bryce is from rendition more happy to
say that rendition is a sister company
to black hills information security they
also do a lot of sock really if you're
looking for a good defensive company
kind of managed look at your logs and
detect the tax rendition is fantastic
and then this particular presentation i
was a little bit sad whenever I read the
write-up for this particular well I'll
just give you a heads up breaking into
banks like a boss breaking into banks I
think is one of the most exciting things
in pen testing when you do it for the
first couple of times but after about
the 15th or 20th Bank he starts getting
a little bit scared and then anything
beyond that you just want to curl up
under your bed and hide so to help
people get to the point where they're
curling up and hiding under their breath
beds Bryce is gonna take us and talk
about how we can get to that level of
paranoia so take it away sir
how I appreciate it yeah thanks for the
introduction they're definitely spot on
this this talk will definitely you know
I I actually talk about it like I have a
slide in here where I talk about where
I've done physical princess and then
with several clients now where I've done
remediation testing right testing them
again and well we'll get into that but
yeah definitely definitely makes people
curl up like a balls ball so anyways
we're situation awareness here this is
very difficult for me especially being a
professional a social engineer right I
need feedback I want to see people's
faces and then being like oh yeah I
understand what you're saying or have
that confused look so I can be like okay
let me let me read you know re-explain
this for someone so this could be a
little difficult you know especially the
dry air whenever I lay out a joke you
know typical life all my jokes suck but
hey we're gonna push on so yeah thanks
for thanks for joining me really
appreciate it
thanks well what's a confess for having
me definitely very cool and then yeah
San Diego looks a lot like my my house
so yeah all jokes aside they've done a
fantastic job with with this with this
conference making it virtual it is it is
just really cool sure that's gonna be
the future definitely pioneers rock on
this is this is very cool so yeah an
overflow of gift reactions III think
that would I think that I do a little
bit
appreciate it appreciate yeah yeah might
be the founder I'm a little young but I
might be the founder of the bad jokes
Club I don't know it's not really bad
jokes it's more it's more just just bad
jokes
I like bad jokes physical pentesting
social engineering breaking into banks
like a boss let's get started so Who am
I so I'm bright self that's my twitter
handle you underscores be selfless I'm
our physical pin test lead a tradition
InfoSec I'm also our custodial engineer
if you will so I'm just kidding I do a
lot of things with renditions hadn't
been with company for quite some time I
absolutely love it learn something every
day and it's just a great big company to
work for so so prior to that was in the
US Navy I was a CT Intel guy I know it's
an oxymoron now being in the military
and the military Intel and and then and
then just me it's just it's yeah it's
it's no fun and then I was in some other
stuff you know thriller it free other
agency that kind of thing so you know
take a port it's work and then whenever
whatever I'm not doing these talks I
like the camp like motorcycles doing DIY
stuff and then and then breaking into
your office that's one of my one of my
favorite things to do so I'm with a
rendition InfoSec that's the twitter
handle up there so so like John said we
do with digital forensics instant
response we do obviously Red Team and
pin testing as well audience s-mint
straining sacraments whirring all that
fun stuff and then we're MSSP 24 by 7
sock in Augusta Georgia our headquarters
and then there is our ambulance that
attacking macaque face that's that's
real that's not photoshopped that is
actually a rolling cybersecurity
Enhancement unit so it's pretty fun we
try to bring it out to a couple cons and
if you have a good time run CTF out of
it it's really cool so where we go
together talking about so this kind of
the overview we're gonna be talking
about physical security and and pin
testing what it is why it's important
especially to me but not only myself
right being a cyber security
professional here but also to to our
clients and then also you as a stake
holder where you might be invested in
this company right the super important
has some common misconceptions so as
I've been doing this as a professional
I've come across some things right I've
come across some people that don't
believe I do what I do or I can't
believe how I did it or just flat-out
deny it or don't know how I did it right
so so you're gonna go over a couple of
those things really really fun and then
and then I'm going to teach you guys
basically how to do it
how to understand this physical
intesting art if you will because it's
definitely not science right and how to
understand it how to do it yourself
and to apply why legally if you if you
do this don't do this don't do this
illegally there is a certain point where
you get into some some illegal areas
there's some some lessons learned what
I've learned along the way kind of what
I've changed in my ways have gone about
breaking into two buildings in just kind
of learning from from however many I've
done along the way
and then how to stop me obviously if you
can take anything from this talk it's
that it's that slide right there is how
to prevent someone from getting into
your building because it's sometimes
just it's just super easy for me to get
in and it's as easy for me to get in as
it would be easy for one of our clients
to be able to put something in place and
basically prevent me from giving it and
then we're gonna go over some frequently
asked questions and then we're gonna get
into two questions well Rob joy said it
best don't assume a crack is too small
to be noticed or too small to be
exploited well run networks make our job
hard whenever I do my physical pin
testing just like I know we have hackers
you know our keyboard guys I'm doing it
the exact same way if I find something
small that low hanging fruit something
that someone says oh there's no way
they're gonna actually do that and they
don't do anything about it that's the
way I'm getting it right so you just
want to make sure you're constantly
checking up on these things because you
know just never take it for granted
never get complacent and adversaries
going to take care take advantage of any
opportunity that they have try to your
physical assessment to define it
physical pin test is to measure the
strength of existing physical security
controls and uncover their weaknesses
before bad actors are able to discover
them or exploit them so what are we
doing we're doing a B&E right we're just
breaking into a building on in my case
it's legal right what we get paid to do
however it doesn't matter if I can get
into a building right it doesn't matter
if I can steal certain things and your
server and all this stuff and and that's
all well and good but at the end of the
day how can I use this information to
basically better our clients to say hey
this is how I did it this is what you
can do to prevent that and that's the
goal because we don't want bad actors to
be able to do that through story I had a
client contact me or contact us not too
long ago and they were like hey guys I
just want to be thank you for for doing
that that physical pen we actually had
some individuals try to get into our
building intentionally to do who knows
what right and and luckily because of
what rendition did because we did a pin
test before then the security team was
able to stop them and prevent who knows
what right so so definitely definitely a
great great thing
so why is it important so it's super
important to me I'm super passionate
about it there's like an old wide stale
old story out here especially around
cybersecurity cons where there's a CTF
right let's take a CTF I know we have
one going on here say we have team a on
one side of the room and team B and then
you have the moderators obviously in the
center with it with the server sitting
there on the table and they go like okay
hey listen up you know team a and Team B
you guys basically need to figure out
whether vulnerabilities are in the
server and completely own the server
completely own the data right so then
team a just starts hacking away all
right they just start in a plugin way
see what vulnerabilities are there we'll
open pour its protocols all that fun
stuff any any hackers in the room this
is what you guys are gonna be doing
you're just guys just gonna be hacking
away right and then team B kind of looks
over and they take a second and I go you
know what you just said we have to own
the data right like we just have to have
the data and that's just it right so TV
gets up and they just walk over to the
server and they unplug it and then they
take that server and they sit back down
right so who actually owns the data now
right it's not team a because they can't
connect to it anymore
Team B has the data right and that's
what we're talking about is is because
that that physical part was overlooked
it's still it's still the same thing
right your hackers can definitely get
into networks and get that data but what
if I can just walk in to the front door
bypass security or whatever measures you
have in place take that server right and
then now I have the data and that was so
much easier right and quicker yeah and
sometimes cheaper my personal opinion I
think it's one of the most one of the
most overlooked areas of our industry
there's some common misconceptions right
so so I actually I actually developed
this talk there's a lot of great
physical pen testers out there I'm sure
you guys know of a couple deviant he's a
great you know great physical pen tester
but you know I heard a lot of these
talks and a lot of them are like oh yeah
we got into this building and then we
you know picked these locks and then we
you know open the safe and we use the
elevators to do all these things and
which is great and definitely an
important part of the physical pen
testing aside but one thing I did like
didn't see and I'm sure it's out there
but one
I didn't see was hey how are these
people getting into the building right
what is the process of being able to say
okay I know I'm gonna be coming in
disguised as whoever or I know I'm going
to go speak to that guard or I know I'm
gonna be coming in at a certain time
that's very calculated how did like what
is the process there right
so I basically came up with my own
process where we're going to be talking
about reconnaissance surveillance
Canaries using these things to make a
process where you say okay no matter
what kind of building it is whether it's
a huge skyscraper mom-and-pop radio
shack rest in peace or anything else
right you're gonna be able to get in
some somehow so what does that process
getting up to that door you know before
you start doing all your lock picking
and fun stuff like that some other
common misconceptions right I've had
this one from a client where they say
hey hey Bryce there's you know how about
it feel free to do your do your physical
pin test you know you're not gonna get
past the front desk right there's no way
we have lasers we have biometric so we
have 24 by 7 security guards the roving
round alarm system
we even have pressure sensitive floors
right and and even we know you're fat so
you're not going to get past those right
so I say okay challenge accepted
right guys I'm going to show you for the
first time ever actual photographic
evidence of how I get past all these
measures and in particular the the
pressure-sensitive pads
hope you guys are ready there you go so
that's me
okay so that's not me but that's a bet
yeah okay that's Tom Cruise in Mission
Impossible he's an actor but I've
actually never done this but it's uh you
know it's actually a lot like a lot
easier than this right so so yeah what's
another one I've had this one you were
lucky right I've had where they say you
know you have yet inside knowledge so
you must have talked to someone you must
know someone at a company that told you
how to get in or gave you a badge or
something I've had one one one client
where I texted him I think that night or
something or a son of an email that
night I said hey I was able to get in no
problem and they they just flat-out
denied it there was like there's no way
you could have got in there's no way you
could have got in and and got out just
no way and so unfortunately you know I
had to send send a picture just to kind
of prove that and not not so fun but but
there's gonna be people that just you
know flat out deny it but what I did is
is I actually broke into your bank these
are actual companies you know huge
physical buildings roving guards federal
banks secured secured right locations
that where people just say hey yeah no
problem
there's no way someone's gonna break in
we're just gonna really focus on the
electronic that the the technical piece
of it will put all of our money on that
trying to prevent people from hacking in
and then we'll just hire some guards and
it'll be all good and me as a physical
confessor hey do that love it but but
obviously there's more to one story on
this
I literally I got into one of these
banks got up to the floor and there was
a computer sitting right there hide the
mouse unlocked right and that's always
fun right that's that's more fun than
finding the the sticky note with the
password on it which found quite a bit
of those but unlocked this film and
actually the the password was on on the
monitor to be fair on the unlock system
and then this system would have given me
access to basically I would I could have
put in my bank information put the
amount I wanted in and and hit send and
transfer it over to me and this is super
dangerous right but if you get you guys
understand that the severity here is
it's because they they saw
because the computer was behind a door
on this floor behind guards all this
stuff they didn't they'd even think to
lock the system number one and they
didn't even think to you know take the
password away who else would do this the
only people that can be on this floor
are authorized employees right so just a
little complacency there so how does how
do I do this right what's the what's the
kind of overarching method of how we do
this so so number one is going to be
observation so so what I do here is is
basically this is where I fly into the
city you know I have my address of the
building I need to go to I'm gonna be
doing obviously some some ascent right
I'm going to go on Google Google Maps
Google Street View and and look around
and see what I can find
right I'm also gonna be getting my cup
of coffee across the street at the
Dunkin Donuts and and looking at the
foot traffic people coming in people
coming out who are they how old are they
what do they look like what are they
wearing do they have a company like are
they the cleaning company does the
cleaning company use a different
entrance right where do the employees
Park is their parking garage that they
park maybe under under the building or
do they take public transportation I do
a lot of a lot of skyscrapers and like
downtown you know big downtown cities
sometimes if they have those underground
paths that go into a parking garage
underneath and so all these things
really come into play and I just
basically sit there and look back I
don't do anything except for just
observe right and as you can see in my
picture here I don't know if anyone
recognizes this picture but this is
actually from from home alone the old
movie home alone right and you have
Harry and Marv in a plumbing and heating
band which obviously they're not
plumbers or do any HVAC right and
they're in there sitting in the span and
and you know that scene where they're
like mars-like or sorry Harry
he's like at this time in ten seconds
this this this house the lights are
gonna come on right now right and then
he says right now so he obviously got
this Intel and he knows all everything
works
he knows who's out of town all this
stuff just from observing right and and
and because they're professional well I
say professional but they're bad guys
right
which moves into the second phase is the
reconnaissance right so what we do is
we're gonna do a little bit more active
active approach here right I'm going to
enter the building right I might enter
the building and just day-night see who
notices I'm going to see if someone says
you know hey what's your business here
or something like that obviously I'm
gonna have kind of I'm gonna expect to
be challenged I'm gonna have a cover in
which we'll get into all that here in a
second but you see who notices I'm gonna
be in the back maybe dumpster diving
right looking for some sensitive
documents and if there's a camera up
there I want to know how how quickly
someone might see me digging around and
then and then you know come challenge me
right maybe maybe they're not monitoring
the cameras I can spend hours back there
no one no one says anything no one comes
back there so I'm building this
basically just this profile of this
building saying okay you know what are
people noticing what do they not notice
that visitor badges right or employee
badges contractor badges visitor badges
you see people walking out of the
building with these just hanging can I
get a good enough picture in my mind
where I can kind of fake one that that's
one of the one of the ways I you know
kind of get I get into testing policies
and procedures so if I'm not trying to
find a badge and look at someone with a
badge and copy that or imitate that so I
can come in as a contractor or an
employee I'm gonna be testing their
policies right so one of the things I do
is I act as a delivery person I have
this this fake delivery form I come in
as like 1-800 flowers or whoever the
local flower company is I'll just buy
some cheap flowers or chocolates or
something I'll find someone through a
sense with your open source intelligence
you know LinkedIn or something like that
that works at that company and I'm gonna
deliver a you know a lucky person that
day I'm some flowers and some chocolates
right from an anonymous person but what
am I actually doing right I'm actually
going into the building this gives me
some at a proper cover to go into the
building where I have a reason to be
there
I might have paperwork to make it look
official and kind of back it up and then
I'm going to go up to the front desk or
maybe I'll try to just walk into the to
the to the delivery entrance right see
if that's unlock see if anybody notices
or I'll go through the regular employee
elevator see if anybody catches me or
says anything there and then if they do
or there's no way I can kind of get past
that stuff I'm obviously a check in with
the front desk and was it fun that's
gonna be well they're gonna look at it
and they're gonna say okay yeah that
person works here that person doesn't
you know they might say okay hey let me
call that person real quick what's their
protocol whenever visitors show up do
they call them do they email them do
they just say oh yeah go on the one
upstairs which is a great one by the way
um you know do they call a four digit
extension rather than seven digits right
so that could tell me okay they're
sitting in that building is they dial
four numbers right you can listen to it
or obviously look over the best to see
if but you know what they're typing do
they do they call ten digits right that
would be a cell phone number so so I
know if they have cell phones or if they
just have desk phones and and you'll see
where all this comes into play here in a
second but but that way I say okay I
know how they're processing visitors I
know their policies of how they do this
and their procedures and I'm gonna
figure out where that vulnerability is
and I'm gonna get right in there right
literally all right and then next is
final crap right so once I have my plan
of attack once I know and I do all this
research and poking and prodding I'm
gonna go okay I know what time of day
I'm going in because I know the guards
schedule I I did my delivery in the
morning
right and and this particular guard was
there or these three guards and I
remember their faces so I'm going to
wait doing my observation and I know
that two o'clock is whenever they do a
shift change right so after two is
whenever I can come in again those
people aren't going to notice me at all
right and obviously I can do glasses and
that kind of thing we'll get into
disguise here in a second but I'm gonna
build that plan of attack what time am i
coming in what what am I dressed as
right so so naturally one thing that
works beautifully is if you can find
through through open source intelligence
there is P there in an Internet service
provider and you disguise yourself as
that you create a fake badge
I love ATI as in I love using the cover
of ATT right I have me a fake AT&T badge
I'll dress in a dress up as business
casual and I'll have this cover story
that's just incredible I'll have fake
documents
and I'll just basically say you know
through a fake letterhead on their of
the company and I'll say hey you know
this company there they said that they
sent us a memo obviously we work for
them they said the Internet sound or the
networking sound there's a problem
whatever it is and I'm gonna go in a
certain time and can basically sell it
right and and I'm gonna make sure I have
this all down pat everything is
top-notch and and I have this plan and
then I'm gonna I'm gonna do it right
which goes to execution all right I'm
gonna execute it right I'm going to go
do it it is time to walk the walk right
so you have to sell yourself you have to
you have to blend in you don't want to
cause a scene unless that's part of like
you know the way you want to get in
which you know that's a whole nother
thing but I'm gonna blend in I'm gonna
pretend I'm supposed to be their
business casual that shows you know hey
this guy obviously you know he's a nice
dresser right and I know that sounds
silly but that kind of stuff comes into
play
does he take care of himself is he kept
these kind of things will basically make
a person like you more right with I'm
all dingy and you know maybe smelly or
something like that
obviously could be like hmm I don't know
right so so if you act like you're
supposed to be there and kind of look
like the typical employees that they see
their guards gonna be basically down a
little bit right basically be helpful
right extroverts are great at this so if
I'm helpful and I say hey I need I
really need to do this thing I need to
go up to the to the top floor that or
the server room or or whatever it is
networking connectivity is kind of bad
they I need to get this done before the
morning they're gonna say what excuse me
they're gonna say well you know I can
like I can't leave my desk but you just
kind of got a I guess I can give you a
badge maybe and be like yeah that's no
problem I don't want you to get in
trouble hey I don't want you to get in
trouble I don't want you to leave your
desk just give me a badge I'll be quick
hey no problem and then they go oh
you're being helpful to me right I'm
helping them out right because they're
helping me out so hey no problem right
the funny story on this one of the one
of the clients I I had they said you
know hey sorry we can't let you in by
yourself we're gonna have to get someone
to escort you we don't have any badges
that we can give you we're just not
really allowed to do that after a
certain time hey no problem give me an
escort
and then guess what's gonna happen right
they're gonna escort me around and then
and then I'm gonna you know go through
and see everything hey can you take me
here can you take me here and guess what
I have now I have B guy with the keys to
the kingdom right I don't even need to
steal the kingdom if they have all their
sensors and pressure plates and all this
stuff that's the guy that's going to be
turning it off for me
it's great right so if funny story is is
I literally got the maintenance guy to
walk me around and as he's doing it he's
like you know this is actually the most
secure building here in the city I don't
know if you do that or not I'm like no
kidding
I was like what can you show me up to
your server room he's like yeah not a
problem
that one's always always fun to tell
stuff there's there's tools and kind of
tech of you know the badging and
everything like that this is more the
human element you you have to serve it
you have to sell it
other people ask in experts yeah J Hamm
I worked with J him quite a bit
definitely knows I'm an extrovert
especially when I need to be so but you
know everyone everyone enjoys their kind
of alone time introvert kind of both
throw the headphones in and get to work
so just depends but but definitely
definitely more of an extrovert so there
are definitely introverts that do this
stuff and and they just basically become
an extrovert and it's just I mean heck
this next slide right here is those
acting skills right you know that gosh
we've seen so many actors where they're
just kind of off the off like they're
nuts right but then you put them in
front of a camera and all of a sudden
they are just off the wall yeah acting
and it taking profiles absolutely
absolutely right so so yes so let me let
me go over this right all right cover
story cover for action there's two
there's two kinds there's cover for
action and cover for status you got
anybody ever heard of those so so a
couple for a couple for action cover for
status there is a difference right so
cover for status is going to be the
status the reason why I'm there in the
first place right so in the example that
I brought up cover for status would be
myself as an AT&T contractor employee
I'm there to fix things right I'm there
to oh your network you know function
right there is a problem I need to get
in and get out I have a badge I have you
know all this all this fun stuff I need
to I need to get in there that's my
cover for status that's the reason why
I'm there right the cover fresh
a little bit different over actions a
little bit different because I'm going
into the building and then why are you
actually using a lockpick to get into
that door or why are you actually you
said you're going into the server room
but why are you going into the CEOs
office right
so as a as a malicious guy because I
have to be malicious whenever I'm doing
this um I have to have a reason why I'm
doing certain things every single thing
why I'm doing it why am i taking the
starck at the emergency staircase as
opposed to the elevator right why am I
going up to the floor a floor above
where I said I was actually going to go
now that is number number one let me
tell you I am the dumbest person when it
comes to physical pin tests and what I
mean is is I act like the dumbest person
like if if my goal was to basically
distract someone right I'm gonna say
okay I my plan is to use directions
right and say hey I don't know where to
go to basically distract someone for a
long enough time so what I would do is I
would ask them directions over and over
and over and over again I would be like
wait you said three left's and then a
right and they would be like what are
you talking about dude I said you go
straight like that's it and mind you I
mean you use this everywhere right so
hey why are you on this why are you on
the floor that your document says you're
supposed to be on the 12th and on the
15th I'm so sorry I just pushed and
pushed the but I guess I push the wrong
button
I mean it's very simple but it's super I
mean it's just so funny because you just
can just being just acting dumb right
nobody bats an eye they're just like
this guy is just an idiot right and I'm
okay with people thinking thinking
nominating it because then they try to
help you right I mean let me read some
of this so yeah yeah nobody nobody who
asked right
nobody cares a lot of the times people
people will just not even bat an eye and
they will just walk through the building
and and you're just trying to find
someone I remember I was looking around
trying to find oh you're kind of like a
nympho sect Columbo right
yeah Trekkie that's right yeah I I you
know I will have I remember I walked
into this building had a thing I was
doing my delivery right I didn't think
the delivery ploy would work I
definitely use that I know we I talked
about the delivery piece as you know
recon on where I'm doing kind of poking
and prodding right to see how their
policies are but I gotta be honest
whenever I pulled up to the building and
I had my my chocolates right and I was
ready to go with my delivery or my
delivery slip and all this stuff I see
that the delivery dock doors open hey
okay so cool I'm going to just walk
through that door right and then just
see how far I can get cuz hey I'm making
a delivery that's my cover for status
right and why am I going to the did this
door specifically that's my cover for
action right and if someone catches me I
didn't know I didn't know I was supposed
to go to the front desk right hey who
cares
um so so I go right to the to the the
delivery door right I think it's like a
UPS truck or something delivering
delivering you know whatever packages
and then I walk through nobody says
anything I take the first elevator I see
I go high as high up as I can now just
start walking around right and and if
anybody stops me and says hey what are
you doing on this floor who are you all
that fun stuff I'm trying to make a
delivery to this person do you know who
they are can you help me out you know
that kind of stuff and then they'll be
glad to help right they will love to
help you and they'll just walk you
around the building so I walked around
that building for probably two hours and
no one stopped me no one said anything
except for oh I hope those chocolates
are for me right and and and they just
another one hey I think this person's a
nightie do you know where the i.t floor
is do you know where you know maybe the
server room maybe as persons in the
server room and for whatever reason this
person was like yeah no problem I love
to help people it's server rooms down
that way
right I mean it's just like I mean to
what John's saying like it makes you
just want to after the first second time
you're like okay hey that was fun or hey
I'm trying to help by but if you do this
over and over and over again and no one
has changed anything you're just like oh
my goodness
right and then you just start feeling
bad and you
you want to cry a lot of lonely Hotel
nights anyways
so bored items I think we covered a
cover of the cover story right so
support items right this right here if I
can get a nun frame here this is a
leather portfolio alright
casinos I got that I got that for a
dollar at a yard sale a dollar all right
and I fill it up with legal paper I have
pins in there I have all of my
supporting documents do you know how
important you know how important this
makes me look like like I'm not an
impressive guy okay
but you get me in a button-up shirt
right some pins maybe a backpack
obviously with all my gear in it and
this bad boy right here and I hold it
like this and I walk in I flip it open
like this and you know thumb through
some pages yeah yeah you'd be surprised
how important you look and people people
just say hey yeah no problem right so
disguise items the clipboards absolutely
Jeff clipboards work you get you a
reflective vest a metal clipboard and
you walk into the delivery entrance or
ring the bell someone's gonna go okay
hey no problem cool he's supposed to be
here I mean easy right so just little
items like that and and they're super
cheap right some other supporting items
right especially whenever I'm talking
about Cobra for action cover for status
so I carry uh so I got my wallet here
okay and then you see I got a pin and I
got a flashlight and always carrying
with me I also have my wedding ring so
what I can do is if I need to plug a USB
into a system and obviously if I'm
depending on my cover right if I need to
plug in a USB to a system whenever I'm a
delivery guy because hey someone someone
let me in or you know let me tailgate or
the back door is open I need to have a
reason why I'm under this person's desk
especially if they're getting up to go
get some coffee and then I'm in there
plugging in something and then they come
back right and catch me in the act you
have to have a plan for that right so
that's gonna be my cover for action so
what is it right well I dropped my
wedding ring or I dropped one of these
items right here and I'm trying to find
it on your desk so I literally will take
it out I'll have my USB in my hand
and I'll take these items out and I'll
toss them under the desk and then and
then whatever I need to go back hey I
can't find my flashlight and you know
you know what the thing about a
flashlight is I need it to find things
right so that's why it's taking me so
long I mean the things you can just make
up and just be just be sillier or fun
someone mentioned that improv class
absolutely take acting you know acting
skills take it in improv class acting
class whatever it is just start talking
to people in an airport and a bar
obviously not right now with the virus
don't feel close to anyone you know but
stiff-arm um I don't you know don't get
it and and just be a great liar right
just be a great liar not not to your
significant other but yeah so all right
so fun fact right so kind of what we
were talking about a lot of these people
on here I thought you guys saying you
know hey be helpful all all that fun
stuff so 1969 scientists tested the
Benjamin Franklin effect right and found
that yes asking people for favors when
you strategically is a tool to get them
to like you more absolutely right and I
think we basically covered that is if
you ask somebody to help you out I love
playing the sympathy card right hey I
don't want to be here either it's 2:00
in the morning
you got the 24-hour guard there it's
2:00 in the morning they don't want to
deal with anything right and typically
the people that work the midnight shift
or like the ones that typically right
that's that's that's the crappier ship
right it's usually the lowest level
person that just got hired and they go
hey nothing's gonna happen during the
night time you know the CEO isn't gonna
walk by and challenge you and all that
stuff so you could just work the night
shift I love coming in during the night
shift right because they don't want to
lose their job I don't want to I don't
want to be there right I'm tired too
just help me out and they go okay hey no
problem and typically they'll give me a
badge right all too often all too often
all right another another great tool is
you know George W Bush George Bush gave
us a great tool here and it is confusion
patience and persistence this guy is my
hero when it comes to fiscal pin testing
because he is so confusing in this quote
and he just keeps on going he keeps on
chugging he knows he is butchering this
so bad but he keeps on truckin right and
and this is what you have to do you have
to confuse this person
much and and and be so persistent that
they just give up right whenever
whenever I went into a building one time
basically if your virtual sock from
another area they had to basically allow
me access right there the only people
that could allow me access and I sat
there for over two hours basically
asking for permission to the point and
obviously there's more stuff to it but
but long story short to the point where
the companies like they called me up and
they said I don't know who you are and I
don't care but you need to go and do
your thing and then get out like they
just got tired of dealing with and
because I was so persistent and annoying
and just confused the heck out of them
of what I was even doing there right
they just for whatever reason let me up
right and they just gave me access I
don't care what floors you need
have at it we don't care just hurry up
and get out of there okay perfect George
Bush with a channel right so yeah like I
said if you could challenge confuse them
hey yeah I didn't know I was supposed to
be on this floor sorry I'm actually
trying to look for this person we got
challenged one time where we tailgated
them and and basically this woman
challenged us and she said hey who are
you you know you're supposed to be here
and and we use the cover from a person
that we deliver these these chocolates
to and we said hey you know we're
actually looking for this person if you
could help us out because yeah no
problem
so she escorts us and it was great on
her she challenged us and she takes us
over to the to the other lady and and
she goes hey these people are looking
for you and we say okay hey thanks kind
of wave her off she leaves and then
whenever we come up to this other
person's desk we say you know what I'd
actually know you're actually sorry your
name was yeah it's actually not you and
then we just left right guess what we
don't have our escort anymore I mean
it's brilliant right we don't have a
dress code anymore
she doesn't know what's going on
everyone's confused and we're just
roaming around now we just have to avoid
that one lady that challenges us we're
good to go
alright so patience persistence it pays
off ride the elevator we we rode the
elevator for you know I don't know over
an hour and a half two hours right just
riding the elevator getting off
following someone end right because
people love to be helpful they love to
open doors right so so write it on every
single floor get off if someone starts
looking over their shoulder you're like
let me check my phone real quick and
then wait for the next person to come in
right so be be patient be persistent
definitely helps right all right so some
lessons learned right
lessons learn whenever you do this whole
test you might be the bad guy right like
I said I've had I've had clients where
they say no there's no way you got in I
was sitting in front of you know several
several of their employees and
particularly the ones that are in charge
of physical security and they were not
pleased because they weren't aware of
the bin test right and and and obviously
my goal is to not have anyone lose their
job ever right I am going to make sure
that everything is in place right and
the company's doing what they're
supposed to be doing the policies and
procedures right but there's gonna be
people that blame you right hey you
broke this door you broke this latch or
something like that when when you didn't
they're basically trying to figure out
you know why you were so successful and
and why you know they don't want to be
blamed they don't want to lose their job
right so you're gonna have some angry
people there and just be aware of that
and at the same time that's a meeting
you know several people on the other
side of the table who knew about the pin
test they were loving it they were like
oh man Bryce you did so good right a
Google Streetview not always up to date
right
we've had several times where we will
kind of scope out the building through
through Google Streetview
you know just be obviously you and your
due diligence through through oset and
basically see that the the building is
covered in construction right and and
they're working and and all that stuff
and but then whatever you have to show
up on site the building's complete and
maybe there's a new restaurant
downstairs that you didn't know about so
you have to be flexible on that you know
on that regard
things change and then sometimes it's
the opposite so I'm sure oh yeah I could
I can definitely use this Dunkin Donuts
that's in the lobby of this building and
I can just kind of chill and drink
coffee and then you show up and they
destroy the Dunkin Donuts
you know so you got to be flexible you
got to have it you gotta have a plan
there but sometimes it shows some
interest in interesting things OSA is in
particular with Google Streetview you
know we had a client where they the
Google camera or the you know the
vehicle took a picture of their loading
dock while it was open right and and
they were just obviously passing by and
taking pictures you know how it goes but
still if you're you know your company do
a Google Streetview of your building you
know see if there's any badges that are
being displayed any any doors that are
left open you know any kind of sensitive
information where you might have to
contact Devon hey can you guys come take
a new picture it can give you a new
picture or don't use this or black it
out or you know whatever the case may be
so leadership leadership CEO CEO CFO
they don't always sit on the top floor
sometimes it's it's four floors the full
suite is you know four floors deep and
you right up to the top and then you
gotta walk up another floor or you right
up to the top floor and that gives you
access to another elevator that only
goes to up to the executive force you
never know and and then also IT you know
sometimes ite sits in the middle of the
building typically but I'll tell you
what's great is you know usually
everything's nicely decorated so
whenever you pop up on the floor and you
say hey this has marble floors and all
the other ones were just tile I think
I'm on a pretty important floor right I
want to get off on this floor and check
it out and then and then you might have
four where hey you hear loud servers
that's always a nice tell as you know
you hear loud servers whenever you get
on a floor and you're like okay this is
where I want to be as well and then when
in doubt there's usually a building
directory somewhere laying around I
snatch those things up and I just start
reading it like a book come on all right
yeah we're gonna go to 13 now and we're
gonna go oh it's it's great oh and I
guess floor 13 doesn't really exist
sometimes sometimes it's for teens just
be aware that they're doing these I know
I was talking about remediation testing
and several of our clients have done
remediation testing where I got in the
first time and they say okay Bryce hey
okay cool you were lucky like you did it
but you're not gonna do it again we're
gonna do it this year again and we're
gonna fix some things we you know you
you were able to lockpick your way up
through these floors you know you you
bypassed security because you showed
them a fake badge real cool but you're
not gonna be able to get in here at this
time well that's all great but whenever
I came back the second year I actually
hit um worse right I convinced the the
person that the front desk person to to
give me a badge right using the
contractor the contractor cover so hey
that was great and and you know multiple
clients like that I'm still batting a
thousand right I'm batting a thousand
and as far as I've never came across a
building I haven't been able to get in
and then I'm batting a thousand all my
radiation testing right now where I give
clients the tools they need and and
they've they've implemented some of them
but here's the thing I find another way
to get in right
I find another vulnerability and I'm
gonna use that as well so always
constantly improving but sometimes I hit
a rule that worse and they're not too
pleased with that and then so my
foolproof way I call my foolproof way is
is that contractor adds you know and
pretending on Who I am you know I
obviously get in a couple different ways
but that's always a great one especially
when these buildings are set up the same
but when in doubt hey just tailgate done
right do it the old-fashioned way just
tailgate in I'd love to cause the scene
you know maybe yell or scream or trip or
something and everyone looks at you
right even on the cameras they all look
at you and then your buddy goes goes and
follow someone in or jumps over the gate
or something like that so when in doubt
just tailgate in and hey your glass
doors
you know they look pretty I know I know
a lot of buildings I've been in they
have these glass doors and they look so
good but but that does nothing for your
security right especially if I can get
to that floor I can peek in there I can
see that it's a wreck sensor or magnet
magma core or any of the following right
or I can come up under the door and use
it I mean come on they're nice but they
they're just for security they're just
silly
like I said still batting a thousand so
come at me if you want so how to stop me
how to stop me so so these these
training policies build them out make
sure they're there you know take this
scenario okay I have a building I don't
think I don't want Bryce getting in here
you know how do we process visitors who
do we call how do we do it you know did
we send them an email all that stuff and
test those right but check the policies
it's it's not the individuals fault
right I've had clients where they say
okay who was it that lets you in right
who was this person that lets you in
this front desk security person who was
working that night right and I say hey
listen it doesn't matter who it was it
could have been you were working and
sitting at that desk but my method is
the same it's never gonna change and the
way I go about it it could have been you
see at the desk and you still wouldn't
let me in because there's not a process
for it you don't have anything in place
and there's no training there's no
training for this so have that in place
make sure there's no vulnerability there
so prevent tailgating seriously I don't
care if you've been working with Joe
20 years and you've been sitting next to
him every single day from now on you
slam the door in Joe's face you do not
open the door for Joe I don't got okay
right because here's the thing Joe could
have gotten fired last night without you
knowing right and then now he's showing
up maybe they forgot to revoke his
access to his badge or they did and
you're letting him in right you're
letting him and go behind you to do who
knows what right a disgruntled employee
not always an adversary or you know your
third-party adversary if you will and
this employee wants to do harm to the
organization that just you know fired
him or laid them off right and you were
responsible for that so you don't want
to be responsible because hey you might
lose your job now or it might cause
havoc and and and shut the company down
right you never know
shut that door in that person's face
hide your badges so many times I have
I've just wondered around whether it's
their campus or downtown or something
and specially during the summertime
wintertime it's a little bit harder
because I want hazard jackets on but
they just have their badges out right
they just have their badges out and I
can and - - enough where I can just say
hey excuse me sir ma'am I need
directions to whatever I'm not from here
and I again being the dumbest person you
said three left's and a right and they
sit there for ten minutes trying to
explain something simple to me so I can
just get a good look at their badge
right and I go make a fake one and get
in that way validate all visitors with
employees right so if I'm saying oh hey
I'm here to see John strand in this
building I would expect the D front desk
people to say okay well we're gonna have
to have John Schrank come down and
verify you are who you say you are and
basically escort you around right so
that that will cut out a lot of this of
what I'm talking about
just make sure an actual employee and
mind you the employee needs to verify
who they are right with that like
contractor kind of memo that I was
referring to I'm going to put a actual
employees name on the bottom of that
that signed this memo and then I'm gonna
have a name under it or ask excuse me a
number under it and I'm gonna say hey
it's gonna say call this cell phone
number to basically verify with this
employee that price is supposed to be
here and guess who that number goes to
it goes to a rendition InfoSec employee
and then that employee right they pick
up the phone they go oh yeah
I'm client so-and-so and yep give them
whatever they need access to whatever
it's not a problem and they go okay sort
of no problem I don't want to get in
trouble so not only do you have to
verify the visitor with an employee but
verify the employee as well lease each
other definitely police each other like
I said shut people shut doors in
people's face hey where's your badge at
I didn't see your badge I didn't see
badge in and then don't provide sense of
information of the phone who's your ISP
right who's your contractor that fixes
this that the other so don't don't
provide that information I know I see a
lot of questions in here I am gonna get
to them so so here's some frequently
asked questions last two slides here
what happens when you get caught right
so you have a get a jail free card
right you get out for a get out of jail
free letter it's basically this piece of
paper that sign actually signed behind
the client in it and it basically says
hey if you see Bryce this is what's
going on he's doing some nefarious stuff
call this number the actual number and
then you know we'll verify it
now that being said you can carry around
a fake get out of jail card right
basically if I have this fake one and
someone gets challenged to the point now
before they call the cops but to the
point where they say who are you oh my
god I'm gonna pick you out you say all
right hey ma'am you caught me you did
great right here's my fake letter I
don't say fake but here's my letter all
this person that numbers gonna go to
rendition right and then they're gonna
say okay cool I'm gonna say hey I'm
gonna put you in for a raise I'm gonna
tell your boss you did great but let's
go to that server room I got to finish
out I have a job to do you understand
they go yeah no problem Jake will tell
you that you know what's really tough is
trying to explain the real letter from
the fake letter to the cops when you're
in handcuffs right so just you know be
cautious there but and so what if what
if they get out of jail letter doesn't
work just be patient try to try to
explain yourself you know you're
supposed to be there you're you're
legally supposed to be there make sure
your statement of work is you know
written out very detailed right make
sure it's it's concise of what you're
actually supposed to be doing where
you're supposed to be doing it that's
fun stuff so what are some other
creative ways to get in hey are there
any floors available for rent maybe for
15 through 16 I have this startup
business I want to invest I want to I
want to buy floors for all my employees
or I'm I'm shopping I'm a secret shopper
for Google or whoever I want to buy
these floors and they go yeah no problem
we'll take you for so you can
at least see maybe how they process
visitors how the elevators were all that
good stuff hey what are you what are you
take in mail oh we take it to the mail
room where hey how're deliveries made oh
let me show you the delivery dock right
so all these things are going to give
you this information it's a great way to
get some information there and and maybe
hey I gotta use the bathroom
okay cool yeah it's down the hallway and
then I'm gonna leave that person to go
what to do what I got to do looking for
a job same thing they're not they might
interview you right in the lobby but
maybe they take you up to the eighth
floor hey this is where you're gonna be
working let's go ahead and so they're
gonna let you in to it to an area are
not supposed to be and then what do you
do what do you look for when you get in
I obviously look for sensitive
information that would be detrimental if
it got out that I want the client to be
aware of you know PII pH I all that fun
stuff HIPPA HIPPA information accesses
right can I access the server room can
access the CEOs office can I access all
these different things and then candy so
if you're gonna be one of my clients and
you want this done leave some some some
Reese's peanut butter cups those are my
favorite and I'll leave those off I'll
do those off your desk so I guess it's
like Santa Claus except I steal that
rather than giving you gift sometimes
silly candy questions there's a couple
good ones I know sigh I know up up here
ever go on site at new construction
buildings I've gone on site to yeah I
mean where they're doing construction of
a building it is it is easy right
because they're just gonna have plywood
doors no locks or anything like that but
also remind you they might be doing
construction in the building and you
didn't know about it
so you might be like hey I need to go to
for 17 and 18 and ago that's weird like
that's where construction is going on so
you better have a cover to basically
basically figure that out and and kind
of you know stray away from there like
well maybe they met seven and eight
77019 Jeff admitting that he's pretty
bad at physical pain test that's always
fun I loved you so fun would be done
let's see what have you done to bypass
reception that requires free scheduled
appointment to lat okay yeah so what
have you done to to bypass reception or
front desk security that requires a pre
scheduled appointment to allow a vendor
or a contractor into the bank hey guess
what it's 1:00 a.m. it's a networking
issue it's an emergency they just put it
in or they
have time to put it in or they didn't
put it in right not my job so sorry
and it's just selling it right and if
they're good they say hey sorry this is
how it goes but but the thing is is then
it's okay this this security person will
say well if I don't let them in and they
said that this needs to be done by the
morning then I might get in trouble
right so okay hey okay sure you know
maybe it's just a one-off right and I've
had that too where they say hey we don't
typically do this but I'm gonna call
your your contact to make sure it's good
and then sure enough we have that
whenever we'd actually did get denied we
as in and then we you know got in
another way we did have it where they
actually called and they said you know
hey this is just not how it works
and we got turned away so so yeah stick
to your policies all right yeah hand
deliver flowers to your friends when
you're on testing and get past nerves
awkwardness absolutely yeah hey do some
practice right I just feel bad for the
for the individuals I like give flowers
to or chocolates to and then you know
they go oh hey honey like I got flowers
thank you so much for those flowers and
chocolates that you gave me today and
they'd be like yeah man yeah I did that
go problem right or it's just that
awkward conversation and hopefully I
didn't ruin any relationships there but
I love one and RFID badges help with
that type of approach stick so yeah I I
love social engineering because I just
love talking to people and and the thing
is is that's why I love physical
pentesting is because you know computers
it's one it's one or zero it's either on
or off if you're testing if RDP is dogs
you're going crazier if you're testing
for RDP you know is it open or is it
closed that's that's the only option is
it up or down with humans it's there's
that third it's yes no or hey maybe
maybe maybe I'll let you in and it
depends on the day and depends on the
person have you had any anti anti
rubbering robbery training to avoid
doing things that raise red flag
okay yeah so I've had training I've had
training like you can read my little bio
there but a basically had tactical
training you know surveillance counter
surveillance you know cover training all
that fun stuff hitting main offices and
not retail will hit satellites will it
satellite buildings will hit the main
office like a huge skyscrapers
sometimes like an off-site a dr site
right a disaster recovery site will hit
those as well and obviously the approach
has to be a little bit different so do
you have a preference for a caller ID
spoofing I don't have a preference
honestly whatever works so I'll look
into that
I appreciate that it hit me with the
link using really really strong smelly
Chinese food all over reception as a
distraction I loved it I loved it
crisp air the best can you fight me
absolutely best candy
so we're now fighting over candy is that
it well it's the it's the candy that I
want people to leave at their desk when
I get into the building as a little
treat for me you know it's a struggle
it's a struggle working at 2:00 a.m. and
a building and not having that that pick
pick me up so it does this it helps help
some candy makes everything better
it's like I hacked you but here's some
candy although I did have one customer
talking about physical pen test so like
we want you to get to the network
operation center on the third floor and
I broke in and then I started walking
around the third floor terrified I'm
gonna get caught terrified that I'm
gonna get caught walking around walking
around walking around but I can't find
the knock I just can't I just can't find
the sort of a room I can't find a closet
I can't find anything then and you know
it's the circle building so I'm walking
around walking around and then finally I
just sat down in the office of one of
the security people that had hired me
and I waited for him to come back he
walks any surprised to see me he's like
how did you even get in here I'm like
well I did this and this social engineer
my way up he goes where's I I go where's
the Network Operations Center you guys
told me to get there he starts laughing
he goes dude there is no network
operations center messing with you so
let's go that's great hey thank you so
much everyone I really appreciate it
thanks well what while was I confess
again really appreciate John thank you
yeah I really appreciate the con words
guys great feel free I'll have my you
know that the discord up a little bit if
you want to shoot me a DM any questions
or anything like that if I miss
something you know feel free to you know
hey guys really appreciate it thank you
so much