You’re Probably Not Red Teaming... And Usually I’m Not, Either [SANS ICS 2018]

Video Statistics and Information

Video

Captions Word Cloud

Captions

that is absolutely know I learned that detail 30 seconds ago I think they're making it up just to see if I can bring it bring it all to you right now but hopefully this will be fun hopefully you'll like what I have to say most people come and they see me talk cause like you're that guy I've heard what you do your job is awesome yes it's fun I you know I physically get into the space that I'm not supposed to get into my team is there with me and we do this in a variety of ways you know there's there's basic covert entry so here we have a locked door though we're just gonna try to save house you're slipping a latch on the door this is a water pumping facility you know this is literally their house side perimeter door thatis that is not supposed to happen do office doors this was actually at another sands event a fella named Tyler was filming us for us so it looks like I've heard about this covert entry go show me how it works he says that's where he's not even near the door lock well I'm popping this door through what's called an under door technique and happened so fast the camera guy was like can can we do that again I don't understand what just happened how'd that door open doors just kind of pop open around me sometimes one of the more favorite videos of mine is silly video a bank late at night my wife and I walked out of the bar I still had a whiskey with me so you never seen before that's triggering the REC sensor on the inside of the door not the cleanest way of doing that you do that on a job but you know it's lousy on YouTube whoever keeps up voting it so people want to do this people want to be the person who breaks in and I get that I can dig on that however a lot of people will come up and say man I wish I had that red teaming thing going on that would be so much fun this is not red teaming nothing you just saw in any of those videos was red teaming whatsoever and red teaming gets really overused as a term and there's people way smarter and better-looking than me who have called people out on this before you have nickerson you have gates you have Dave Kennedy there was talks about the purple team so like you have Carlos Perez you have Chris gates again with with who is he with Johnson like there the idea of Oh purple teaming well not everything is red teaming because you know purple is the new hotness it's like it's like the blue team but the red team and then magic and and cyber geek and things and I get the idea that we should be talking about the idea of a purple team if you want to you'll see purple later in the slides but just calling anything a purple team or calling anything a red team I think Gates had the best quote he's like well that's when you put a red teamer in the sock and then you just charge double for the pen test then you grate your purple teams right on maybe I mean there's no official definition for a lot of stuff so anybody could sell you anything let's first talk about the blue side let's talk about defense let's talk about the fact security has three elements there's always three elements to your security they are of course your little padlock your ones and zeros and a guy in a suit and if you think I'm kidding look at all the stock images there every time it's your padlock it's your ones and zeros and your guy in a suit to protect you from the guy who's not in a suit now as funny as this is and I've literally curled stock image sites and kept finding this sort of imagery it's crazily enough not the furthest thing ever from the truth the three elements to security kind of are represented in those iconography you have digital security you and this year ones and zeros right you've got the network wrap you've got whatever you're doing on your network segmentation firewall rules etc you have physical security literally the locks the doors the walls that prevent people from getting where they shouldn't mostly me and what's the last person that the guy in a suit represents trustworthiness he represents well you an element your people your staff should be well trained to understand security many times we talk about the human surface as the weakest surface but other people like Nickerson and so forth for years have said well where these services blend and cross over that's where attacks can get really you see for example a badge system physical access control system like is that is that physical security is that electronic security it's kind of both who really owns it who manages it those juicy overlap spots that's where he used to talk about attacking all the time and the super super intersection in the middle it's it's red just like is that where the red team lives I don't know it's red well let's let's dive this a little more attacking the physical vector these are all things we do or all things we know people who do I myself some friends in the back you're gonna hear from later we've all done this sort of work like okay lock-picking if you've never tried lock-picking by all means we will teach you where the only sans class I think that does lock-picking actual hands-on with all chronic tools later but oh yeah picked a lock now this looks like a real crummy lock anybody who's known known locks is why is he showing that terrible pock that's not a present well anyone who knows this is usually the lock that controls the most important thing in the building which is the key cabinet you get all your expensive locks and keys put them I'm the worst luck ever and like you got lunch right or I don't even pick the lock at all you know this is again this is black slipping with a piece of garbage and a server room that was that was a piece of plastic trash if you didn't see my talk last year when I talked about how I get in on a lot of physicals this was an example we talk all about how slipping works and doors should be anti thrust or anti loyd now the physical side is what I talk about a lot I don't talk as much about the digital side but I'm willing to bet many people in here have this sort of skillset would not be surprised that we do as well even though it's not as as fun it's hard to show a good video right like oh they click it and something happens lightning bolts right like that's this pwned again it's not a good live demo right but we understand this we understand that the digital surface is another attack surface and this is what some people go for now I said physical access control systems badge systems they're kind of in the middle are you about to see a digital attack or are you about to see a physical attack if you've never heard of what's going on here if you're not aware what's happening here this is the access control credential reader to this server room we've taken it off it's mounting not set off any tamper alarms why because stampers not hooked up why because it's never hooked up and Babak here our electronics guy he's installing a microchip about the little circuit boards about the size of a postage stamp it's called an ESP key and this is going to just sniff all the badge system traffic to and from this rear ostensibly just from this reader this is a one-way you know unidirectional protocol but he's gonna sniff all that traffic and be able to communicate with our sniffer via Wi-Fi from anywhere within about 50 yards of this door and in future we can come back check all the bad data dump all the bad data that it's seeking replay it we can deny of service the door we've done that before you must pretend the door isn't working and after 15-20 minutes and frustration and security guard staring at each other you walk up with a logo on your skirt that's the same as the integrator and you're like oh I haven't trouble with your door huh so again is that is that a physical attack though is that a digital hell I even described a human attack another sort of digital Dorset this is more electronic right this is just cloning a badge into someone's hand it's my wife she and I both have implants so we can form credentials all the time so our fingers that work pretty well too again she looks perfectly normal she's not holding up a proxmark or something to the bar but she's not officially authorized to get in that building the human vector plenty of people has who's who's taken securing the human plenty of people have gone through securing the human at sands we know a lot about social engineering we know a lot about how to spot it if somebody is trying to pass themselves off like they don't belong can you identify that and we laugh right but this is the sort of thing that works in the real world this was a this was a robbery I don't know if you've anyone has seen this news footage this was in Oklahoma yes this was in Bristol Oklahoma this is a guy who showed up at a Walmart said he was here for the daily take with Loomis you know and he walked out with $75,000 and he didn't get it he was not from Loomis he got into a Lumina and drove away but he was wearing like a weight belt and I think an airsoft you know rig and he just kind of kept his head down I'm here to do the thing later they they found there was some collusion with an insider who told him like this is when you should come and look kind of like this guy but again no one else in the whole store security nobody questioned it 75 thought he's not stealing a TV at 75 grand this is my favorite video just look like you belong there though this cat is he's working right he's working for a beverage company or something no he is walking through grocery stores he hit like five grocery stores in Alabama in a weekend he just walks in and steals a ton of beer and leaves he's leaving with all the beer but like I would walk right by him and probably not notice just all right that's the guy he's got a matching colored hat right he went something that involves work look like you belong there is one of the main things we talked about when we train on social engineering if you're the phone guy I'm here to fix the whatever an RA just to kind of be disinterested you're gonna see some some real good social engineering hopefully in these stories because I want to tell you a few stories from the job and I want you to tell me later on your thoughts about them so Story number one the elevator repair technician all right elevator repair technician is a great cover story by the way they only come to most buildings on your semiannual z' they're not really recognizable by most staff they're known as those people who sort of show up and you know I think I might give them a key but then I don't see him for a few hours and then they somehow they drop the key off I don't know when they leave I don't really our spot him so a person in an elevator if they're like oh excuse me this one we're working on this one I'll catch the next one you don't think about that they're almost invisible and if you want to be an elevator repair tech some people in this room witnessed this before with me three things you can remember anybody can kneel down at the e phone and do an emergency phone test and not really screw anything up you're not breaking any laws you kneel down get your clipboard get your metal clipboard so you can look all sophisticated like any contractor you press the e phone button an actual a phone test involves three things one the first person who answers sometimes it's a machine but sometimes it's a human hey this is a test I am performing a test on an emergency phone alright step two can you hear me right now and you can draw that out as long as you want if you're nervous you're trying to yourself down wait I can't hear you can you hear me again just alright alright we can hear each other and though the doozy the zinger step three can you identify where I am calling from which is an it's nuts because so many times depending on how phones are wired you'll get people who cannot and this happened on a job you know we actually assumed it was going to Otis line or some services no it was an internal extension and just went to the security desk and this guy was like yeah I can hear you what's not looks like okay can you identify where I'm calling from he's like uh what I said sir I said I have to ask you know identify where I'm calling from well my phone had a display you know he's a it just says elevator I said okay so so Kevin he gave me his name Kevin you can't identify where I'm calling from I mean I don't know like it's okay don't worry Kevin we just have to write these things down it's no problem at all we're just gonna make a log in the entry here okay all right Kevin thanks very much for the task what do I do like that's all right Kevin someone I'll be in touch and if this came into play later but yeah you're never gonna break anything it's fine have your contractor clipboard you know put a bunch of stuff on it put a bunch of in it that you can use to do other bypassing and snack in the elevator so we're in this building right when you get into a building I think we just you know hit a rec sensor or slipped the latch got in pretty easy but a teammate had to go back to the hotel there was a you know an electronic unit to the test as well like oh yeah we should we should we got in already holy crap we should bring the Dropbox so we can go ahead and pop it in whatever room we get into I'm like all right I got nothing but time I'm just gonna hang out in the elevator and he's like how many how many tests of this you phone you're gonna do it like I got this so if you've ever seen my talk an elevator hacking I just took out my elevator control keys and I just disabled the elevator I just put it on independent I'm like dude you take your time at the hotel I'm just gonna be here I'm just gonna read Twitter it is fine I've spent hours and I've moved chairs into elevators before just hid in there because no one notices you know hey how come 6 hasn't come all day Charlie's isn't that weird no no one says that you just get on whatever elevator came so things at the hotel were a little slow there was a problem with like the keyboard I think working with the box had wound up the USB keyboard didn't work or like on-screen keyboard if you've never set up a script using on-screen keyboard yay but you know I'm fine I'm just hanging out in the elevator I don't I'm just hey man how's it going no I'm really getting caught up here I'm always behind on Twitter but then I nearly had a heart attack because it sounded like someone was pounding like banging on the hoistway doors and I jumped out of my own skin and I went all right whoa calm down calm down this is like when you're camping like in the what everything things lat sounds loud in the woods it's just a squirrel you know no and if I'm like alright deve this is it's like 5:15 the cleaners have to be here they've their wind xìng their fingerprints on the hoistway doors that's what that must have been no one shouting saying hey let me in I'm fine I'm not burned turns out it wasn't the cleaners Turk was security now I wasn't roasted I was fine but something hilarious turned out to have happened teammate comes back he's like alright let's rock this and out for ones out of the office so we have the free run of the place I'm like no security but they'll be here but he pulls up hits me a message I go downstairs pop out of the elevator the doors right here and as I'm letting in and I look I had been in the elevator so long that security came by after hearing reports that it literally wasn't working and they just put a sign up that said this elevator is out of service use north bank you know elevators which turned out to be in our favor because now it's an empty building what are two people doing it at night security happened to come down a hall a few minutes later sees us sees me with my little Otis badge and so forth thing is wow you guys got here fast like oh yeah you know what you're paying for that elite care service so let's see if we can get our Chooch in again here aha let's do some things with keys and you know all makes buzzy noises and it nuts oh look the elevator doors open dope all right it looks like we're good man we got that elevator working he's like great that was annoying I had people calling me all day about this yeah that she does that we'll put a ticket in there we'll sit we'll make sure everything's tip-top let's check out the I'm gonna check the controller logs sometimes if there's a Fault in the elevator they might you know might be on this one box and you probably have where's your where's your network room guard was our best friend gave us a score did access showed us around so yeah groovy right that's awesome as everyone wants to keep the elevator working obviously trust your friendly elevator person now story number two keep these in mind though who's got enough foam going off doing your recon if you want to be somebody just walk around a building do some open document searches find out who services them for anything even if you don't have the exact name of their integrator or their internet company pick a name even that just anybody's heard of we have shirts we have badges we have plenty of I'm not sure who this company uses because we were hired on the last-minute job but I'm pretty sure you know this is someone they've they've known deck yourself out and say alright well we're ready to go well this is in fact what we did for recon of a job we were thrown in at the last minute we said all right you know we'll we'll do our best here we'll take it on big proper jobs we want a lot of recon time but we all right let's let's just walk around the building at night let's get the lay of the land let's figure out this building looks like so two of us are out there we're in our technician shirts we're just you know okay have you tried this door right now I'm not seeing the effects saw this alarm might be enabled on this building we're just biessing and then Babak like hey what some truck down there was that truck there before I don't think that truck was there before it's you know it's 10 o'clock at night I'm like that's that looks like a security truck off in the distance in fact was it a little dome light we're like that's a security truck all right ooh what's that yeah I out there by that other building nobody's around that's he's walking each door that's a guard whoo that's a guard now it's late right it's late it's dark we see a guard the guard has not seen us what's the best plan say again yes a lot of our students say hide or go back to the hotel approach absolutely make a new friend you're the only person out in that parking lot next to him in case he has seen you yeah hey you know wave your arms walk up to him absolutely what we did like hey man how's it going look this is building nine isn't it of course it is a giant nine on the building right he's like look we're just trying to get here this is phil mickelson the chief of whatever we made up in the middle of this conversation in this building he's a manager here right it's a third-party contractor in a huge parking lot it always is they're not gonna know who the heck is the manager of what it's like who's Phil as the what and we're like look there supposed to be a truck roll coming through tonight there's a whole big fiber run that we just got pulled off a job on the other side of the city we can't know is the place like 9:00 to 5:00 or is somebody supposed to be in there he's like oh no it's regular hours 9:00 to 5:00 no one's ever in there at night getting information we're like all right man so you haven't seen a big bucket truck obviously out here right no I don't I haven't seen anything like that so Babak pretends to get frustrated get on a fake phone call is like ya know I'm out here no of course Steve's not here no no I'm with what's your name it I'm with Gerard from first security he hasn't seen a truck all night no we tried the number on the work order for Phil no he's not answering well I don't know what you want us to do you pulled us all the way over here you want us to go back to Main Street all right we'll stay all right man we'll all right we'll call me back look man I'm so sorry about this Bob and we're going we're like obviously Gerard you can't let us in here we wouldn't ask you for that because you don't want to push too far no I couldn't do that I think nah that's all right man this is frickin situation all right do you like is there Wawa 7-eleven sim please just get a cup of coffee around here hopefully this gets squared away he gives us an address now do you think he verified anything we were saying no do you think he even really had a mechanism to verify anything we were saying again he's looking over like nine different companies buildings in a parking lot he doesn't know who to heck to call and it's two guys and you know Verizon Polo is fine now of course 20 minutes later we just come back we know he's gone I think in the conversation we even asked for like well how are you on all night or as I go yeah you know I come around every two hours but I haven't seen anything okay well we know so we just come back and we did get into the building you know how did we get into the building again it's always always a low-tech if you saw my talk last year it's always latch slipping or something to that effect if you don't have one of these little hook tools by all means ask me about them it's my favorite thing to carry around because why take my picks out when you can just work on the door that's improperly hung $5 hook boom get you through everything at the time so we're in the office right we're running over like all right we know it's empty because we just had that confirmed we know he's not coming back for a few hours and we got the run of the place and we're trying more doors we're trying to use that under door tool on a server room okay we're almost in the server room except I'm working on this door bobak comes running down the hall he's like dude dude someone's here but put that awhile I kind of kick this thing onto the door a bit I just oh yeah so the drop ceiling and the conduit and sure enough someone does come around the corner it's Gerard our good friend the guard and he's way earlier than two hours it's only been about 3540 minutes first things out of his mouth are not hey how did you get in B what are you doing here anything like that first words out of his mouth oh you guys must have found Phil yes yes we did Gerard thank for your observation your kindness what do we what can we do for you though he's like oh well were you guys holding a door open at one point because after 30 seconds they alarm have you been propping a door open like I was propping a door open I was going out to my car which I wasn't I mean I was actually opening doors elsewhere in the building without properly shorting out the contacts but literally the client did not believe that we told them the next day we're like oh yeah we talked with your state like the guys and like no way they pulled the tickets and they actually had these log entries from first security saying you know door 21 Jay alarm condition no sign of forced entry door 21 Jay alarm no problem with door perhaps the door sensor is wrong ultimately culminating multiple times the guy had come out checking doors in can't find any signs of forced entry Verizon is working in the building I have informed them to not prop doors open and it blew the clients mind that we could have actually interacted with a guard but like how did you not just get caught I'm like well you know who wouldn't trust it look what we don't look shady at all of course we're so we're nice guys I got these little verizon polos from some lady in my street that just makes clothing so great right all right third story the armed guard story most security guards are pretty untrained and we we just had a story of guards that are not always sharp it's not their job it's their job to notice literally the like I guess the black hooded criminal making off in the night with a big thing under their coat I'm not sure exactly what security guards are trying to do mostly just observe four broken windows and then call authorities they're certainly not trained to presume someone will just act like they belong there I mean you'd think that this was a front desk where there's no one was at the desk I just sat at the security guard station picked up the book of keys hung out waited to get caught sometimes you just want to see how long it'll take and I got bored after 20 minutes and left so a lot of guards aren't always on the ball right arm guards usually are in order to be authorized they have a lot more training there's a lot more hours they have to go through they're there they're sharp now we were on a gig and we needed to grab electronic credentials this was a building that was buttoned up pretty tight no real way to slip latches no real way to we thought to pick or anything and even if we did we didn't want to set off door contact sensors we're like we need credentials for an event otherwise the access control system it's gonna go nuts well if you've ever seen any of our electronic stuff before if you've ever seen let's so what we call the hunt pad we weaponize long-range hid readers put a battery pack in them put a nice little extra Arduino nm talked to him these are long-range credential grammars long range in the world of procs is you know 2 feet 18 inches maybe but this is a weaponized regrab right this is a little bag in Dennis's shoulder he sits down pretends he's working on his phone oh yeah ok I'll meet you around the corner guys yeah that's a credential grab we've done it a billion times we know we could do it we knew what types of credentials they were using that's another reason my wife and I enjoy having the chips our hands one that I keep always written to is just like hid procs so if there's a multi-class reader a nice-nice i class se multi class like I wonder if they have credentials that are legacy enabled well we know somebody's using Crocs even though you paid for the brand-new reader so we knew they were using procs we knew we could grab the procs we get this hunt pad all ready to go like alright well the building is pretty pretty buttoned-up I mean there's only a lobby right that's all they've got and sometimes employees come and go but it's not gonna work real well I don't know if we have to go in there there's just a bunch of security guards in there there's like three of them at the desk what are we gonna do well what do many armed guards dream of becoming one day yes the dream of being officers usually so what do you do he send in a cop you got a guy on our team who used to be on the job we gave him a new life gave him a new identity with us but he was like I can get in there and cop it up give me this bag so drive up middle of the night right in front of this facility can't park way far away in the parking lot because that looks weird why are you walking across a parking lot I had to pull right up to the front but was hard his Babak was in the car in the backseat under some coats and he is communicating remotely with the badge software on the reader that he's installed he's like I'm gonna see what I can get he's gonna text Robert if he gets a good and Roberts cannibal okay Rob keeps trying he keeps talking by the time he gets into the lobby it's so far back all the signals dropped out on the Bluetooth so Babak has no idea what's going on he's blind but Roberts just trying Roberts just trying he's not listening for a beep because we turn off the beep you don't want to do that obviously I'd be a little weird but he's alright so okay guys well yeah I'm here just working with this project this week and he's making up stories about why they brought him in to advise on legal something but every time he gets close to these guards again their strong side blade back every time he would get close they would just by their training just blade off and their badges were all in their hips so he couldn't get near them and he tried like laying his bag on a like a bend she's like or the the table top he's like hey is this a good restaurant it's the only thing that Yelp says is open hoping that one of them would lean over it none of that was working so finally at the end of the day he's alright I've been in here like an hour it's only so much small talk he can make before it's weird alright guys well it's nice meeting you you know thanks for everything hopefully I'll see you if I'm around this week and this last guard who had kind of been the friendliest robbers like come here you swings the bag man hugs him to like make it awkward he was like a second or two you know he really gives him what for he's like alright well I'll see you later Dawg and gets out of the cut and I was like that was weird gets out to the car Babak is still under the coats he's like what huh he's freezing you can't leave a car running like well it's they drove to like a gas station down the block pulled the S cards get the Bluetooth up he's like dude you got one read you were in there an hour you go one rate but who do we have security at that point and then it was game over one little hid credential we went back the next day with clone badges everybody could get in elevator was used to lock out certain floors have you ever seen me talk elevator hacking bypassed the elevator controls exited out a different set of doors found their most important infrastructure room picked the lock on that and we've got right up to the network we faint you know we you can like lay hands take a picture all right we're not going to touch your network but we proved we could so of these three stories which scenario was red teaming some people apply the all surfaces litmus test you have to you have to hit you know digital physical human so let's think about that all right so if we got into a building I met a guard I used a cover identity and was granted escorted access everywhere hmm I'd call this social engineering didn't really do a lot of physical or digital stuff here so was this a red team engagement no no no no I would not call it that Story number two the cable technicians right well we're here from Verizon and we're you know we've got to do some things we befriended a guard the guard led us in then later on where the guard didn't let us and we let ourselves in right we use the latch slipping and everything else we got onto the door okay that's a blended attack multiple surfaces is this a red team engagement ah I hear voices yeah how about no no I would not call it that Story number three the armed guards so we made that hunt PAP gonna get in establish some rapport made it just grab a digital credential got a new badge came back the next day overrode more security picked locks got into the server room hands on the rack didn't touch the the network side but you know demonstrated it was this a red team engagement no no no no it was not in my opinion why why not any guesses some people lat I could hear whispers some people latch on the fact that something was out of scope I said oh that the network was out of scope I wasn't allowed to get on the network the question of how much scope you have everyone loves to latch on to this is is that what makes something a Red Team engagement the idea that well red teamers have no scope the attackers don't have scope man so you can't have scope as a red teamer this is a common argument right it's one that I've made in the past and I think it's BS and I'm here to say that scope absolutely has a place in a red team engagement if the resource you are modeling the attack of has a limited surface in some fashion if you are modeling a very particular type of attack like if you're a company and you're working for you know ni and you're gonna test bulletproof vests and you're like alright pew pew pew pew pew oh the soft body armor holds up pretty well everyone on there their security team has that one a-hole friend who's like oh we're gonna test bulletproof vests well let me tell you about how badass I am because look at this thing you think this guy or vendor lies bulletproof well you know look let's use my freaking Austrian forty millimeter Kanaka think that's a bulletproof vest come on pull my leg everyone's own a red teamer like that what were you testing to begin with you don't know more than the client you don't know what you're trying to model if you're not listening to them maybe they're modeling a completely different threat than that listen to them otherwise you're not adding value what the client ultimately cares about and what I bet a lot of people in this room who the defense side are frustrated because you care about and people don't listen is a given Vaughn going to cost money or make someone look bad now this sounds very political but it's true unless you can demonstrate physically demonstrate this will cost me money or make me look bad sometimes they're related obviously if you can't demonstrate that as an attacker you have no value to the client that person oh look I blew away your bulletproof vest with my cannon yes thank you cannon based assailants are not in our risk model thank you for wasting I did you Bill us for that how much did you rent that is that am I gonna see a line item for that on the billable Thanks your job as a red teamer is yes of course to think unconventionally you are supposed to be attacking across all surfaces that's part of the nature of the gig but you are supposed to model the relevant threat and if you've missed the word relevant you need to spend more time when kickoff call paying attention and not playing like you know desert golf or something on your phone demonstrate impact is a huge one none of the theoretical stuff I think really belongs in a lot of the deliverable reports I see well in theory an attacker could have pivoted too well and Chris Nickerson is always a fan of saying well did you do it well the attacker could have this yeah but did you do it no then shut up demonstrate the actual impact there's one more thing it's one more thing we've been dancing around this whole time what is missing from my list who should always show up and be with the red team the blue team you should be integrating with this is what makes a red team engagement this is what makes you not just a person knocking things down I love the sparring analogy and you've heard it before if you're doing adversarial modeling but never talking to the people who are getting beat up their value add isn't there this might as well be a red team that's half the time one team comes in is wildly wildly more strong than the person they're just gonna whale on and they just pound them in the face repeatedly and the person tries to get up and knocked the Oh boom and that like here's your yes that's your deliverable report look I'm awesome perfect and then you get hired back six months later the red team is still as strong as they were blue team still as weak as they were the whole thing plays out the same exact way with all the same flaws all the same faults and all the same results perfect yay aren't you badass that you literally could screenshot this and just here you go here's my deliverable that's half the time look at me I'm awesome rec to you this is what you want the end goal is not just to beat people up and get the high score the end goal is for the blue team to start hitting you back and if you're not building this into your jobs this is not the same value add that it could be most people when we plan jobs you know all right I'm gonna kind of prep I'm gonna do what I'm supposed to do and I'm gonna go bananas and I'm gonna write a report or those of you who get pivoted from job to job to job to job to job it's your schedules honestly more like this and you're like doing laundry you know a holiday in and then you all right boom to the next one boom to the next one and I understand our lives are tight and our schedules are tight but build time in to do after-action with the blue team it's so rewarding a couple of quick examples of that what are we doing here we've got a long pole with a mirror we're using a bright light up against a server room door we talked about a type of sensor earlier in my in my stories what kind of sensor am i identifying here can anyone see it it's a very little sliver of a dot what is that it's a door contact sensor most door contacts are magnetic and whenever this door open to the server room the access control system should know about it well we literally walk the client through we said all right can we have some people from the sock come down to the data center today and we show them or like well this is what we did we put a piece of plastic with a dot magnet on it this is how I bypassed your sensor and we're showing them aunt like the door is on the door is off blew their minds and they're like we never thought about that we can configure this a little differently it turns out we were disturbing the magnet just a hair they're like yeah we could turn up our sensitivity window so it alarms after a second not five seconds yes do that you know Babak is in the wiring closet with them he's saying well how come I can unplug this one door door contact input this should be a monitor input there's no way this if the circuit goes dead it should alert it shouldn't just alert when the sensor you know enunciates like well I don't know what does that mean and Babak sat there with their integrator it was like all right on the phone with the sock he's like all right door contact 12:00 is off is on was there an alert no door contact 30 wow you got an alert ok 13 is wired correctly how about 14 we're the red team and we're doing the blue team job they had on all of their doors at this one facility for like reasons of emergency all their credential readers also had near them these extra little key switches I've never seen that it looks kind of homebrew but I'm sure I know what it is this is like these are these are override locks right like oh yeah they came with a building but we never have to use them because we've never lost power said okay let's just see what one is we took the front you know screws off looked inside now all right it's just a cam lock that comes around and hits a momentary switch again nothing really sophisticated here there's another little momentary button right here though what is it it's a tamper right do you think that tamper did anything no 90% of the time it did not but we went around again on the phone with the sock we're like alright you're gonna see some noise possibly or not okay not mark this one down is not and we went around to the next one and the next one even though we had gotten in this is great value for all of them the oh my god the fingerprint reader we can ask me in the Q&A I'll tell you more about the fingerprint reader but literally taking it off the wall installing an ESP key no tamper alarms even though the company insisted up and down if they had tamper on the data center readers were like you really don't and they would never have known this until we hit all the different hall doors and they wrote they were like oh my god every single one of these does not work the way we thought it did the next day they had their integrator out there servicing an edge they were changing it up they are really moving fast to get the problem fixed that would have taken six months after maybe someone had passed a report to somebody who didn't even read it but that's if you're lucky spending a couple extra days on site with a few shot callers makes such a huge difference so in ER please interface with the blue team that is what your job should be as a red team now I'm not going to just you know shame shame finger wag I'm gonna give a little bonus gift to the attackers out there some of you have seen me talk about telephony systems before front gate systems you've seen them in some of these videos some of you may remember that I often talk about the fact that they're all key too like I've talked in the past about what keys they are used you know you used to get in there if you've never seen my you know deviant super everyday keyring I'm going to reveal it all of these systems these are all default keys these are all like this is the Dorking system absolutely one of the most common front door telephony systems door king all is the 16 120 key linear boxes all the same key once you're inside there's a whole lot of trickery you can do I like again why am i doing anything that looks strange with a latch and an under gorgeous ism when in fact I can just walk up to the system gives you them technically there should be a tamper alert when you open the front case your delivery never seen one carry my light every door kinky so you're gonna get a momentary switch literally just that simple on most of these systems that have if you how many people have been in a building the title in these boxes out front by some brand you've seen them they're out there absolutely I have a bunch of useful keys you've seen me mainly talk about the CH 751 it is America's any he everything he the the dopey like camlock like this is a generator that somebody oh look our buildings generators a seats of our medical storage Oh our flame you know cabinet the CH 751 literally like the key that just goes to stuff you would never imagine when a company is building a thing and they say we need a lock half the time it's a CH this is a snowcat literally some people send me photos all the time now at the hashtag CH seven five one what's crazy crap that this key works on it is the most popular key in America and if that applies to you know your cabinetry keys your circuitry cabinets this key box why did I show it to you earlier I didn't actually pick this key box yeah it's a CH 75 one and extra awesome is that there are no less than three more CH seven five ones inside this key box for other stuff around the building if you've seen me talk about what the the key to like you know vehicle systems and things 12 84 X what is that the 12 84 X key is Ford Motor Company's flinky you would be astounded how many black and whites right now in this country are key to 12 84 X door trunk and ignition these are all common keys that the industry kinda knows about in code books but you don't talk much about my new favorite though that I've added to my keyring this lock a lot of you have seen it even if you don't know you've seen it it's this lock the most popular industrial cabinetry brand for rack systems for big racks is by emka emka has essentially three keys in their whole product line essentially the 3 3 3 the 2 2 2 the 2 2 3 3 real real original naming they got bored at the end like what we call the third one I don't know man it's 5 full 6 I want to leave call it 2 2 3 2 2 3 3 X because it's extreme it's extremely easy to pick but I mean again you don't have to pick these locks you don't have to look like a person who doesn't belong there you just have the key these are well known keys this is my everyday carry set now this is a little keeper that I ordered on Amazon tucked it all in together nice like and we can think about red teaming as it applies to all the different surfaces right the FE okay one is the most popular elevator key out there it's the one that I used on that job at the elevator Tech right ek 3 3 3 that digital cabinetry key I either look like I belong there or I'm actually servicing the digital cabinet stuff I'm gonna change these settings but I look like I belong there I got that key 2 2 2 3 4 3 that's the linear key again I can get into the physical system C 4 1 5 a and CH 7 5 1 those are just super generic you know cabinet keys that I always want to have on me 16 1 20 that's your door King that's again another physical access control system kind of a foot in both worlds digital physical jigglers well if you've never taken a physical course with us we'll talk about jiggling locks open this will get you through a lot and I do have that 1280 for X because it's hilarious showing fellows on the job that their their roller is not as secure as they think but this is my this is my usual smash this is what I have in my pocket at all times yes the slides will be up later some of you are writing some of you are wondering what's this dangly bit anybody want to guess also useful on weird physical stuff that's a jumper wire loop because if you get inside of various cabinets and you're a little bit bold you can just start sorting things out if you know how the circuit block works no more rummaging on the ground for paper clips I started just carrying my wire loop so again we got another door king system door is locked 16 1 20 is gonna let me in it's not wired for postal service access but I know which contacts on the terminal block to use loop a wire for Oh so absolutely keeping one of these around keeping this folded up tucked away in your pocket I recommend it you can you can buy all these keys online one place or another they're not hard to find and it can make your job a lot easier if you want to learn anything else about this we're always happy to be at San Sands Orlando if your local is just around the corner they told me to remind people we're an odd duck right we you don't think of taking out circuits and taking out you know data streams of a badge system like DISA deck detecting that in a classroom we do talk about this kind of thing it's a little bit of a it's a little bit of a niche topic but we're happy to share details about it with you if you ever want to learn so in conclusion a friend of mine Patrick had a really cool you know image Emma graphic about this where he says people throw the term pen test and I even think red team around a lot nowadays untangle this terminology really decide what it is you want and then make sure the team you're hiring is going to deliver what you want this this blog post he put up it was just really all about everyone understanding each other on a kickoff call and it gave got all these thumbs up and very deservedly so where he says your job is to not be the biggest badass you think you are your job is to be the value add to the team that hired you so keep working together work with the blue team the red team works with the blue team to make everything better together it's fun getting in getting caught is the goal so hopefully that's the kind of value you can get out of people or if you do this kind of work that's the kind of value you can bring to the table and thank you for letting me talk about this this was fun [Applause]

Info

Channel: DeviantOllam

Views: 179,929

Rating: 4.9374518 out of 5

Keywords:

Id: mj2iSdBw4-0

Channel Id: undefined

Length: 43min 44sec (2624 seconds)

Published: Mon Jun 04 2018

Reddit Comments