I'll Let Myself In: Tactics of Physical Pen Testers (2017) [video]

https://www.youtube.com/watch?v=rnmcRTnTNC8

by 333c • 7 years ago

209 24 7 years ago

youtube.com

333c• 7 years ago

Previous discussion: https://news.ycombinator.com/item?id=18203270

spacedog11• 7 years ago

This is fascinating. Thanks for sharing

jedimastert• 7 years ago

Deviant Ollam has some of the most informative and approchable physical security and pen testing talks out there. He's great.

farisjarrah• 7 years ago

Deviant Ollam is great, so informative. I feel like another great conterpoint to Deviant Ollam is the Lock Picking Lawyer on youtube and reddit:

https://www.youtube.com/channel/UCm9K6rby98W8JigLoZOh6FQ

He really doesn't waste any time and just gets in there and picks or tears down locks and tells you exactly how good or bad a lock is.

QuadrupleA• 7 years ago

I somehow got recommended LPL via the YouTube algorithm, his videos are great - and slightly wrong somehow, a lawyer compiling a hoodlum's dream encyclopedia on how to get through any lock :).

danpalmer• 7 years ago

He’s great at what he does professionally.

I get the impression from his talks that he holds some views that may be quite exclusionary - there a some throwaway sexist comments and some political views that some may find uncomfortable or exclusionary.

Watch his talks for his content, if you are ok with these things, but not everyone may be ok with his personal side. That doesn’t matter to everyone when it comes to technical topics though.

Edit: FWIW, I seem to remember this particular talk and the Elevator hacking one mentioned in another thread are fine. I believe it was several layers down the YouTube rabbit hole that I started to hear comments that I objected to.

debt2• 7 years ago

Walk confidently and never make eye contact. Easiest way to get into anywhere. It forces people to verbally call you out which people rarely do.

Looking lost or "looking for something" while wandering in is another great tactic.

Spooky23• 7 years ago

I worked in a mall as a teenager and rolled a big safe across the mall through the mall to a shared loading dock for the store owner.

Rent a cop guys blocked my way at the door challenged me, and I just said “Wtf does it look like I’m doing, I’m moving a safe, get that door!”

So they opened the door, and I rolled the safe into a white rental van and got in the passenger side without incident.

c22• 7 years ago

I agree with "walk confidently" but I find making eye contact, smiling, nodding, or even saying "hello" while you pass does wonders to subdue people's suspicions.

debt2• 7 years ago

I agree, but it requires quickly reading the situation. Sometimes it can be as effective as not making eye contact.

bitbang• 7 years ago

It's more the reason why you avoid eye contact. Looking nervous while shifting eyes to avoid eye contact looks suspicious. Avoiding contact because you are otherwise distracted thumbing through forms in a clipboard makes it look like you have a purpose for being there.

chaoticmass• 7 years ago

Obligatory Sneakers scene reference:

https://www.youtube.com/watch?v=oG5vsPJ5Tos

MichaelApproved• 7 years ago

That was a great movie and the scene was fantastic but none of the tactics OP mentioned were used there.

maxxxxx• 7 years ago

I remember when I was contractor I had to get some screens from another building to kick off the project. They didn't have badges, just somebody at reception. I walked in, took screens almost $30000 worth, carted them out and left. This was my first day, nobody knew me, but nobody challenged me. Only afterwards I realized how crazy this was.

agumonkey• 7 years ago

look like you belong, the more psychopatic you can ignore the fact you're crossing the line and act if you're everybody's friend the better

centizen• 7 years ago

Ollam is top class, he manages to get so much good information across without getting long winded, and never sounds condescending.

chris_wot• 7 years ago

You probably should also look at "The Search for the Perfect Door", pretty fascinating.

https://www.youtube.com/watch?v=4YYvBLAF4T8

thejenk• 7 years ago

Deviant Ollam does another talk with elevator consultant Howard Payne just about elevator security which is fantastic. It's very similar to this one, but goes deeper into the single subject. There are a few versions on YouTube of various lengths, but here's the 2 hour version: https://youtube.com/watch?v=ZUvGfuLlZus

donatj• 7 years ago

It's nice to see this getting some love but a little bitter sweet because I posted it a year ago and it went nowhere. Oh well.

Deviant Ollam is always an interesting listen. He's got a very good way of explaining things in understandable layman's terms.

aszantu• 7 years ago

Interesting

DigitalTerminal• 7 years ago

20:22 how does this help with underdoor tools you can still pull the lever down, cant you?

tzs• 7 years ago

What people can do without anyone noticing is unbelievable.

Once upon a time, I worked at a Unix workstation manufacturer [1], which was having some financial problems.

The hardware developers worked in a room in the center of our offices. It had no windows, and one door to a hallways. If you went right down that hallway, you would pass my office and another programmer's office on your left, and my supervisor's office and the office of the head of software on the right, and then reach the back door to the office.

If you went left, you'd have to go past the reception desk and through an open area to reach the front door. Next to the front door was the office of the guy in charge of engineering.

The way the desks were arranged in all four offices in my hall, and in the engineering head's office near reception, you could easily see if anyone walked by.

The hardware developers had a large format printer in their area. That thing was something like 5 ft side, 4 feet tall, 3 feet deep, and weighed maybe 300 lbs.

One morning they printed something just before noon, then went to lunch. When they got back from lunch maybe 30 minutes later, the printer was gone. During the time they were out of the hardware area, I was in my office, and at least two other people were in their offices in my hall. The receptionist was at the front desk the whole time, and the engineering head was in his office.

None of us saw what happened to the printer. Later that afternoon the company we rented it from called and said that they had successfully repossessed it from us, so apparently a couple repo men managed to stroll into the office, passing several people, walk into the hardware area, disconnect the printer, and walk out with it, with nobody noticing.

Our office was just engineering. Sales and admin were in a different building in the same office park. Manufacturing, shipping, and the warehouse were in a third building there. Meetings with outsiders, even outsiders who were there to meet with engineers, took place in the conference rooms in the sales/admin building. We generally didn't have visitors in the engineering building except when interviewing someone for a job, and we always knew when those were expected.

[1] Callan Data Systems

I'll Let Myself In: Tactics of Physical Pen Testers (2017) [video]

Related Stories