Black Team war stories — Part one
Written by: The Black Team
A ‘Black Team’ assessment is not in itself a new concept within the areas of physical or cyber security, however, its name is. It’s purely an attacking team sitting under the Red Team umbrella of operations.
The objectives may vary, but a Black Team challenges an organisation’s susceptibility to physical-based attacks, whether that be through social engineering, media drops, bypassing of barriers, attacking door controls and so on. The assessment itself may also be complemented by tactics such as surveillance, open source intelligence gathering, and the deployment of bugging devices.
War stories
To give an overview of our Black Team operations we thought it appropriate to share some sanitised war stories, highlighting the importance of Black Team testing and how a physical breach might affect your environment.
The weather during the planned week of testing was scorching, the target building was situated in a very closed environment and all staff knew each other.
During the day there were fire doors left propped open and many opportunities for an opportunist attacker to remove things.
This tactic wasn’t in our interest and doing so would not emulate the abilities of covert and methodical attackers. A Black Team wants its true activities to stay undetected (for a period of time at least, if not indefinitely).
Long term static surveillance was not possible without being noticed so we had deployed covert cameras in bushes around the car park.
Through this, and our online intelligence gathering, we confirmed that employees didn’t use staff ID cards or lanyards, however, using a pretext of being a member of staff during peak time would be out of the question.
The security for the building came in the shape of a four-digit pin pad and an alarm system which was switched on outside of office hours.
Using a low-tech attack we were able to compromise the pin pad by marking the individual pins with a felt-tip pen at about 7am and subsequently returning after office hours to assess the fingerprints and remaining markings.
Knowing that the first few staff members would have inadvertently displaced the markings for us, to this day I often wonder at which point those few staff members became bemused by the green ink inexplicably smudged across their index fingers.
Once the four digits of a pin pad are known you only have 24 possible key combinations, the brute forcing for this particular assessment didn’t take very long.
Having conducted our initial surveillance, we knew when the first and second employees were expected to show up; 7:30am and 7:40am respectively.
We also knew that the first member of staff would head straight to the first floor to open all of the roof windows — our OSINT gathering had identified planning applications for these windows from years earlier, made due to the excessive temperatures inside the office in the summer months.
With that intelligence to hand we planned our infiltration whereby one consultant would maintain a brief static observation post, controlling the entrance, car park and road in order to provide a running commentary and heads-up of any approaching staff. The second would conduct the infiltration and deploy a remote-access network device inside the building.
At 7:30am the first member of staff arrived. And as expected, he went to open the windows upstairs providing us the opportunity we needed to gain access, deploy audio bugs and a network device.
Get NCC Group’s stories in your inbox
Join Medium for free to get updates from this writer.
For a brief moment it seemed that the second member of staff had arrived earlier than expected, at which point the consultant inside was given the “stand-by” message, as he attempted to hide under the (unusually small) reception desk.
Luckily for us it was a false alarm allowing the operation to continue. During that week we were able to access the building covertly on a number of occasions and extract a significant amount of our client’s own confidential customer information.
Physical reconnaissance had taken place and the open source intelligence gathering exercise had yet again identified internal office imagery and staff ID cards. The cards were replicated in readiness for a suitable breach scenario.
This building was a cross between an office and warehouse. It was like a mini fortress. It has CCTV everywhere, RFID controlled anti-tailgate barriers were installed and a security guard manned the small side office to deal with visitors and deliveries.
As is often the case in these exercises, time is limited and so organising a meeting to get us in can be tricky and time consuming.
The intelligence picture at this point was not developed enough to confirm exactly which business units sat inside. Developing that further could cost us a lot of time we didn’t have.
We brain dumped some ideas over a brew in a nearby cafe until we had something suitable to build upon. It was clear that targeting the security guard was the only way in, but to do that we needed to develop a situation whereby the security guard would not just let us in, but would be in his interest to do so.
Outside of the target building we stood in clear view of the security guard at his desk, while we overtly pointed at the CCTV cameras and made notes in our clipboard. We wore high-vis jackets with the company name printed on, the correctly coloured lanyards and forged ID cards.
Approaching the small reception room where he was sat, the clipboard was placed on his desk while we rifled through the fake paperwork and proceeded to explain who we were. and what we were doing.
We told him that we work out of the Crawley office auditing the physical security controls for the corporate estate. And that we have the authorisation documents should he need them.
Without allowing him to jump in and ask any questions, we stated that we would be auditing both the internal environment and will also be assessing the site’s external controls.
The key for us here was to be seen as authoritative figures, as opposed to asking for his permission.
One of the team even asked the security guard to fill in a security questionnaire and asked him if he wanted us to wait in his office while he completed the form.
Safe to say that the offer of us standing over him while he completed it was turned down, to which we promptly told him that we would grab a coffee from the canteen before getting started and we proceeded to ask him to allow us access to the building.
We did actually collect the security guard’s completed questionnaire on our way back out!
For further information, please contact:
• Black Team (Physical & Social Attacks) blackteam@nccgroup.trust
Originally published at www.nccgroup.trust.
