Cirvumventing Physical Security Controls- A Red Team Assessment
Posted by: Jeromie Jackson
security compromise, physical pentest, physical penetration test, red team assessment, hacking, spy pen, RFID cloning
Our customer occupies the entire 3rd and 4th floors in a 4-story multi-tenant building. We took a variety of pictures and videos during this day, identifying and documenting the countermeasures and areas of weakness. One of my favorite new toys is a video camera, microphone and 3 megapixle camera that is housed in a pen.
Not only does it produce a good picture and video, it was VERY cheap! I also walked several areas using my Blackberry, acting as though I was texting while walking, when in reality I was video taping the environment. Primary take-away’s were large gaps in the front doors, the lack of motion detectors on the 1st floor, access to the plunger on a poorly installed interior door, and identification of the datacenter. Monitoring the location we noted the guards who leave at 10PM. The cleaning crew appeared to set all of the alarms on their way out.
First Floor Enterance
We did not have all the equipment to clone HID cards, thus our attack did not include cloning HID cards, however it is very easy. If you’re interested I recommend checking out RFIdiot. Also, to see how vulnerable HID cards are I recommend checking out this video from Padget that shows a simple cloning device. For a fairly expensive, long-range HID Reading capability check out is more elaborate long-range HID/RFID cloning setup.
At approximately 12:30AM we arrived on-site. The back-door is protected by a HID proximity system. Shoving a wire hanger covered in a piece of paper through the door we attempted , and were able to, trip the motion sensor. “CLICK,” went the pins keeping the door closed, but the doors did not open. The plunger/break-away bar was still keeping the door locked. We hit the street-side door and attempted to pick a Schlage lock a minute or two. The amount of police traffic was too high- we left the door. Having severely compromised the organization during the day, my cohort was ready to call it a night. Having a “get out of jail free card,” and being up at 1AM, I wasn’t so eager to give up. I went back home, bent up every round bar I had. I needed something I could shove through the door, turn it, and then use it to pull the plunger, opening the door.
I had that may fit through the door, and off I was for another hit on the building. I called my cohort and told him I would call him back in 30 minutes, successful or not. We needed a strong enough bar we could push through the gap in the doors, and then turn to use to pull he plunger closed. Eight minutes on the back door, and “POP,” I was in! The bent wire above with the needle-nose pliars was the tool that breached the door. I called my accomplice, “I’m In!!!,” I told him and he was on his way to help complete the job.
Awaiting Backup
Making it into the first floor, due to poorly installed exterior doors, I called my buddy and called the troops in. After calling my wife, letting her know it was going to be a long night, I waited. All the doors in the hallway, except the stairwell, were locked. Not even the bathrooms were left unlocked. After approximately 15 minutes I hear someone yanking on the doors, then I hear radios going off. “It looks like someone tried to shim the door, there are fresh scratch marks,” I heard across the radio transmissions. Burrowing under the first floor stairwell with my bent bar, coat hanger, and get-out-of-jail-free letter, I shivered for over 15 minutes. I couldn’t call my buddy as there wasn’t service under the stairwell. After approximately 15 minutes the noise had ended- the police had left as nothing was tripped in the facility. We had entered the building and had 5 hours until security would be returning the following morning. My next blog will document getting into the interior offices and compromising the datacenter. Make sure to follow me on Twitter!
0 Comments
RSS Feed
Email a friend
