I'll Let Myself In: Tactics of Physical Pen Testers

Video Statistics and Information

Video

Captions Word Cloud

Captions

[Music] so we're doing this thing who has had a good time so far wild les a confessed who's had trouble with the Wi-Fi who's a t-mobile customers you have shit for service energy yes enjoy it it's my it's my thought that John's actual plan was just to bring us all here the most elite friends who travel the world and have no service in a place like this so we have to use an open Wi-Fi network just ponen us all as we speak so yeah many of us have fun gigs though many of us have really fun jobs people come up to me a lot and they say oh my gosh deviant you know physical security and breaking it and that's your job is so cool I like it and yes I get it right like being the break-in guy is fun if you've never met me that I run a covert entry team Robert Babak and our crew hooligans in places we shouldn't be but the funny thing people kind of romanticize this notion like yes our ops division does very dynamic door kicker stuff but for this one scene here this was a photo shoot when an article came out about what we do they were like oh yeah get some pics and get some pics in your hands right and so like I'm here picking a door now everyone has said to me I'm known as this lock picker and like maybe I've taught some of you about lock picking if you've ever seen like any of these animations that tool has on all of our slides like you've ever learned how a lock works you saw their little pins and they they bind but they push up with a key and if I don't have a key like how do I get in the lock like I've taught about lock picking forever and everyone thinks of me is this lock picker and they say oh yes so like I'd love to have that job man like that's you know you at a door at 2:00 in the morning with those picks out I wish I could do that and get paid which again like sure that's fun and I have picked locks to get into secured spaces but this shit here manipulating the pin is with like pick tools it's something like the ninth thing on the list of stuff we try to get into buildings and this whole talk is not this is like the last lock picking slide in the talk because this is not a lock picking talk I am I know hurry is what I say cuz I'm so tired hey you ready I'm so tired of talking about lock-picking I look like I love when someone new is learning it right and if someone's never done this and they get it and it's this wow moment that's fun but I gotta stop this illusion that we are picking a lot like how many times do you pick a door you don't daddy like fuck yeah Vince and you like you don't really pick doors this this shit is great that's not what we do so let's talk about how physical pen testers actually get into buildings how real covert entry tends to work and how you fix almost all of it dumb shit right like right off the bat I have not dive legit knocked hinge pins out of doors you just bang the hinge pin out walk the door I don't care how many locks are on the door if you can walk that door away from the frame walk in this is a thing that you can do with like a nail or a nice little orange tool so you don't bust up your fingers but again like all these locks on the door what you don't see your hinges hinges are on the outside of this door this is an absolute method that gets you into places and stupid easy to fix I'm giving you like easy ones off the bat here this is a security hinge the door swings shut little peg goes in a little hole it doesn't matter if you bang the hinge pins out you can trench that away from the door frame because the peg is in the hole like literally it puts it puts a block from that attack if you don't want to buy new hinges and rehang all your doors I'm huge into recommending what are called jamb pins I don't sell any of this stuff like I know some of the firms that make it but like brilliant idea what are Jam pins you have a conventional hinge take out these two screws replace them with jam pins take out these two screws replace them with fuck-all you just made a security hinge and you didn't rehang your door like two dollars I think brilliant kind of solutions easy easy stuff slipping latches and such like people see me like oh he's taking a tool out of his pocket he's gonna open that door what's he doing I'm not taking pics out of my pocket most of the time I am too if sound by the way oh no sound we're gonna need sound who's my sound guy back there let's see anybody you here all right oh well I don't know why we're not getting sound but yelled the guy in the back he's not doing anything so yeah like this is a completely locked door this is a water treatment facility this is the room where they chlorinate and prep the water for the supply and I'm not picking the lock I'm just attacking it with a little latch slipping tool you should not be able to do this on most systems right here's the door there we go is there some sound can anyone in the back turn the sound the fuck up please there's a remote oh wow this is like dad's living room but way too many buttons is that a thing is that happening I don't know whatever all right I don't care I'm gonna keep going but yeah like this little tool this little stupid hook that we've been selling in our student kits we give them to you you give them to students it's like a $5 part and it gets through so many doors what we're doing here it's not that you can like reach the latch here's a latch you can't reach with a hook because it's got that big plate over it right get yourself a big piece of wire oops the problem is not that you can touch or can't touch the latch the problem in all these bits of footage here is that the latch is not installed properly latches in a modern environment should be what are called dead latches in fact this is a picture of a dead latch well let's talk about what is it dead latch what is not well this is the latch right this is what goes into the strike plate holds the door shut if you lean on the door the door does not pop open you might remember doors that only ever have this this is what a door used to look like long time ago and then all of a sudden you started getting this extra little button sometimes called a guard bolt sometimes called the dead latch plunger has a lot of names but that extra button that I will highlight in red here that indicates that you have a dead latch mechanism the dead latch plunger or the guard bolt many people only see it when the door is open and that you know it's not always in this configuration sometimes it's next to the latch it's there's a lot of styles no matter what style you have you might not know when the door shuts that's supposed to be held back it's supposed to be pressed back into the door by the strength plate it's not supposed to pop out into the hole if that is pressed back that latch is now dead you can't hook it slip it shim it anything like that that's how this is supposed to work but the problem is door fitment if you don't have the right hardware mounting you don't have the door hung properly we see this all the time on doors man this we've got a nice door properly locked okay that's a piece of trash literally a piece of plastic garbage shoved in boom server room look at the size of that strike plate hole you could drive a truck into that why is it so huge is this the strike plate that came with this handle set what do you think this is yes I heard it say it louder electronic strike play this is a card reader access door so they retrofit the additional like the original plate of strike plate they put like a separate units a solenoid powered strike and there's all different configurations of this kind of hardware we literally know integrators and installers who are like Oh make sure you always get like the JP 41 that's the one with a big hole it always works no matter what door the client has it's no problem no that is not how this is supposed to work you are really undermining your security another door another water facility right nice lock I mean I'm I'm a decent-enough picker I'm not gonna try to pick this why not because boom bad door fitment over and over and over and like you know you don't want me in there I don't belong in this room $5.00 hook gets me in when a nice lock could have prevented me if they had properly set the door up let's talk about this kind of door fitment problem you got crash bars let's just reach through you've told stories like this forever what happened there I was like talking to point at Johnny right let's watch that again crash bar let's get a bent rod and just slip it through and bam hit the door right absolutely works the why because weather stripping is not a security device weather stripping is not the same thing as a plate or even a movable astragal of metal if that is just rubber or that brush material if I can slip something through and smack on that crash bar they make specially designed tools just for this here's Robert when our guys on our team reaching through with a reinforced tool hitting the crash bar BAM exit paddles smaller target how many times like you see glass door glass doors are wonderful because you can see exactly what you're hitting or not hitting but going back you can barely see it's a really dark photo you can't see it here easily you can't see it in the video though sometimes is this daytime or nighttime this what is it it's not it's like 3:00 in the morning I know it's a little bit white out here but it's it's very dark out this is a low occupancy structure at night what could they have done and not violated code they could have set the deadbolt it's right fucking there right well this tool there's a tool it exists for this the idea of a deadbolt again for code many of these attacks as you all know like fire code and actually egress like restrictions and allowances you have to set up doors certain ways if you have a deadbolt it probably has a thumb turn on the inside this tool exists I have it in my room this is a phone turn flipper you stick it through the door and you go broop absolutely that like these tools are out there man they are not expensive and again like here we have a nice this is a classic California office building why because it has frameless glass doors oh my god California where the weather is so nice you don't care about insulation frameless glass doors everywhere so yes reach through with the tool the hardest part was just getting it to stop slipping off the knob was so tiny but eventually sure enough you get it on there you twit it's just like a braided cable attached to it's not a sophisticated tool right but eventually BAM that's open post office near where I live you can see like right on the other side of the door I'm not gonna go steal a bunch of mail or anything but the gap is huge you could get through there Tesla dealership of course it's California why because frameless glass doors that's why middle of the night no one around I'm not saying I wanted to duplicate Tiger team and like steal a car but absolutely like frameless glass stores boom thumb turns that's the only thing preventing anyone from getting in here and the gap is like a half inch wide talk about another gap problem here's a lock door there's some noise and then dr. Tran comes through like ninja and a cloud of smoke what happened there many of you know this one already I hope this is a lab where we do a lot of prototyping and we just show it like Babak and the Hat just showed Ross and Ross is like hey building owner Evan come here I want to show you this thing I just learned so you'll see he's trying to do something with a tool up in the time Babak says no reposition it a little bit out here and look through the glass you'll see the same thing you'll see this sort of cloud of vapor and all of a sudden this lock door is no longer locked yay well who knows what government there's a very restricted government tool that they're using I don't know if you can get it like talk to someone you know who's kind of spooky you can find out how to order this it comes with a one-page idiot-proof government instruction manual that says hold tool like this so all you're doing if you invert one of these spray dusters you're boiling off that r134a essentially is what's in there and you're creating this cold gas cloud what's actually tripping many doors have sensors on the inside especially electronic lock doors they are called requests to exit sensor if you have a system where you badge in but you don't have to badge out you just walk to the door and just open it you might not realize you have a request to exit sensor you have most of the time a simple passive thermal sensor it's not the only technology out there it's far and away the most common one and if you can get that sensor to trip in this case just by blowing a cloud of gas through the door the door unlocks these are old tricks you should know them Dave if you saw his keynote this morning dave did he's a big you know vape guy is a big ecig guy oh yes so he and Ben Tenn recorded this is one of the best videos ever of it so like I don't know if you sub ohm your coils or something because he makes this amazing cloud through there but he's just listening to hear that solenoid he's listening to hear it trigger and when he knows that electromagnet is done BAM door's unlocked boom now unlocked yeah Chris up here I think it was like hey Dave you should try this on that door this is totally at we don't we don't shit where we eat right yeah this is this this was the dirty Derby class yeah yeah and like I think eventually people other people kept trying it until the point where there was staff in that because like a staff area and staff was like what's the smoke coming through the door they went freaking out I don't smoke I do drink too much my wife caught this video once we're walking home from like a bar this was late at night this is a bank the bank is closed but I'm like well there is a rec center up there and I had just kind of walked out of a bar with a drink so I just spit that through the door and like that works so yeah man passive infrared doesn't understand hot cold it just says different Oh different must be a human this one up top here the Honeywell passive infrared sensor I guarantee you've seen it or you've seen it rebranded and rebadged as somebody else's almost always white sometimes you see them in black our page you will see that everywhere all over the place and why are they calibrated this way well you don't want someone with a bunch of boxes to like banging into the door and fall over these are tuned and the installers mount them in a way to get the most wide spectrum hit because they don't want to be called out repeatedly hey the wreck sensor is not working it's not picking us up it's causing you know Mary just fell down with her cane and her Walker the Installer doesn't want that installers and integrators want to always have these things trip so you're gonna see that on a lot of doors because it's got a really good coverage and you're gonna always see it open the door what is this on the bottom though that's your solution ge is the only one I've ever seen that reasonably brings to market a dual technology wreck sensor yes it does passive infrared it also does microwave radar so it has to see some temperature change and it also has to see something vaguely human-sized coming vaguely toward the door we knew like a hacked wrist actor so nine val/val actually she'll put balloons through doors and blow them up and let them go because the old trick with the PIR is you usually just put them further away from the door you just put them down the hall and you if I'm trying to gas the doll like I'm not hitting it so her solution for that was like like send balloons like blowing down the hall to try to trip them GES product will stop that I don't work for GE I'm not here shilling for like muack sand his buddy's moving so much ee I don't know no all right but yeah it's the only like dual technology sensor that's I've ever seen that's good for this also code let's talk about door handles what is the last time you've seen a doorknob like in an office you don't because if someone like has reduced grip and tactile function or what if someone doesn't have a hand they need to be able to get in and out of the building especially in emergencies lever style door handles are the norm now well inside I mean you see the front one facing me that's locked and has a you know shitty little hidden procs reader on the inside there's also a lever handle which many times that's going to be the case there are tools like this that exist this is an under door tool I'm doing a little show with a guy named Tyler gray he's like will show me this tool and his cameraman is like how would you get in here and they expected me to do something at the door they didn't realize I just knelt down and kind of bang the door open and actually it's one of the cameramen was like can you do that like again like slower that was way too fast I didn't understand what's happening well these are actual tools that we use on jobs what we're doing with this tool it's called an under door tool we're reaching a rod under the door and because modern doors have those lever style handles they're really really trivial to grab that handle and hit it on the inside I'll show you a picture from flipped around in a second this is Robert middle of the night getting into a server room you know people see this video and they thought they'd see him crouched down like how he's gonna unscrew like with a multi-tool to get through that crawl through the grate no he's not he's gonna lean his head into the door and just push it open because of the inside we're just swinging a rod pulling down on a line and yanking this handle absolutely works because when's the last time you've been in the server room and had to badge out some six of real secure facilities maybe most of the time you hit the handle and you leave there are solutions for this there are what are called dynamic door bottoms this little animation shows you a black if this black plunger gets pushed in what happens you'll see this bottom bar drops down so when the door shuts that bar drop stay now this is not a security product this is like a heating and cooling insulation product but the same principle applies to much more robust models so a company called pemko PE mko pemko makes the door bottom now they're sold by ASSA ABLOY big contoured floor plate interlocks in this metal bar and unless that plunger is relieved of its pressure that door bottom is dropped down you're not getting a tool underneath the door now you might get something over the door this is a video from Utah a buddy of ours named the InfoSec Pope he loves demoing this all he uses is 35 millimeter film for the young kids of the room film is what we used to take photographs with but he literally just feeds a bow of film over the door walks it over to the handle and then pulls and you might not do this as a user but if you pull up on a handle it's usually gonna open the door so pull BAM that doors open and I mean pemko makes the door bottom I've never seen anyone sell the door topper so like what do you actually do to prevent this problem well consider a shroud I was one time working an under door tool in this one job I'm like shit shit got damaged yet I've like radio - Robert and like Robert get in here can you and Roberts trying he's like son of a bitch bobak comes around from another building and he throws a borescope unto the door and we're like oh crap what is that and eventually like with the borescope we can kind of see and shove the wiggle the tool we got it open and I asked the client I was like man that one door gave us freakin hell where did you get these things that you installed in the server room and they're like odd they were like on the building when we got here I don't know what that this one used to be like a storeroom or something these are like in Grainger catalogs these are so carts don't crash into door handles when you they're just shrouds for like protecting the door handle not for like security they're just so you don't bang into it with stuff brilliant no money solution if you've ever been in a hotel and you've seen the door handle mounted like down who's seen this before hotels know about this man tell us about break-ins with on their door tools they mount these handles down for reason this is one of my favorite pictures renderman sent me this and I've started to see hotels and other doors with these like little clips I was like I stayed in a hotel once for like a week in San Francisco on this job and you know it's talking to the staff late at night hanging out bullshit and I'm like hey so I got it I got to ask you the freaking clip thing that looks very out of place on the doors is that like under door tools and the guy was like oh yeah we have people breaking into rooms and stuff we I was like I gotta know where you get these my clients could rip because I couldn't that would be a fucking nightmare trying to get an under door over door attack he's like well you know the closet in your bedroom with the the sliding doors yeah these are just those little feet that like you put in the carpet on slide like literally a Home Depot for dollars if you don't care that it looks a little weird put these on your server room door man it will completely frustrate the hell out of me so I love this kind of thinking I love wierd and hilarious ways of getting in and I've got just I just guess it's this crowd I added some funny shit right like stealing keys you think we're above steal it just outright stealing stuff this was the security cart on a facility once we just found it and I was on a job with a guy I was actually subbed in on a job had everything key like everything all over the building and of course like yes we stole it I'm not gonna I guess we're allowed to say J wouldn't mind I'm not gonna say who it was but like eventually we just stole the car and just drove it around because if you get to that point I mean you don't want jobs where you're like you've gotten everything and there's still time and you call the client and you're like so we're in every they haven't stopped us do you wanna start doing stupid shit and the clients like yeah just push it so yeah we literally took this little golf cardi thing and drove it around the parking lot until it ran out of juice and we're like puttering back it like no miles per hour just to try to get it back to where we left it so it looked really and we're not in uniform no one stopped us but I loved it like all the keys were there lock boxes oh my god talk about stealing keys stealing keys from a lockbox these show up on a ton of buildings possibly your buildings if you have con if you have infrastruc like cell towers and stuff on high buildings and other contractors are coming in to service that gear I bet you there's a lock boxes somewhere that you might not even know about tunt there's one two three four five six seven different people have to get into this building I can't even think of that many cable & wireless providers I don't know what's going on here these kind of boxes oh my god telephony boxes right this I just throw in because mostly you know Chris knows this guy in the slide yes Dennis like Dennis is a good cat right Dennis is standing next to a linear access control box I am standing next to another brand called door king let's talk about these two big players in the industry just because this is stuff that's not usually in my slide deck I just had to throw you some fun shit right most of the stuff that cracks me up when it comes to stealing the key like I don't even think it counts as stealing in the instance of like linear you got this nice lit up keypad you got the little W grill linear boxes all have the same key it used to be called the a 126 key it's not really it's the 2 2 2 3 4 3 key but if you google like linear key or linear 2 2 2 3 4 3 or linear a 126 you'll get this key it's the same key on all the freaking panels it's not a restricted key or an expensive key but it lets you do crap like this so here we have a locked door now my wife is going to enter through a different technique beep whoops this is actually the apartment where we've stuck Marcus Hutchins while he was waiting for trial so we only got one key fob we cloned it to her hand so she could come and go and have an extra a key but now I don't have a you know the key fob the door is locked so what can I do well when your boxes are all key to like 8 126 key there's a little momentary switch and just boom flip the relay so that works same key on all these boxes man absolutely so yeah door King the one I'm standing next to here I personally think door King has even more market penetration do they have the same key yes they do the 16 120 key it's been the door kinky I think since 1992 and it's never tried go to trade shows I go to like the trade shows with all this gear and the door King huge and I take I just walk around like he's my king just open stuff and just walk away every few hours just walk by the boot this was like a giant parking gate arm like a huge crash barrier thing and it's again 16 1 20 keen they're all the same key door king systems let's let's dive into this for a moment here we got a lot going on here alright you can always always always tell a door King system boom boom boom a Z call those three huge buttons you'll spot them a mile away now there's not just that we have a we clearly have hid procs going on here we'll talk about electronic credentials but let's get right into it alright let's use our 16 or 20 key look at all these electronical x' well there's a lot of stuff going on in there we've got a big bank of connections here what's going on in this terminal block well punch in door king manuel da pete file type PDF in google you get a big manual with this on one of the pages what's the most giant writing you see on this page real a1 relay - those are the door relays right there they're just dry contacts on the frickin panel so if you have like door relay one either normally open or normally closed you can just bridge that circuit and like oh boom fire the relay open the door fire relay to open that door so in this case do you see how this is wired by the way you can see one common and you can see what normally open so that tells you this is probably a solenoid powered door lock so normally there's no power put power just literally by bridging that with a piece of wire the door suddenly is open there's another useful feature however if you don't want to like carry your own wire and I'll show you what I carry around way up top let's look at this PSW function what is p SW it's postal switch a closure between these terminals in the common will cause whatever relays are set up however they're set up to fire how is this normally work in fact is the postal switch wired up yes it is it's right there a little white in the little blue a little white and blue that come down you got these two beam connectors and they come somewhere else let's look all the way down in the front amazingly low tech this is the postal switch right here it's literally just a momentary and on the front of the panel you'll see they have these doubts that you can just bang out a piece of metal and install your own lock and the tailpiece of that lock just comes around and hits the momentary switch many many door kings are installed this way so we got a lock door now of course you know we could clone the hip rocks we could install a sniffer or whatever we want we don't really care what lock they're using for the postal switch because it could be a good luck it could be a bad luck I don't give a damn because I have the 16 120 key Oh No Oh laptop don't do things that laptop sometimes do you're killing me whose pony my laptop so ultimately here hopefully we can get it to play because it's really hilarious this is outside of like roamers apartment I think we're in town for band practice and you know we called him up he wasn't answering like try shaggy he wasn't answering and I was like you want me to just let us in so you know we walked inside so you know we have this postal switch let's see if my 16 120 key works if I'm our if our video plays nice here we go momentary switch fires door's unlocked how many buildings have these on them and people don't realize many times it's not like your office right it might just be the front vestibule but if I can get in if I can leverage this access in and find a way then I get the next step I get the next step I ride the elevator etc if you're keeping keys like on you oh my god there's a whole talk I did with Howard Payne the CH 751 is like the everything key it's the most common key in this country for all kind of dumb dumb stuff every little wafer lock everything like steel toilet paper I don't know what you're doing if you're you know you live in a trailer you need toilet paper I'll steal it from this hotel whatever like the CH 75 one my favorite story was we were on a job we got into an office like a broom in this office building and there were all these filing cabinets on the wall and we're like oh I don't want to pick every one of these open to see which one has the valuable shit but let's try a CH 75 one totally worked and it turns out every one of them had valuable shit it was like their HR archives going back years the great part and I just added this story because K Joe gave his talk and he talked about finding the exploit from the last job you were on like still on the server we found this we showed the client we're like boy these are really terrible filing cabinets and you're leaving this around in a room that we just waltzed in so the client was like oh my god we'll get on that we were hired seven months later to a different office and we got into like another room and we're like wow look at all these filing cabinets and we opened them were like are these the same fuck wow these are the same filing cabinets they had moved them from one office to another office but didn't actually change him so we had the same finding just in a different state ch seven five one all day long for maximum Lowell arity in the key to like space stick 1284 ex into your google engine right looks a look at some image searches you've seen a lot of the same vehicle here the 1284 ex is the ford motor company's fleet key the number of crown vics and excursions and explorers in this country that are key to like to 1284 x tons of police departments in this country will all and not even knowing it that all of their cruisers are the same key and what's the most common use of a Crown Vic after it's got enough use hours and have to kick it out of the force taxis they auction them off and money to become taxis there are cities in this country where the entire taxi fleet is key to like and it's key to like to the entire police fleet 1284 X is not a restricted key it's not a special like this is the paper still attached to it from Home Depot you get a twelve eighty four X ticket Home Depot cut as many as you like yes it will open the doors yes it will open the glove box yes it will open the trunk nothing interesting in a cop's trunk right and it's not a chipped key it's not a key lock it's nothing like that yes it'll start the freaking car so if you have cop friends and we have plenty show them the 1284 X if you get your hands on one it might pop their eyes out if you're curious my like everyday key ring that sometimes people will see me with they say what are you actually have in your pocket all the time well I have an elevator key the most common elevator key on me at all times I have the two most common filing cabinet keys the c-47 C for one C four and five a CH seven five one I definitely carry that 1284 X cuz it's funny right I have a couple jigglers because why not little tiny jigglers that we make if I can't get through simple Chitti lock this is my wire bridge when I'm attacking door King another box this is just a paper clip that I burned the insulation off the tips and looped it around door kinky if you didn't get it earlier as the 16 120 linear the 2 2 2 3 4 3 which is sometimes called a 126 and a cuff key that is that that's my smash right there that's like deviants devious keyring giving you pearls here I don't think I've ever shown the slide before outside of our training so there you go because I love you John strand and everyone else who invited me here if you are not an electronic person in fact you know we were talking about this earlier but we're at hire people from our team we either have people that came from the electronic digital world and we sort of train them up on physical or we've pulled people who are door kickers they're just cops and other people that were like hey want to make a better salary and not be evil come come work for us and like we have to train those people on electronic learn some things about electronic access controls learn a little bit about badge systems it's not that hard to get you spun up we can get you spun up in a day or two on basic cloning and sniffing and a lot of credential stuff but the fact that we take long-range readers and weaponize them babacar electronics dude changes the guts packages up a self-contained power supply power on this reader let it sit in a bag you know the idea look very mr. robotic kind of stuff right if you've seen that credential grabbing scene this is real this is about 18 inches away credential grab out of someone's pocket biggest with a nice antenna and a good power supply inside that backpack that readers gonna grab that card and it's gonna work we can talk about that later if you want we can talk about how if you get the reader off the wall you can install a sniffer on the back side of the reader and you can sniff replay get credentials that way there's a whole world out there and it's not hard if you've never done any kind of digital electronic work like this if you are just a door buster this is within your grasp and I encourage you to get kind of cross-trained like that little story time for you now new stuff I promised as I tweeted earlier it's not I've given versions of this talk in the past this is all this is all new because war stories are great and we've heard about them from speakers so let me give you a few good ones most of which if you had to distill this down the lesson is just be confident and look like you belong if you've never seen this footage here this is a robbery of a Walmart where a guy came in and said oh I'm here from Loomis I'm here for the the pickup you know I'm the armed guard he's not he's not the armed car guy he's wearing of runners vest with like you know weights and the tactical pants and his hats down I think they found out later at an airsoft pistol and he took $75,000 he's not I'm here from Loomis no he got in a chevy lumina and drove away this dude another guy keep your hat down and don't bother anybody look I'm just here from you know your beverage services I'm stocking your shelves no you're not this guy hits seven stores in one weekend in Alabama he's just stealing beer he just went in with a cart loaded this thing up and just freakin left look like you know what you're doing and people will tend to believe that shit so the elevator repair story all right we got into a building it was an interconnect we gassed off you know a wreck sensor because again you could see it on the ceiling Honeywell PIR boom gasps the wreck sensor get through okay we're in the building now we've got a go whew like we're come in weird the first time you get any get that like adrenaline rush and I'm with somebody on this other job just another company we're partnered with and this guy's like man what are we where do we go what do we do it was like calm down I got an idea let's come walk it find the nearest elevator we just got in an elevator okay why because I mocked myself up I'm here from I've got my little Otis badge I've got my clipboard I'm an elevator repair technician why not you want another like great tip from me to you this is your cover story for being any elevator repair guy ever have a stupid clipboard and learn these three steps you press that ephone somebody picks up it's many times as a computer if it's a human hello this is a test of the emergency phone in this elevator step 2 can you hear me clearly right now step 3 where am i calling from and that last one flummox is the hell out of people a lot of the time because they should be able to know where you are in event of emergency you will sound like a jedd elevator tech if you do that you're not really breaking any laws you're not causing any harm to the elevator you can just sit there and just try elevator you know like trial evader phones and just to get this dude to calm down I was like hey just relax let's try some iPhones man so we're just being the elevator tax and it turns out the third question really flummoxed somebody because it wasn't like a service that went out to Otis line it was the the front desk and we wound up consistently hitting the front desk and like oh it's just another one of those elevator tests yeah I don't know where you are though it just says extension 39 and like so you can't tell me where I'm calling from like I mean you're in an elevator I'm like okay sir I'm gonna have to write down that you don't know where I'm calling from and it gets them all panicked right turns out the security guard was so flummoxed by not knowing where the elevator emergency well I'm like don't worry so there's just a test you're not at fault here we just we just have to put this in the notes that came into play later so while we're in the elevator the guy says to me it's like okay so all we got to do is get the poem plug and deploy it and oh shit oh man I didn't grab it I'm like oh you didn't grab the pole plug well you know the hotel is like 10 minutes away just drive back and get it I'll stay in the building and I'll let you back in he's like okay that sounds good you're gonna look okay I'm like dude I got my metal clipboard like come on who's gonna mess metal clipboards great because you can hide a bunch of tool and gear in it and like all your stuffs in there but the better thing about the elevator story is if you actually watch the elevator hacking talk we have a lot of keys that do things well my partner is back at the hotel which was not going well he was like hey man I got some delays here I'll just hang out in an elevator so I just disabled an elevator with my keys I'm just in the elevator just hanging out nothing I'm like reading Twitter and stuff occasionally asking like hey how's that going at the hotel turns out what happened is his USB keyboard wasn't playing nice with the palm plug he was hooked up to the hotel TV and he couldn't get the key so we had to use on-screen keyboard to like set up all the scripts and it was taking forever and I'm like dude that's fine I got Twitter I'm fine I'm just sitting in an elevator until I almost had a heart attack cuz I thought I heard someone banging on the elevator door because it's like you're camping in the woods like everything sounds loud in the woods when you're asleep in the I thought someone was pounding on the elevators like oh my god there's like a camera I didn't see is that security trying to kick their way in and like no calm down calm it's it's 5:00 5:15 the cleaners are here they're probably like Windex seeing the fingerprints off of the hoistway doors like alright calm down eventually the guy comes back and he's like alright let me okay I go to let it turns out it wasn't the cleaners turns out security had come by the elevator not because they thought I was in there I had been in there so long that they had stuck a sign on the elevator that said elevator out of order do not use this elevator use other side of building which was great because when we came back in my buddy and I now were the only people in the damn building security came down a hall the sauce saw my Otis badge and went wow you got here fast and it was like oh yeah I got that Oh des you got that Otis elite care service so like they dispatch this out here I'm you know doing things with keys that because clearly the elevators working now that I turned it back on but he was so thrilled he's like we guys doing that elevator test earlier I was like no that was the other team but I heard you had some problems but you know what the elevator dispatcher is in this room can you let me in this room and sure sure enough the guard just like let us everywhere we wanted to go because you know who wouldn't want their elevators to run right right on the I'm the helpful elevator guy I'm getting the light on time I'll give you I'll give you one more story I got a couple more stories here but how much time we actually have five or ten minutes five we can do another story and a half in five so the armed guard story is a good story most guards it craps you a lot of guards are under trained a lot of guards are third party this was a guard desk that literally had no one at it and one time I just sat there I actually took the binder of keys and key cards and just kind of like spun around in the chair just waiting for a guard to come up to see I wanted like know what the hell they would say and it took so long that I just got up and left like the guard literally never showed armed guards are a different story they're a little more mastered they're a little better with interaction and they're gonna be more cautious now this was an instance where we needed electronic credentials we really wanted to get in using a badge and all the employees like we couldn't get close to the employees at all they were using a separate entrance like the vestibule is the only place we could get in and during the day the only people of the vestibule were the armed guards this was a private development space well we know how to do a credential cloning right we have our gear we have our long range reader that you saw earlier right shove that in a backpack once you power it on shove that oh we already saw this video shove that in a backpack get somebody to go in just try to get close enough you saw 18 inches or so so when we said who's gonna go in right well what is every guard especially armed guards kind of wish they want to be or maybe they're trying to be the trying to be cops right send it a cop like Rob's on our team rob used to be a cop or like get in there and cop it up man just talk about cop stuff so he goes in Bob Beck is in the backseat of a rental car in the parking lot like remote on to the reader he's like trying to check the status of it and goes out of range his Robert goes in all the way to the vestibule so babak's like man I really hope I really hope that readers getting some credentials and Roberts trying everything Roberts like getting close but they're armed guards so they keep bleeding off every time you get too near them at one point he put it like his bag on a counter and he was like asking the guard he's like hey is this a good restaurant is no Donyell trying to get the guard to like lean over the counter wouldn't do it so he keeps trying it keeps trying to keep strand getting nothing finally at the end of the inner ace telling cop stories right so he's friendly with him he's like all right well I gotta if he stays any longer he's like this is just weird it's like all right fellas I gotta I gotta go all right take it easy man it's nice meeting you and the last guard he just fucking surprised hugs him and like very very Kennedy he was like make it a little weird make a little weird all right brother all right and gets out of there in the car bobak is in the backseat like what did you do I was dying back here it's like well here check check the logs man bobak check dumps the courage he's like you were in there 47 minutes and you got one read and that was it but then who are we we're the armed guard at that point so getting that you never know exactly what's gonna work out for you in terms of getting in I had one other story about you know find me in the bar will tell you about about some other stuff what I really wanted to get to I'm gonna quiz you at the end here we got a little we got a little Q&A and I promise I'm wrapping it up right so this is I hope you're paying attention right what kind of unit is this here door king wide you know that three fucking huge buttons who remembers the door kinky 16 one twenty key buy it buy it online what kind of unit is this it's one of the ones we talked about has a little recessed lit keypad linear linear absolutely what's the linear key a 126 or technically two two two three four three blurry dark picture but who is it door King exactly three buttons you can do this shit on Google Street new we got a building here let's zoom on in you can't see it clearly but you see a recessed lit keypad what do you got you got a linear a 126 key absolutely let's look at this John over here all right can't see it from here but let's zoom in and Google what do you see three giant freaking buttons door king absolutely door king we got a lot going on here let's let's talk about this all right first of all we clearly got a door King system we're using what key is the door kinky 16 1 20 go buy one they're also using hid old-school fucking prehistoric hid procs soap rocks card - you know they're using cloneable credentials you know you could sniff the back end of this because you could pop that circuit board open easily they've got a ton of key boxes this was for deliveries I don't know if that was a CH 75 one but I'm sure I tried it in their little freaking you know kidde accesspoint in here what is what is this one turns out it's also a key box it's just a different key box so we have multiple key boxes we have a lock that we know the key for we have a clone a cloneable cred there's one more thing that you can also see in this picture can anyone tell what I would I would look for through the windows maybe you can tell what elevator fixtures they have so I know what elevator Keys I'm going to need so I can prep my story and I can bomb in there all equipped and ready to rock so keep these kind of attacks mind keep physical side in mind try it out if you think it's all about lock-picking you're not exactly right most of the time we're just doing dumb stuff to bypass our way in but I love sharing this and I love trying to give a little hope you got a couple of pearls in this one to make your jobs easier and your life better and my job harder because that's in the end that's a win for me like I like being the guy in the server room but I also like telling people what they did right and a lot of it's not hard to do so thank you very much for listening and I hope you enjoy this [Applause] you

Info

Channel: Wild West Hackin' Fest

Views: 1,402,912

Rating: 4.8772526 out of 5

Keywords: Wild West Hackin' Fest, Deviant Ollam, Lock Picking, Infosec, Pentesting

Id: rnmcRTnTNC8

Channel Id: undefined

Length: 44min 55sec (2695 seconds)

Published: Mon Dec 11 2017

Reddit Comments

Deviant Ollam is a legend. This whole video (and he has a few others) are fantastic /r/actlikeyoubelong content.

👍︎︎ 118 👤︎︎ u/misconfig_exe 📅︎︎ Apr 30 2019 🗫︎ replies

Here's a news clip about it...

👍︎︎ 35 👤︎︎ u/Cayotic_Prophet 📅︎︎ Apr 30 2019 🗫︎ replies

Loomis*

👍︎︎ 22 👤︎︎ u/BurntRussian 📅︎︎ May 01 2019 🗫︎ replies

This is the best thing I've seen posted on here. Super entertaining.

👍︎︎ 11 👤︎︎ u/swoofswoofles 📅︎︎ Apr 30 2019 🗫︎ replies

This was a great watched. I restarted the video from the beginning and really enjoyed it.

👍︎︎ 23 👤︎︎ u/cyril0 📅︎︎ Apr 30 2019 🗫︎ replies

lol that dude has a bunch of videos on pen tests and that shit. It leads down a whole rabbit hole. The guys that go to these forums hack and break into places, but very little actual computer hacking takes place. It is more of them just coming up with some idea of how to break in and then physically hacking the system.

👍︎︎ 10 👤︎︎ u/kashuntr188 📅︎︎ May 01 2019 🗫︎ replies

I see this pop up every so often and its strange because I live literally 7 miles from Bristow and knew the manager well. After being arrested he had a stroke and was released because there wasn't evidence against him since he lost some of his memory pertaining to it apparently. Last I heard of him was that he was an assistant manager at another Walmart about an hour away.