Rappelling Off a Roof

http://redteams.net/blog/2013/rappelling-off-a-roof

by sciurus • 12 years ago

157 76 12 years ago

yathern3• 12 years ago

This is something of a dream job of mine. As a college student - does anyone have suggestions of what steps to take to be able to do something like this for a living? I have a small amount of experience with hacking (pen testing my own sites for fun and learning) and I have a decent understanding of a wide range of network security and vulnerabilities. But I don't have very much knowledge on the physical side of pentesting. How would I gain this knowledge, or is it something that you're expected to learn simply from experiences in the field?

theoh2• 12 years ago

Caving is very technical and can involve a lot of rigging ropes for abseil and prusiking (going up). It's not really a career, though, and you need to have access to an area with the right geology for caves. Yorkshire is excellent.

Judging from the "professional" section of the Petzl website, being a steeplejack, rescue crew or arborist (tree surgeon?) is the best way to get to use this equipment and get paid for it.

yathern3• 12 years ago

Thanks for the response - but I think you misunderstood - sorry if I wasn't clear. I'll update my first comment to reflect this. What I mean is, how to I get into pentesting in a way that combines both digital and physical attacks. Though thanks for the tips.

hanley• 12 years ago

I get the feeling that you didn't read the original post.

brianmwaters_hn6• 12 years ago

I just got done with a three year "mini career" in industrial rope access, where I got to work on-rope on wind turbine blades, in oil refineries, on the sides of high-rise buildings, and even one job up in the rafters above a professional football (American football) stadium. I'm now working towards a first job in IT or app dev, so this article is right up my alley. Nice work ;)

If you're interested in a job working on-rope, and, uh, learning the ropes, I suggest you take a look at rope access. It's a small niche industry, but pay is very good, technicians are treated well, and many companies offer an "alternative" work schedule/lifestyle where weeks of travel work are interspersed with weeks of total off-time - and good technicians can sometimes choose how much they want to work (or not work).

If anyone's interested, run a Google search for SPRAT and IRATA (those are our professional certifying bodies), and look on those sites for companies in your country. You'll have to take a week-long course (it's hard) and pass an exam before you're allowed on a job site, but if you have the stuff you'll pass, and most companies are hiring.

fleitz• 12 years ago

Lock your doors, try to get into your house, fix the security issues, try to get in again.

Buy a safe, try to unlock it without the key, buy a better safe, try to get in.

If you're especially lazy, put an ad on craigslist looking to hire janitors, take the resumes, put your name on it, and apply for real janitorial jobs.

yathern3• 12 years ago

Thanks for the suggestions. I've already dabbled into lockpicking as a hobby. I honestly have no idea what you are talking about with the last sentence though. Are you making a joke about the likeliness of making a career in pentesting? Or is this a way of describing how to infiltrate a building by running a long-con as one of their janitorial staff...

maqr• 12 years ago

After a week of recon I found out that the 4th and 5th floors are only accessible with a very specific card via the elevator. I didn’t have that card. Even if I get to the elevator I could not go to the 5th floor

See https://www.youtube.com/watch?v=ZUvGfuLlZus

icedog2• 12 years ago

Interesting that one of those presenters is named Howard Payne. Along with Payne being an elevator company, Howard Payne is the name of the antagonist in 'Speed', who hacks an elevator...

Crito3• 12 years ago

I get the impression that that is not actually his name. ;)

I believe this is his twitter account: https://twitter.com/SgtHowardPayne

kondor6c• 12 years ago

GR1 is a nice backpack, I've got one and it is solid. A little heavy but a nice bag.

nether• 12 years ago

The BD Speed 30 would be more appropriate for this, and costs less than half of the GR1. http://blackdiamondequipment.com/en/climbing-packs/speed-30-...

brianmwaters_hn6• 12 years ago

Shameless plug for Randy Rackliff's packs out of North Conway, NH (the company is called Cold Cold World: http://www.coldcoldworldpacks.com/). They are hand-built, to custom order, in New Hampshire, weigh less than name brand packs, are made of tougher material, AND will only run you about $125.

What's the secret? Simple construction, no bells and whistles and unnecessary crap like water"proof"ing. Tougher, cheaper, lighter. Not made in China by a giant corporation. The ultimate hacker pack!

jonah3• 12 years ago

For the climbing aspect yes, but from the social engineering aspect, it looks less like something a geek would carry as a laptop bag.

scott_karana• 12 years ago

Why the downvotes? If this is a sockpuppet account, it's sure playing a long game:

  created:	1339 days ago

vonmoltke3• 12 years ago

Problem #0: Security did not search his bag on entry, thus allowing him to bring rapelling equipment to a software sales meeting.

Problem #4: Security has inadequate visitor monitoring procedures, thus permitting a visitor who required escort to hide inside the building. No, I am not confusing this with #3; his escorts not bringing him to the front desk or whomever is (or should be) logging visitor arrivals to log his departure.

Crito3• 12 years ago

"Problem #0: Security did not search his bag on entry, thus allowing him to bring rapelling equipment to a software sales meeting."

Realistically, what sort of security guard would actually stop him when they found the climbing gear? Unless they receive some special training, they'd be looking for weapons. The climbing gear would probably raise their eyebrows, but could easily be explained away ("I'm going to my climbing gym later this evening").

Relying on security guards to consider the possibility that their guest might be planning on repelling from the roof down into a secured floor doesn't seem practical.

ecnahc515• 12 years ago

Even that could be accounted for. If you have 'questionable' items, security could ask that you leave them at the front desk, and you can pick them up on your way out.

ChuckMcM• 12 years ago

The security guards were brutal at Intel in the 80's. You had to sign a waiver that gave Intel permission to keep anything you were carrying on your way out. They did it too (confiscate things they felt shouldn't leave the building). Most people were smart and just left everything at the desk.

That said, these days with phones and laptops being nearly attached to the wrists of folks it would be a very hard policy to enforce. Google's solution was conference rooms that were outside the security perimeter and had bathrooms outside the security perimeter as well. That worked pretty well and would have defeated this particular attack.

electromagnetic2• 12 years ago

Speaking as a construction worker, you'd be quite surprised how easy it is to get into places you generally shouldn't with no one asking questions. I don't wear a company uniform and I've gotten onto the roofs of buildings I really shouldn't have, including when I've been sent to the wrong address and I talked to everyone from the property manager to the building owner and everyone helped me.

You'd also be surprised how easily security can be fobbed off by telling them something they've heard a few dozen times before.

You can go to any uniform supply store and pick up some coveralls for a fake company. You would be able to walk into any commercial building with any equipment you want, and excuse it all off with knowing who the property management company is. If anyone asks too many questions you just say "I don't know, I just go where I'm told" and if you're getting nowhere you can get out of dodge by saying "Let me just call the office, make sure they didn't give me the wrong address."

Your #4 assumes he'd be logged coming and going, which in my experience isn't true for construction workers. Also hiding inside the building isn't necessary. He knew his methodology for getting into the place, which meant accessing the roof. Security wouldn't check the roof once the electrical contact shows the door or hatch is closed.

The weakest link in security is human nature. Build me the most complicated lock in the world, and it's only valuable if people remember to lock it and you can't get them to unlock it for you.

RankingMember2• 12 years ago

Reminds me of this (artist undertook "Guerrilla Public Service", donning CalTrans worker garb and modifying a highway sign to be more helpful to motorists): http://www.laweekly.com/2009-12-31/la-life/richard-ankrom-s-...

"The sign was so authentic that Caltrans officials let it remain in place for eight years, four months and 15 days, until its removal last month under a standard scheduled replacement. "

vonmoltke3• 12 years ago

Speaking as a construction worker, you'd be quite surprised how easy it is to get into places you generally shouldn't with no one asking questions.

No, in general I'm not. At a place where the mere location of the main server room is confidential information, though, I would be very surprised.

Your #4 assumes he'd be logged coming and going, which in my experience isn't true for construction workers.

It was true of every defense contractor facility I have ever been to.

Also hiding inside the building isn't necessary. He knew his methodology for getting into the place, which meant accessing the roof. Security wouldn't check the roof once the electrical contact shows the door or hatch is closed.

Well, I was counting on the roof as inside the building; I wasn't clear on that. Still, security should have known the door had been opened at some point, and done due diligence with facilities to find out if there was a reason

The weakest link in security is human nature. Build me the most complicated lock in the world, and it's only valuable if people remember to lock it and you can't get them to unlock it for you.

Absolutely correct, which is why training and awareness are the most important features of an effective physical security plan.[1]

Basically, I keyed off the author's statement that this client has security and started thinking, WWDSSD[2]? The items I mentioned in my original post are items I would flag if I were inspecting a facility, in addition to what the author mentioned.

[1] Shit, I'm starting to sound like a fucking DSS training pamphlet.

[2] What Would the Defense Security Service Do

IgorPartola• 12 years ago

My dad used to work at a classified facility in the USSR that dealt with satellites. Naturally, they had pretty strict security for things going in and out. At the same time, they had ridiculous amounts of overstocked construction materials. My dad's friend told me a story once about how he and my dad got a bundle of copper piping out of there in front of the security guards.

The two of them grabbed the bundle of pipes, and carried it to the front door, then put it right outside of the front entrance to the main building and pointed it at the gate, which was about 40 meters away. They then flipped it over at the far point, and counted "one!". Then again: "two!". And so on. This way they got to the gate, and then simply continued across the street, continuing to count. According to the different versions of the story (it's been told more than once), they either acknowledged the guards, or pretended to be super concerned with the counting. In either case, the piping went into the walls of my dad's friend's apartment shortly after and been there ever since.

P.S.: Apparently, one of the people in their group also managed to sneak out a power drill (not as common back then), by tying it between his legs in a pair of large pants.

hadoukenio• 12 years ago

I wonder how many people stopped half way and searched for "GORUCK GR1".

Now I wonder if I just read a cool blog post with product placement.

MrBuddyCasino• 12 years ago

And lets not forget the Black Diamond ATC Guide and the Petzl Tibloc!

dmix2• 12 years ago

The blog has a whole section on 'gear' as well. Maybe it's the monetization strategy?

InclinedPlane• 12 years ago

The BD ATC is perhaps the most popular belay/rappel device around, even if everyone who read this article went out and bought one it probably wouldn't affect their overall sales much.

Systemic33• 12 years ago

That's a very good point. The post seemed to skip all the juicy actual security bits, but made sure to explain thoroughly how good the rucksack was, how everything fit into it nicely, and how it was waterproof.

dpeck• 12 years ago

maybe, but I think its something that goes with the territory, every pentester I know is borderline obsessive about their bags.

ZoF3• 12 years ago

http://redteams.net/rules

Rule 57:The GORUCK Rule - Under promise and over deliver.

Rule 69 also references the GoRuck founder

So they either really like the bag, or they're in some way advertising for it.

Alupis• 12 years ago

he forgot his amazon affiliate link ;)

bm1362• 12 years ago

Climbing tends to have a gear culture.

joelrunyon• 12 years ago

Sidenote: that's an awesome bag. Crazy expensive but an awesome bag. (If you're feeling extra badass - try one of the challenges).

lordbusiness2• 12 years ago

Crikey! As an avid rock climber reading this, I'm terrified for the author's safety. :-)

wingerlang• 12 years ago

Well he did say "I have more than 15 years experience as an alpine and rock climber, I am trained in high-altitude rescue and rope safety." at the bottom.

lordbusiness2• 12 years ago

Then promptly described a rig that no climber would use in their right mind. :-)

pbhjpbhj• 12 years ago

This reads as a fictional advert for a backpack.

jrwoodruff• 12 years ago

Has to be.

the GR1 protected the laptop really well, by the time I was inside the 5th floor it was pouring outside and the laptop and gear remained dry.

What does that have to do with anything? Don't know, don't care. Just sad that this is the top post right now, complete with supporting commenters/marketers.

dsjoerg• 12 years ago

One part I didnt understand: if the rope is attached to a solid object on the 7th floor, how did s/he retrieve the rope once inside on the 5th floor?

morganm• 12 years ago

It sounds like he looped/threaded the midpoint of the rope around something and then rappelled on both strands. Once back in the building he could pull either end to retrieve the rope.

brianmwaters_hn6• 12 years ago

That, or rappelled on one strand and used a classic pull-through anchor: https://www.youtube.com/watch?v=SSGUPd6RKAM

jonah3• 12 years ago

Possibly either loop the rope and descend on both ends - once inside retrieve by pulling on one end, alternately, use a knot that only holds under tension, once inside, shake rope to release knot, finally, it could be fantasy and the author didn't consider that detail.

brianmwaters_hn6• 12 years ago

Watch out! That technique is really sketchy, and won't work if the rope goes over an edge (like the edge of the building). You also have the problem of a falling metal object that can smash windows, your head, or itself.

steveax2• 12 years ago

A 70m rope (depending on the building) should manage 7 floors with a double strand (only just, and you'd want to use some webbing to anchor to the edge). The fact that he mentions a tibloc indicates he was rapping on a single strand though as that device would not handle a double strand ascension. I doubt I'd be comfortable anchoring to an AC unit though. Also, really, don't try this at home. There are lots of non-obvious hazards here. For instance, climbing ropes are incredibly strong and in practice, just don't break, unless, oh, say, they are weighted over a sharp edge like the corner of a building. And no, do not try the "shake the (insecure) knot free" technique, really. Rappelling is (statistically) very dangerous as it is one of the few situations in climbing where you are trusting your life to a single point of failure (redundancy is good! and is probably responsible for more deaths than climbing falls are [1]

[1] http://publications.americanalpineclub.org/search/solr?all=R...

jberryman• 12 years ago

Is this a real thing, or is this whole site just sort of autistic ramblings of a wannabe spy? I guess I'm inclined to believe the story only because it's not particularly exciting as fiction.

mabbo• 12 years ago

My job will never be as cool as this guy's job.

jpdlla• 12 years ago

Those GORUCK GR1 rucksacks are insane.They even have a "bombproof compartment".

http://www.goruck.com/en/GR1

RankingMember2• 12 years ago

I kept looking for what exactly made it "bomb-proof" in the product description, but saw no mention of any plating or kevlar or anything, so it seems like a suspicious claim.

redteamer• 12 years ago

Throwaway here. A couple years back, we thought about hiring this guy for a security assessment, so we looked into him.

He didn't check out. He appears to be lying about his military background in Israel and has little in terms of information security skills. No certifications. Nobody in the field knows him. He refuses to provide any proof of his claims. His blog posts are vague ramblings without real substance.

He's what's known as a "charlatan" in attrition.org lingo. I'm not sure why he hasn't been called out by Attrition yet, but he's probably flying below their radar.

You can easily find his real name and do some Google and Archive.org searching and see that none of his story or timelines check out. He did work in an entry-level security position for a Waltham, MA company for a short time.

The best I can tell is that he's an EDC gear junkie with dreams of being a spy.

PS: He is not affiliated with the fine people at GORUCK.

snowwrestler2• 12 years ago

It's obviously made up. Rappelling this way would not work and you would have a good chance of killing yourself.

When rappelling with an ATC you lock the rope off, and control your speed, by pulling the free end of the rope downward. Feeding your slack out of a backpack you're wearing would force your hand upward as the slack came out and the rope started to bind on that tiny hydration hose hole. If you're lucky the whole system would lock up; if you're not lucky you'd lose control of the rappel and fall.

For future reference the way to rappel with a rope is to stack it into the pack, open the pack up nice and wide so the rope will feed freely, then clip the pack to your harness with a sling so it hangs below you. Or use a rope bucket, which is expressly designed for this purpose.

bofh69• 12 years ago

I didn't read the blog post as a step by step instruction, more like some commercial for the bag.

I've done quite a few rapells and sometimes keep my rope in my closed rope bag on my back (with compression cords in place) if there is a large risk of the rope getting entangled with the environment, I'm on a bridge over a road or I'm on a cliff above salt water.

I use a french prusik on the rope below the ATC and pull the rope out of the bag at the same time as I pull down the prusik. Often the rope gets slightly stuck, a harder pull on the rope has freed it for me every time and I never take care when putting the rope in the bag so I would think a proper packing of the rope would decrease that risk a lot. Should the rope get really stuck I would simply take off the bag and open it up while hanging in the harness. Not a big deal at all.

pistle• 12 years ago

This is like a deep ad for backpacks, right? Alpha Mac Infosec Warrior thing - like if you love minimalism and jingoistic tech-spy novels, we've got the gear for you?

I prefer that to the alternative - that someone is purring while looking at OCD pocket dumps of watches, wallets, pocket knives, and patches.

Rappelling Off a Roof

Related Stories