him and he's like, let me see your badge.
And Tim's like, okay.
And he goes, you're not an employee.
You don't work here.
And Tim's like, yeah, I do.
And he's like, no, you don't.
Let me see your badge.
And it was just a paper badge on top of an actual badge.
We did it really quick.
So, we just had to print it off like very quickly and arrive there.
So, we just shoved it on a sleeve.
I didn't even have like an HID or hardback or anything like that.
So, just kind of.
Yeah, just a piece of paper slipped in.
So, the funny thing was this guy was so sure he was catching us.
I think he knew we were going to be there or something.
But he was like, that's not a real badge.
Let me see it.
So, Tim's like, all right, here you go.
Rips up the badge in front of Tim.
Hands it back to him.
And then walks off.
No joke.
That's it?
So, that went in the report.
You know, thanks, jerk guy.
There you go.
Got your name on the report.
So, not that we try to single out people or anything.
But, you know, come on.
You come to find out this guy was an exec, too.
So, he didn't know who we were.
He was like, you don't belong here.
He wasn't in the kickoff calls.
He wasn't in any of the preliminary planning or anything like that.
He was just the guy that was like, you've got a man bun.
You don't belong here.
Yeah.
But it was so odd because I was like, okay.
We're done.
Thanks, Tim.
He didn't do anything bad.
But, you know, it's like, all right.
We're done.
And then he rips it up and hands it back and walks off.
And Tim and I are just like, seriously?
Is he coming back?
Can we?
Okay.
Let's keep going.
So, we did.
For like two more hours.
So, yeah.
Thank you.
Oh, those requests for exit sensors, you know, you guys have probably seen the videos
like Debian Olimp using Whiskey to open it.
Right there.
Yeah.
Dave Kennedy.
Yeah.
So, yeah.
We are going to be using the device.
We're going to be using a vape.
You know, some of them are kind of the neat heat.
So, you're going to get more creative with that like hand warmers and stuff like that.
Yeah.
Hybrid security assessments.
We're not going to go too much into this.
But basically what these are is a combination of both covert and overt.
If there's a large facility or there's multiple facilities, sometimes they'll say, hey, on
this facility we want you to covertly try to enter.
And on this next one we want you to walk through and kind of repeat what you did but with the
client.
We're not escorting you.
Yeah.
You know, you don't repeat the social engineering in this, but this is mostly like the physical
stuff and how we got into the facility.
And then oftentimes it will be social engineering if we go back and revisit the facility that
we just compromised.
So, they'll be like, let's go through.
And then we'll walk past people we just lied to and convince them to do stuff.
It's an opportunity to discuss things with them.
It's an opportunity to kind of blow up their security awareness to be like, hey, yeah,
so these guys are here doing an assessment.
I think you met them.
And yeah.
And then we say, yeah, we're the guys that lied to you and stuff like that.
But here's what you did a good job on.
Here's what you can improve on.
And it's a security awareness training in addition to.
So, that's kind of what the hybrid assessment model is for us.
Yeah.
And then, you know, if we also obtain creds from doing a web app assessment or an external,
then whoever's in charge of that will say, you know, hey, here's a set of usernames,
passwords.
That way if you get inside, you can try to log in, you know, to the domain or whatever.
That's like partial disclosure.
It's not like you're not going in blindly.
It's not a black box kind of assessment.
When is it appropriate to keep pushing?
So, we're talking about being bold versus safe.
It's appropriate when you get to that point where you're like, okay, I've exhausted all my efforts.
I've done what I can.
I have all of my stuff.
Now what?
I'm bored.
This is one of my favorite stories, Bo.
So, we're walking around.
You'll see a security guard there.
I wish I could, like, unhide her face because she's cracking up because I'm such a funny man.
So, this is her and those are her hands.
And in a minute you'll see why that is just so bad.
So, I walk over to her and I was like, yeah, he had a fake contractor badge on.
Or, no, I had a fake contractor badge on.
He had a fake employee badge on.
Yep.
Because when you don't look like you belong there, like, I was growing my hair out for, like, a role.
And I didn't look like I belonged there.
It wasn't ‑‑ it didn't adhere to kind of their dress code.
I had a beard.
But I'm a contractor.
So, it's a little bit easier to do that as a consultant or a contractor.
So, Brent had, like, a suit on or, like, a button up and some nice outfit on.
So, he was ‑‑
Thank you, Tim.
He looked good.
He was escorting me around as a contractor because I was there doing their policies on how they handle badges and keys.
Yeah.
It gets awful.
Yeah.
Wait for it.
I walk over to her and I was like, hey, yeah, we're doing a ‑‑ I think it was off the top of my head.
So, I was like, yeah, we're doing, like, an S853 enterprise security assessment.
And we're just kind of looking to look at some of your policies.
Specifically, I wanted to ask you more about your employee replacement badges.
Yeah.
And I jumped in.
You know, it's fine.
Security guard name.
Insert here.
Elliot is with me.
And it's fine.
He can ‑‑
He signed an NDA.
Yeah.
And she's like, oh, okay.
Yeah, it's only going to take a minute.
Okay.
Sure.
So, how do you handle when employees forget their badges at home?
Well, in fact, we have a binder here.
And all of these badges are active.
And they can get around the facility.
And let me show you.
So, she drew a huge binder.
Probably had, like, 50 badges in it.
All these active ‑‑ I think they were called, like, replacement badges or whatever.
Yeah.
One day badges.
That she gives to the employees.
And they sign their name.
They put the badges in.
They put the badge number on it.
And that's how they track it.
And they have to return it at the end of the day.
So, I'm like, oh, okay.
Well, I'm just going to go through here and kind of do inventory and get the numbers off
the back of them.
And she's like, oh, okay.
And Brent's like, hey, Elliot, that's probably going to take you a while.
Yeah.
It's taking you a while.
Do you mind if he sits down?
Oh, no, that's fine.
Come on.
So, she lets me come around the security guard desk and sit down beside her.
So, we have a picture that we couldn't show because it would, like, you know, reasons.
So, basically, Tim, you can see him on the left behind the security desk opening the binder.
You see her, like, oh, let me show you where the contractor badges start.
And then we also have a picture of him, like, leaning back with his feet propped up on the counter while he's sitting there.
That's when I started being absurd.
I don't do that.
So, as our clients, I don't just go drop my feet on the security guard desk.
Reminder of this the whole time.
Set it down.
Pick up another one.
The whole time he's, like, you know, creeper look.
I'm just talking to her.
She's happy.
When you're going to say something, you know, awful.
So, this is good.
This isn't good.
So, this was good, right?
What isn't good is when the security guard comes over to you and is, like, what are you doing?
I'm supposed to be here.
Or I'm doing whatever.
Testing the physical security latches or I'm looking at your sprinkler heads to make sure that there's a recall on them.
Yeah.
So, no.
What are you doing here?
And the security guards get angry.
Yeah.
And they want to punch me in the throat.
So, at that point, I'm going to change my tactics, right?
I'm not going to sit there and just keep using the same line.
And we're going to get into this.
And I may be jumping ahead, but I don't care.
We use a fake letter of authorization quite a bit.
If you've heard our other talks, we discuss this.
So, basically, what this is, is we have because when I first started using this, I thought, well, if I were a bad guy and I wanted to get into a facility in the middle of the day, I'm going to do this.
What would I do?
Well, I'm here for a security assessment.
I'm with whatever.
So, what we do is wrote up a fake letter of authorization.
On the top, it's got the White House's address.
Yep.
And it says, it has our company.
Like, I think we were calling ourselves, like, I don't know, Fish Nugget Security or something.
Yeah.
Yeah.
Fish Nugget.
Yep.
And through it, it has Brent's name at the bottom as the point of contact.
He is the CISO himself from this company.
Still has the CISO.
I haven't received a paycheck from that company, by the way.
I've got Easter eggs hidden in it just to make sure that they're paying attention.
And this is how we also test our incident response, too, or their incident response, rather.
Are they following up?
Are they doing their due diligence?
Are they calling that point of contact?
And is that point of contact indeed the person that would authorize this?
Do they even work there?
So, that's kind of what I use when security guards get angry.
At one point, I was picking a lock.
I didn't hear this guy.
Really big guy, which surprised me.
And I was sitting there.
I'm trying to get into this door.
And it comes up behind me.
He's like, what are you doing?
Turn around.
He's armed.
He's like, oh, hey, buddy.
And he's like, what are you doing?
I was like, oh, I'm testing.
He's like, I'm with facilities.
I'm helping facilities out.
We're going to replace these cores.
And we just want to make sure they're good.
Just off the top of my head.
He's like, no, you're not.
I'm like, all right.
He caught me.
Here's my letter.
And I give him the fake letter of authorization.
And he reads through it.
He doesn't even look at it.
He doesn't read through it.
He glances at it.
And he's like, oh.
Well, cool.
And he gives it to me.
And I've told this story before if you've heard some of our other talks.
But it's hilarious.
And it's part of our security guards LOL talk.
He goes, oh, OK.
Here you go.
You can have it back.
Actually, I'm with security, too.
And I was like.
Yeah.
Now they're buddies.
Yeah.
Obviously.
You are with security.
Now we're buddies.
We established a rapport.
And I was like, well, you know what, man?
I'm going to be here for a couple more hours.
Could you do me a favor and let the other guards know that I'm going to be testing some
stuff?
That way they don't bother me.
He's like, oh, yeah.
Sure.
Right away, sir.
Yeah.
Score.
It's great.
Or, you know, something to keep in mind, the fake letter.
So if you do get caught and someone's like, what are you doing?
You're not supposed to be here.
And you're like, OK.
Here's my letter.
And they look at it and they're like, nope.
You don't work at the White House.
What are you doing here?
If you try to pull out another letter.
So, yeah.
I got another one, too.
It's like David Copperfield.
How many do you need, sir?
But that's seriously something that you can do.
Something to keep in mind because it could go really bad.
And you strongly want to encourage them, look at the point of contact.
You'll see that that is legit if you have to go to your global directory and pull up
their phone number and call them right now before you call the police.
Yeah.
Please don't shoot me.
Please read.
Or I'll read it for you if you can't.
I mean, you know.
That was awful.
Why did I say that?
Wow.
Yeah.
And squirrel.
Yeah.
So let's say you do get caught.
And I'll try to keep on track here.
So you do get caught.
You know, it's okay if you get caught.
If you're supposed to be there and you get caught, it's okay.
It happens.
So don't try to be cool and run away from the security guards.
Parkour.
Yeah.
Because all they're going to do, hey, we had a guy that wasn't in here.
Police.
You know.
This is what he looks like.
Go find him.
Now there's a manhunt for you.
So then if you get arrested by the police or worse, you know, then you've got all this
explaining to do.
It's like, okay, well, if you were supposed to be there, why are you running?
Why were you running away like an idiot?
So if you get caught and you're supposed to be there, say, okay, you caught me.
Like Tim said, please call the number.
I'll comply with whatever request that you make.
You know.
And it should deescalate the situation.
You know, and it's awesome if you're like some, you know, incredible parkour person, right?
Great.
Use that to get to places.
Don't use it to try to get away.
Because there's a risk.
You're going to hurt yourself.
Somebody's running at you.
They're going to slip and fall.
Or down the fire escape or something like that.
If they're armed.
Yeah.
You're not.
You didn't do anything wrong.
So there's no reason for you to run.
When you're caught, you're caught.
Right?
Yeah.
So yeah.
Just use your brain.
Don't try to be cool and manhunt and, you know, five stars on Grand Theft Auto and all that stuff.
So not worth it.
All right.
Let's see.
I think we've got a few more minutes.
I want to make sure we have time for questions.
Yeah.
Again.
Don't do that to my boss.
Squirrel.
Yeah.
So lockpicking bypass methods.
So make sure that you know what you're doing before you go inside.
If you don't know what you're doing with lockpicking and you're nervous and you're trying to get in somewhere and you have no idea about how to use the tensioner and all that stuff and you break it.
Breaking the crap out of it.
Yeah.
Or you break it off in the lock or, you know, use bump keys and damage it.
All that's going to do is upset the client.
And you're going to have to, you know, pay to replace that and all that stuff.
And, you know, you look stupid.
So just know what you're doing before you do it.
So same with running exploits and stuff.
Well, the same with social engineering, too, right?
Yeah.
If you're not good at improv or lying to people, maybe practice that before you go inside.
Before you sweat.
Yeah.
Hey.
Let me .
Yeah.
I'm good.
I'm Todd from accounting.
Yeah.
Or you walk up.
No, you're not.
Walk around.
Sir, can I help you?
No.
Yeah.
It's like they caught me.
Yeah.
They're really good.
They're very secure.
Here's my letter.
Call my mom.
Yeah.
Exactly.
He was really good at interrogating me.
I buckled him.
Yeah.
Yeah.
Yeah.
That guy was good.
He had a knife to my throat.
I promise.
So, yeah.
Talking about improv and stuff.
When we do our recon, we always pack several sets of clothes, whether it's suits, T-shirts,
or whatever.
Just do your recon.
Figure it out.
You know, you want to fit in.
The dress code.
Yeah.
Figure out the dress code.
And then if you're not good with lying to people, go sit down at the mall next to some
random stranger, strike up a conversation, and never tell them the truth about yourself.
Or do it during DEFCON.
That's a perfect place to do it.
Yeah.
Oh, yeah.
Like total BS.
I'm calling.
I'm from Dublin, Ireland, and I'm here, blah, blah, blah.
Yeah.
Yeah.
You know, and it's like you just make up stuff, and you just practice rolling with
it and filling in the gaps and letting them fill in the gaps.
Oh, you have an accent.
Where are you from?
Guess.
Yeah.
Guess.
Yeah.
Yeah.
Guess.
You're right.
My name's James.
I'm glad you guys could come.
I'm going to talk to you about how I'm the four-time world NBA slam dunk champion.
And, yeah, so we'll talk about the training and stuff.
Yeah.
That is.
Yeah.
That's a far-fetched lie, man.
So, and that's the reason I say that.
It's like, you know, don't be an idiot about it.
Right?
You know, we also talk about improv quite a bit in our talks as well.
You know, I think it's great to go into an acting community or some kind of acting guild
or group, an improv group, practice.
That is perfect for social engineering, and I think most of the people in here would probably
agree with that.
I like, I do a lot of acting and stuff, and that has helped me tremendously.
I was actually a street magician, too, and that has helped me tremendously with these
things.
And a stripper.
Huh?
Nothing.
What?
Nothing.
What?
And so that helps contribute to the manipulation, too, and being able to just roll with the
punches and lie and like it's natural.
Yep.
So.
So, I know we have a few more slides, but it's mostly to talk about, you know, what's
the main, what's the main point of the assessment?
Is it to get into the domain, the, the.
Data center.
Data center.
Yeah, not domain controller.
It's internal.
Oh, that's.
Anyway, so is it to get into the data center or is it to get to, you know, employee files?
Yeah, or is there something that's even more sensitive to this company?
So make sure that whatever you're going after that you understand what would be the worst
thing to happen to this company and go after that.
It's not always the data center.
Could be, but it, you know, there could be things that could be a lot more detrimental
to the company.
You know, and another thing to consider, too, when you're doing these kinds of assessments
is, is, they're not safety assessments, but keep that in mind when you're doing them.
If I were somebody wanting to hurt a bunch of people.
Then how would I do that?
Okay, well, I've gotten in here.
They let me in with a bag.
A huge bag.
Or they let me in with this.
I got into this area.
You know, where the power supply is.
Or the backup generators and all that stuff.
Yeah.
Elevators.
You know, think about that kind of thing, too.
Not just, hey, I found a, a switch and I was able to plug in.
Or I found, you know, the, the network department and I was able to, to get a bunch of stuff.
And check my email.
And check my email.
And get on Facebook.
Yep.
So, again, isn't it response testing?
You know?
So is that part of it?
Yeah.
Sorry.
We like pictures and GIFs.
Yeah.
Yeah.
So, you know, if you get in somewhere, you know, how absurd do you have to be to give
them the benefit of the doubt to see, okay, what do I have to do to get caught?
And then once you do get caught, you work backwards from there to help secure, you know,
help strengthen their security posture as far as physical goes.
So.
You know, and also, like, with this incident response stuff, I know we kind of talked about
that quite a bit.
But it's, it's also important to ask questions.
And even before, during the kickoff call, say, hey, what is your procedures?
How do you guys do this?
And then compare it to what they actually do.
Yep.
Are they actually following escalation procedures?
Yep.
Practical versus impractical.
I know we only have about two minutes left.
So sorry for having to speed through this.
But if you are on site and you're trying to be covert, you know, it's probably not the
best to wear some gigantic tactical bag with Hack the Planet stickers and stuff all over
it.
So.
Looking at you, Jason Street.
Yeah.
You don't think he's in here right now.
But.
Just be mindful.
Like, I know whenever we're going on site, if it's a more professional thing, I have
a leather, sounds stupid saying it, but it's like a briefcase.
Yeah.
But it's leather, you know, that opens.
And I use these gridded things.
So I have a few of these.
And so it's like a filing system for either my backpack or the little side bag that I
have.
That way, if I need to grab something really quick, it's all right there and I can just
get what I need.
And I'm not having to dig through a man purse.
The same thing with lockpicks, too.
Like, I had this made just so I could easily access it and then have different tools.
So it's handy to have that readily available.
Oh, sorry.
It's handy to have things like that readily available.
That way you're not unzipping your southward lockpick set and dumping tensioners all over
the place.
Oh, crap.
Excuse me, officer.
Let me find my single pick first.
Yeah.
That doesn't go over well.
But, you know, it is great.
I know we only have a couple minutes or a minute here.
And so it's really important that you guys, when you're doing this, you get a proper bag.
You know, we jest about the patches and stuff.
It's great to have patches and stuff on your bag when you're at cons and walking around.
But when you're actually on site doing these assessments, they are loud.
Unless you want attention, then it's probably best to avoid that.
You guys can go back and look through all this.
Yeah.
Pause the video.
Sorry.
Here's some Red Team Toolkit examples.
These are kind of what we have in the bag.
If we go back to this first slide with the image here, all of that fits in that little
bag there.
And there's tons of little gadgets and things there.
And a PEZ dispenser.
And a PEZ dispenser and a Game Boy.
Yeah.
Miscellaneous considerations.
We'll let you guys review that on your own.
Some travel tips.
You know, things you can consider.
Keeping some TSA-approved items.
Yeah.
Don't, you know, know what to bring in, what not to bring in.
And, yeah.
We're rushing.
Yeah.
So we'll...
Yeah.
We're good.
All right.
So we'll hang out outside.
If you have questions, let us know.
Thank you.
Thank you.
Thank you, guys.