Gaining A Foothold

Editor's Notes

• #4: Looking at ways into an organisation, then focusing on two different social engineering techniques, with a demo of a so-called “Rubber Ducky”
• #6: There are lots of possible ways in to an organisation – here are listed some common ones. There’s the external footprint – infrastructure, VPNs, Websites etc. Then there’s social engineering – phishing/smishing ( phishing over SMS)/vishing (voice phishing – ringing up the helpdesk posing as an employee and having the password changed.), or even sending a malicious file to users (“please fill in this .docx and send it back to ensure you get your Christmas bonus”). Then there’s your onsite stuff – wi-fi connections, physical access (breaking in and social engineering). Or even poisoning the watering hole (large companies with a mature security culture and water tight security can be targeted via silently compromising a smaller company with considerably less security resources that they have a trust relationship with, e.g. their cleaning contractor).
• #7: We are going to focus in depth at two of these – phishing…
• #8: … and physical access.
• #11: Here’s an example email that’s been sent to me…
• #12: Zooming in, we can pick out some key features
• #13: (The observant onlooker may have already noticed the problem)
• #18: These things are all adding to a sense of legitimacy, and also, urgency – the sort of thing I might set as a reminder to-do on a Friday afternoon when there’s no point getting stuck into a big, new task. In fact, with the right timing, we could use that to our advantage.
• #23: This is something that is very subtle – adding or removing common punctuation would be one way to create a legitimate seeming domain. Other options – leaving out or adding in letters/slightly different spellings, different top level domain - .co.uk rather than .com, changing w to vv and so on.
• #27: Let’s say that phishing hasn’t worked, we will turn our focus now instead to physical access!
• #30: The first step Is reconnaissance – things that can be done, typically sat at home on your sofa, using open source tools. - mapping tools, web cams etc. - company research on websites, job postings and social media trails - social media (both company based and the personal use of employees) (note that as a consultancy we would likely leave this personal social media out but criminals probably don’t care about individual privacy!) - observing, perhaps from a nearby business, building or car park
• #31: This is the Sec-1 offices on google maps using satellite view!We can already see key features – car park on two sides, main front door, trees and bushes on the other two sides, but no obvious perimeter fences. Fairly quiet area, couple of buildings nearby too. Fairly small based on size of building and number of cars.
• #32: …And again from street view. We can see some colleagues there potentially having a cigarette – it could be an option to follow them in? Again, confirmation that there’s no obvious perimeter defences, padlocks, gates fences etc.
• #33: We can even zoom in on the door – loos like there is some sort of key pad – the numbers will be the 4 most worn keys most probably – some shoulder surfing might give us an idea of what order they go in. It might also be possible to tell at this point if there’s any shutters, turnstiles, a reception area, security guards, etc.
• #34: A quick look over the company website shows an example of an employee – red branded polo shirt and lanyard – if we can recreate these, find a manager on linkedIn that we can fake a meeting for, and walk in confidently, maybe sign the visitor book with a fake name if needed we are in and sorted!
• #35: Once we are on-site we might face a few different challenges!
• #36: Locks and padlocks – sometimes only need a screwdriver.
• #37: … and failing that a set of lock picks. There’s always the options of some heavy bolt cutters, but it looks a lot less conspicuous this way!
• #38: Anti-tailgating devices (turnstiles, etc.) aren’t always this easy to get around! However this recent example gives an idea of how we might get around them - a company in a large building who held a fire drill every week at the same time on the same day where everyone had to evacuate the building would turn off the turnstiles and just open the gates to get everyone back in hassle free – joining in with the crowd and we get ushered in straight away with no issues.
• #39: What do hand warmers have to do with physical security? “Request to exit” doors sometimes have a sensor feature where it detects that a person is present and wants to leave, so opens the door for them. These operate by detecting a combination of heat and movement. A hand warmer on a stick, waved around under the door provides heat and movement, tricking the sensor into believing someone is present and needs to exit.
• #40: On the left here is a Proxmark, and on the right, a keysy. The Proxmark will clone a key card – if someone has left theirs lying around, or you can convince someone to lend you theirs by posing as a door engineer this can quickly be cloned. The keysy does the same thing for RFID devices.
• #41: Shoulder surfing! Protecting against it isn’t easy, it goes back to user awareness and security culture – being aware of what is on desks and screens, and who might be looking when you’re typing in passwords
• #42: We’ve all done this – left our computer unlocked when away from your desk. It starts by turning around to say something to a colleague, and then you go and make a cup of tea, and the computer is left there wide open. An attacker only needs a minute or so to run something like a Rubber Ducky and they’ve got their claws in.
• #43: Again, a strong security culture and user awareness is the only thing that will stop this from happening – learning to press the WIN-L combination every time you turn away.
• #44: Once we are in, or even if we left some of these lying around labelled ‘photos’ and seeing if someone will plug them in for us, we can loo at using one of these devices. We have on the left - a rubber ducky – this will emulate a keyboard and can use it to download further malicious files from our waiting server and then create a reverse shell.The top – a LAN turtle – giving access to the networkThe right – USBKill – this will send -200V repeatedly into whatever it is plugged into wiping them out fairly quickly! And the bottom – a wi-fi pineapple. This doesn’t even need to be plugged in, and someone in a café next door could be using it – this will spoof wi-fi connections, stealing credentials and man-in-the-middle-ing traffic.
• #46: That brings us to the end of our presentation – thanks for watching!