Black Team war stories part five — Brief, brave & brazen

7 min readMay 2, 2017

Written by: The Black Team

A ‘Black Team’ assessment is not in itself a new concept within the areas of physical or cyber security, however, its name is. It’s purely an attacking team sitting under the Red Team umbrella of operations.

The objectives may vary, but a Black Team challenges an organisation’s susceptibility to physical-based attacks, whether that be through social engineering, media drops, bypassing of barriers, attacking door controls and so on. The assessment itself may also be complemented by tactics such as surveillance, open source intelligence gathering, and the deployment of bugging devices.

War stories

To give an overview of our Black Team operations, we thought it appropriate to share some sanitised war stories, highlighting the importance of Black Team testing and how a physical breach might affect your environment.

Brief, brave & brazen

The client, a global engineering company, was concerned about the security of a satellite office it had temporarily leased to oversee a large project in London.

The target building was multi-occupancy and the reception desk for the main building entrance was only there to greet individuals and answer queries. Entering and leaving was not an issue, but our target leased the top two floors and staff numbers were low. At peak time, they couldn’t have had more than 20 employees on each floor.

The engagement was very short so researching and developing suitable social engineering scenarios would not be possible.

Attempts to take photos of employee passes as they left the building was not realistic either due to the location and the construction work outside the building meant it would look pretty obvious.
It was also raining at the time and standing in the rain for hours on end was not my idea of fun.

We discussed some ideas in a nearby café, but it was very clear that entering covertly was not going to be possible.

We decided to tailgate our way in and deal with any confrontation as it happened. I believe management like to call this approach a ‘dynamic risk assessment’!

We allocated ourselves a floor each and set off to find an employee/visitor to tailgate. My colleague, a very experienced consultant and social engineer, was the first to successfully tailgate his way inside the office — he’d even made himself comfortable in a meeting room.

As I could still see staff through the door window, I was able to provide a running commentary of all activities, highlighting when the coast was clear.

We had planned to wait for the last member of staff to leave their desk, but this didn’t seem likely to happen soon. So, brazenly, my colleague decided to leave his hiding place and take a stroll around the office while still on the phone to me. The remaining member of staff didn’t seem fazed and after a while my colleague reappeared with an RFID visitor pass. Amazing work.

We used the pass to access the top floor where the project managers worked and the reception desk for both floors was located on the top floor too.

There were a few managers still at their desks, so while my colleague pretended to have a phone call in their presence in order to keep an eye on them, I was able to quickly search through the reception desk drawers. They weren’t locked and I managed to find a stash of visitor passes — so I helped myself to one of those.

We reconvened the following day dressed smartly and occupied a meeting room.

With our laptops plugged into the client’s network, we realised that the floor ports hadn’t been activated for the room — which was very annoying.

At this point, my colleague decided to go for a wander around the office and sat down next to a member of staff.

Not a word was said as my colleague blatantly plugged his cable into the network and started running his tools. He couldn’t believe his luck either when the employee left his desk with his computer logged in for several minutes.

Not being one to sit by idly, I focused my attention on the locked cupboard in the corner of the room. A wafer lock was all that stopped me from taking photographs of the sensitive documentation contained inside. I found staff medical records and photocopies of ID documentation. I made a note to highlight this security vulnerability in the final report.

Having noticed that I had about 20 minutes before the meeting room was booked for use, I decided to deploy an audio bug and listen to the meeting from several floors down. Meeting rooms always provide plenty of conversations to listen in on.

We’d been in and out of the offices several times, made cups of coffee in their kitchenette and wandered around.

Get NCC Group’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

We were surprised by the lack of staff vigilance. Our time was nearly up when my colleague spotted the company’s porta cabins outside. They were using fingerprint biometrics to stop people like us gaining access to the site office.

The biometric security system would have been great, but it didn’t prove to be of much use when my colleague borrowed a branded high-vis jacket from the office and flashed his stolen visitor pass at a security guard. To my amazement, he let him in.

On a need-to-know basis

We’d managed to book the hotel opposite the client’s building. This was useful for several different reasons such as the potential to eavesdrop on the conversations of staff in the bar and restaurant. And we could see who was coming and going from the target building.

My open source intelligence (OSINT) gathering hadn’t managed to find much. We knew the client leased its office space and that it was one of several sites across that region of the UK.

As mentioned, it was a small office environment and the staff were likely to know each other. An unknown face tailgating would be challenged in no time. Interestingly, they didn’t use staff ID cards, so we assumed pretending to be an employee from one of its sister sites might be possible.

From our hotel, we were able to find a stairwell to watch from. There were building works going on in our hotel area, so we knew it was unlikely that fellow residents would see what we were doing.
We had our camera with telephoto lens to hand and were able gather a wealth of information. We could see inside the meeting rooms and obtained some superb imagery of the documentation laid out on the tables.

We could also clearly see the computer screens and were able to note when staff started and finished work. It was clear that we didn’t need to attempt access, we could gather everything we needed right there from our hotel.

We knew that attempted access into this environment would be tricky, but we decided to try. With some props in hand, my colleague claimed to be from the leasing company and used the ruse of assessing the fire alarm call points. From my observation point in the hotel, I was able to take photos of him being led around the office space to each call point.

It wasn’t in our scope to do so, but we could have easily injected malicious USB sticks into devices around the offices.

The following morning, I tried my luck by using the pretext of being an employee from one of the client’s sister sites. I researched the addresses, job roles, names of managers etc. in order to prepare myself to answer any questions put to me.

I had to tailgate my way through the first set of doors. Upon approaching the reception desk, I explained who I was in hope that the receptionist would leave me alone with her logged-in computer while she found someone to host me.

A manager invited me into one of the meeting rooms we’d been previously spying on. We’d talked for a while about where I worked, my management and ongoing projects. They were accommodating and even offered coffee.

My colleague and I had suspected the office manager of knowing an assessment was taking place. This was initially the case when my host was called away from the meeting room briefly. I wasn’t particularly worried though as they’d left me alone with some floor ports to take a look at. I rifled through my bag for a Raspberry Pi.

The manager returned and explained that I’d need to come back later as he was somewhat busy. It was very clear that he was aware of the assessment, but he was polite and I remained in character.

Although we’d highlighted some significant vulnerabilities in the client’s security, we also expressed our concerns that more individuals knew of the test than was necessary. When this happens, it’s not our assessment that is impacted but the long term security of the company’s personnel and data.

For further information, contact: