Black Team war stories part four: Keys to the kingdom

Written by: The Black Team

6 min readApr 24, 2017

A ‘Black Team’ assessment is not in itself a new concept within the areas of physical or cyber security, however, its name is. It’s purely an attacking team sitting under the Red Team umbrella of operations.

The objectives may vary, but a Black Team challenges an organisation’s susceptibility to physical based attacks, whether that be through social engineering, media drops, bypassing of barriers, attacking door controls and so on. The assessment itself may also be complemented by tactics such as surveillance, open source intelligence gathering, and the deployment of bugging devices.

War stories

To give an overview of our Black Team operations we thought it appropriate to share some sanitised war stories, highlighting the importance of Black Team testing and how a physical breach might affect your environment.

Keys to the kingdom

The client had provided very specific objectives; gain access to the network and compromise customer data. Only two members of the organisation were aware of the assessment taking place and they were keen to show their CEO how investment must be made into their security programme.

At the beginning of the job, we arranged for a face-to-face briefing with our on-site contacts at a coffee shop away from the target building as we didn’t want to get compromised on the first day.

These types of engagements attract a variety of clients, some have been forced to have an assessment to keep investors happy while some genuinely wanted to understand any security flaws that might exist. This client was very much the latter and wanted to really demonstrate how important security was in the organisation.

During the meet-up, the first question we got asked was about how we were getting on and whether or not we need help getting in.

The client seemed surprised when we said we were doing just fine and had already spent part of the first day setting up shop in one of their many meeting rooms. They were sure that at least their reception team would have challenged us on entry. This was going to be an interesting engagement.

We found out that a security guard protects the building from about 6pm onwards and had been instructed not to let anyone in after business hours. With that in mind, we gulped our coffees and headed back to the target building. We had a lot to do and we wanted to do it when most employees had left for the day.

We ended up working most days until 11pm and ordering pizza to the site. The security guard was getting used to us working late most evenings, and we often had conversations together when we waited for our take-away deliveries.

One evening, we gained access to the clients call centre suite and were fiddling with various computers to see what we could pilfer or compromise, when the guard walked in.

We thought he would become suspicious, but fortunately he’d become so used to us working around the building, he completed his security checks and moved on. Happy days!

With most employees having left for the day, we methodically worked our way around the various offices. We picked the locks on pedestals, found network passwords on post-it notes and lost count of the amount of staff RFID cards left in desks.

One of the RFID cards we found was in the pedestal of the CFO — they were plain white cards, so we swapped it with a blank card so that we could have persistent access across the entire premises. At the end of the engagement, we returned to the CFO’s desk, picked the lock again and placed the card as we had originally found it

We were hacking the client’s network remotely during the day and then spending the remainder of the evening working around across the various offices and floors.

We had deployed remote access network devices, compromised many staff accounts and located customer data.

Although the customer data was stored off-site on secure servers, we were able to steal the VPN certificates for access and re-use known passwords. Call centre staff had also saved recorded customer phone calls and some even contained sensitive data such as bank card details and personal information.

As with all engagements we conduct, as soon as we identify gaping security holes like these, we debrief the client.

Get NCC Group’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

The client was genuinely concerned and wanted to fix it right away, even inviting the company lawyer to the various debriefings. We were only too happy to help them.

A very helpful security guard

We knew the target building had been undergoing works on one of the floors and the physical reconnaissance had identified a very vigilant building manager on the front desk. Sneaking past her was not an option and having spoken to her, I didn’t want to be the one who crossed her. She was professional and helpful, but very vigilant.

We noticed that there was some vacant floor space in the building, so we portrayed ourselves as company scouts looking to rent office space in the area.

We gathered some useful information including building brochures and business cards and we wanted to know how secure the building was after business hours.

They told us there was a security guard during the evening and that he swaps with another guard at the end of his shift. How reassuring!

Previous experience has shown us that security guards are not always as vigilant as they should be so exploiting this guard was probably going to be our way into the building,

We decided to dress as building contractors — and donned high-vis vests, hard hats and tool bags etc. and we returned late one evening in the hope of entering under the assumption that we were building contractors. We explained that we were due to collect some very important paperwork that was needed in order to undertake our building work. Emphasising how important the paperwork was, we asked if it had been left for us to collect. Needless to say, it hadn’t.

The security guard let us inside to check upstairs to see if it was ready. We soon realised that the few staff who remained in the building were very security conscious. This was excellent for our client, although it meant that job wouldn’t be as easy as we first anticipated.

They always closed the doors behind them so tailgating was not an option we could exploit.

We returned to the ground floor and told the security guard that our paperwork was still being prepared and we’d be back shortly to collect it. We also wanted to make sure that most, if not all, personnel had left for the day for our second breach attempt.

Knowing how helpful the security guard had been, and that they often have access to the various floors in the building, we returned once more. Needless to say, no one had left our paperwork at the front desk for us to collect.

We asked the security guard if he could escort us to the floor where we expected the paperwork to be.

Fortunately, the guard was able to escort us up to the target floor right next to the IT team’s desks. The security guard knew that he needed to sign us into the company visitor’s book, but as he left to retrieve it, he made the error of leaving us unescorted beside the IT desks.

In essence, the company had some great policies in place and were genuinely security aware. During the face-to-face debriefing with the client, he was frustrated that we’d breached the site, but was grateful we found a weak link and could provide advice on how to fix it.

For further information, contact: