Black Team war stories part three — The confident customer
Written by: The Black Team
A ‘Black Team’ assessment is not in itself a new concept within the areas of physical or cyber security, however, its name is. It’s purely an attacking team sitting under the Red Team umbrella of operations.
The objectives may vary, but a Black Team challenges an organisation’s susceptibility to physical based attacks, whether that be through social engineering, media drops, bypassing of barriers, attacking door controls and so on. The assessment itself may also be complemented by tactics such as surveillance, open source intelligence gathering, and the deployment of bugging devices.
War stories
To give an overview of our Black Team operations we thought it appropriate to share some sanitised war stories, highlighting the importance of Black Team testing and how a physical breach might affect your environment.
A pre-assessment conference call with the client identified two things:
- They had been previously tested by another company that apparently got lucky getting in. As a result, the client confidently predicted that we’d fail.
- They were situated in a multi-occupancy building in a bustling part of London, with a police station around the corner, a 24hr team of security guards and RFID controlled doors. The client had also highlighted that anyone accessing their floor via the main entrance would be greeted by no less than three receptionists — an additional hurdle.
We knew that careful planning would be required for this engagement, so we ran several surveillance and reconnaissance phases, monitored the radio communications of the guards and mapped the CCTV locations.
The open source intelligence gathering found floorplans, staff imagery and internal office and building imagery. Some of this was found in historic leasehold brochures and some on employees’ social media pages.
We knew that all building staff had to show their passes to one of the security guards on entry and fortunately we’d managed to obtain photographs of these during our surveillance of smokers standing outside of the premises. Creating accurate forgeries proved easy enough.
At approximately 7am the following morning, knowing that few staff would be onsite (and more importantly, a lack of welcoming receptionists) entry was gained. Two security guards were manning the main building reception desk, although were clearly too busy chatting to provide much of a deterrent. A “good morning,” accompanied by a wave of my fake pass was enough to keep them happy.
During these assessments, my motto is to always take the stairs; being stuck in a lift with an employee could put you in a situation you don’t want to be in.
I walked up to the client’s offices on the first floor and noted that they were actually using two entrances from the lift lobby. However, it was the cleaners in the reception area who provided me access.
I couldn’t help but smile to myself when I walked past the three empty reception desks, proving ineffective before 8am.
Later on, during the debriefing with my colleague, I highlighted the additional door access on the target floor. By standing at just the right location in the stairwell it would be possible to remain unseen but at the same time observe staff leaving the lift lobby and ultimately tailgate through the door.
We again attempted to gain access to the building, finding success for a second time.
This time it was my colleague who entered and he took so long inside that I feared he’d been caught. When he finally reappeared at our rendezvous point I asked what had happened. He said he’d found the environment so relaxed inside he decided to make use of their tea-making facilities.
Get NCC Group’s stories in your inbox
Join Medium for free to get updates from this writer.
Between us we had deployed network devices, photographed a large amount of unsecured confidential data and had free access to some of their computers.
The target organisation was quite small with no more than 40 employees situated across several office suites on a shared floor. The building itself was also shared occupancy with the obligatory security guard manning the reception desk on the ground floor.
It soon became apparent that none of the organisations in this building used staff passes, which meant staff were unable to verify their identify with the security guard on entry. Brilliant.
I promptly walked into the building to test this theory and up the four flights of stairs; the security guard didn’t seem to pay much interest.
Conducting further reconnaissance inside the target premises is often referred to as Advanced Target Reconnaissance, or ATR for short. This ATR was able to show that the target’s own floor did have a reception desk but it definitely wasn’t manned before 9am and that there was a corridor wrapped around the centre of the building with various offices situated off of it. Our target occupied three of them.
Although our main objective was to ascertain if entry could be gained to individual offices, my colleague and I knew this was going to be a tough target to crack. Being small, it’s not possible to act as a fellow employee. Tailgating would also inevitably fail.
There just didn’t appear to be a way in without being noticed.
Using the pretext of job seeking, it was possible to social engineer the security guards of additional buildings in the compound and gather information around the maintenance company in use across the whole site. With that information, we developed intelligence on that third party for use in a social engineering attack against our target.
Dressed smartly wearing fake ID cards in the name of the maintenance company — and holding a clipboard with fake documentation — we headed straight to the fourth floor.
We had created a pretext of investigating a two-inch crack in one of the windows. However, for some strange reason our fake paperwork didn’t state exactly which window.
After explaining who we were to staff, they were more than happy to allow us access.
Being the thorough and methodical maintenance employees that we were, we painstakingly assessed each window pane. Roaming freely in and out of their offices and around desks, we periodically made notes in the clipboard.
Unbeknown to the target company’s employees, we were filming the breach and noting the various items we could have stolen or compromised. Resisting the urge to walk away with laptops, we pilfered a document as a proof of concept only — a prior agreement with the client if we were to be successful.
Prior to leaving, we both noticed that one very small office remained unchecked. It was the CEO’s and he was on the phone. We mentioned this to the office manager and she kindly called us back when he was finished.
Shortly after, we called our contact to arrange a face-to-face debrief, show the video footage and return the documents we had taken.
For further information, contact:
- Black Team (Physical & Social Attacks) blackteam@nccgroup.trust
Missed the previous editions of NCC Group’s Black Team war stories?
Read part one: https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2017/april/black-team-war-stories-part-one/
Originally published at www.nccgroup.trust.
