Socially Engineering Myself into High Security Facilities
Story copy-pasted without the gifs:<p>Hello! My name is Sophie and I break into buildings. I get paid to think like a criminal.<p>Organizations hire me to evaluate their security, which I do by seeing if I can bypass it. During tests I get to do some lockpicking, climb over walls or hop barbed wire fences. I get to go dumpster diving and play with all sorts of cool gadgets that Q would be proud of.<p>But usually, I use what is called social engineering to convince the employees to let me in. Sometimes I use email or phone calls to pretend to be someone I am not. Most often I get to approach people in-person and give them the confidence to let me in.<p>My frequently asked questions include:
What break-in are you most proud of? 
What have you done for a test that you were the most ashamed of?<p>What follows is the answer to both of these questions.<p>A few months ago, a client had hired me to test two of their facilities. A manufacturing plant, plus data center and office building nearby.<p>First step: open source intelligence, or OSINT. I look at maps, satellite images, study what I can of their delivery and supply schedules, and so on.<p>The manufacturing facility looked like a prison. No windows, heavy iron gates, no landscaping. Generally a monstrosity of architecture.<p>This facility had armed guards, badge readers, biometric security controls and turnstiles at every entrance.<p>I remember thinking, &quot;It&#x27;s got to be hell to work in there. I wonder if I can use that…&quot;<p>One thing was for sure… The chances of tailgating (following behind an employee with valid credentials) into this building were next to non-existent.<p>I was going to have to get down and dirty with my social engineering.<p>First stop: LinkedIn. Your LinkedIn is my best friend. The more information you have on your LinkedIn, the more options I have.<p>I have several fake LinkedIn profiles that you are probably connected to.<p>I scour profiles of employees who work at these facilities, and cross-reference them to other social media sites. And I find a lovely young woman who I&#x27;m going to call Mary.<p>Mary was a brand-new hire working as an assistant at the manufacturing facility. Mary had a public Facebook account too.<p>On Mary&#x27;s public Facebook account, she documented all of her family&#x27;s adventures.<p>Side note: Now I know where Mary went to high school, her mother&#x27;s maiden name, the names of her pets, etc.<p>Answers to those &quot;security questions&quot; you use to reset your passwords are very easy to find if you aren&#x27;t careful with that information.<p>Not to mention that now I know where Mary works, where her kids go to school, where they vacation…I could go on. Scary stuff.<p>This is not an advanced investigation. I&#x27;m not a private investigator and I don&#x27;t have the resources of the NSA. But I can do a lot of damage with simple methods.<p>Most notably to me, there were photos Mary posted of her time volunteering with a certain maternity support center.<p>Her passion for children and caring new moms was very plain. So of course, I took advantage of it.<p>For this assessment I played two roles. For the first, I spoofed my phone number to make it look like it was coming from the company&#x27;s headquarters.<p>I called the front desk of the manufacturing facility and was transferred to Mary. &quot;Hi Mary!&quot; I said, &quot;My name is Barbara.&quot;<p>&quot;I am a project coordinator with facilities management. We are renovating a few of our facilities. We are sending an interior designer out to you tomorrow so she can put together proposals to update your space!&quot;<p>Mary replied, &quot;Well that&#x27;s great! But why the short notice?&quot; I could feel her getting suspicious, so I pulled out my trump card…<p><i>Sigh</i> &quot;Well Mary… You really should have heard from me sooner. I&#x27;ve just been so overloaded at work…I feel like I can&#x27;t catch up, and to top it off the baby is due in 6 weeks. If my boss finds out I messed this up he&#x27;s going to flip.&quot;<p>I was really getting into this, voice shaking. (Yes, I know, I&#x27;m a terrible human being.)<p>She cut me off, &quot;Oh hunny, hunny it&#x27;s ok. We will work this out! Tell me about the baby! Is it your first? Boy or girl?!&quot;<p>Our Mary was committed at this point. Not because she is stupid, but because she is a good person. She wanted to help me.<p>We talked babies and birth plans for a while (never pick a pretext you can&#x27;t speak about at length.)<p>Mary took down the name of the &quot;designer&quot; who was coming by the next day and we said our goodbyes. Mary could have saved her company a lot of heartache by simply verifying that I was who I claimed to be. (Just to be clear here, I would never give out Mary&#x27;s real identity. I&#x27;m not totally heartless. This could have happened to anyone. She has not been fired.)<p>I showed up the next day as &quot;Claire&quot; with a fictional architecture firm that I had made business cards and a website for. My alter-ego Barb had done most of the leg work for me. When I arrived, Mary and her boss were waiting for me with smiles. I shook hands all around and handed them the business card I printed out the night before. I was given a visitor badge and the red carpet was rolled out.<p>I gained rapport with the staff there by asking them to tell me what they wanted in an office space. They were so excited. I might have claimed to be on the team that put together the Google offices…(Yes, I am HORRIBLE. This is my inner demon child.)<p>&quot;You want a standing desk? New chairs over here?! Ergonomic keyboards for everyone! Let&#x27;s look at swatches!&quot;<p>We became best buds. I was given complete and unaccompanied access to the facility where I stayed for several hours.<p>I gained network access and stole several thousands of dollars in physical primitives by picking my way through cheap locks (credit to Deviant Ollam for the rad lockpicking animations.)<p>This client had been pretty confident that I wouldn&#x27;t get into either facility, much less be able to hit both in a short time span. So the timeline was left to my discretion, but it was assumed that I would need to fly to the area twice.<p>I didn&#x27;t see the need in burdening them with two round-trip expenses.<p>I went back to Mary&#x27;s office and said, &quot;Well I think I have what I need from here. How do I get to the office center?&quot;<p>She looked at her watch and said, &quot;It&#x27;s almost lunch time. I&#x27;ll take you there!&quot; A whole group of us piled into the parking lot, and they took me to a nearby taco shop. That&#x27;s right. My Marks took me to get tacos… I love my job.<p>After lunch they drove me to the offices and a few of them came in with me to show me around.<p>I took FOREVER looking around this office space, and eventually they said their goodbyes because they had to go back to work. They had a strict policy of escorting visitors. But I had been seen walking around with trusted insiders so no one questioned me.<p>I was free to take my time. I made myself at home. My main objective at this site was to weasel my way into private corner offices.<p>When I accomplished my goals, I tracked down my point of contact&#x27;s office. This is the man who hired me in the first place. This is the best part of every job.<p>Steve was there, hard at work when I disturbed his groove by knocking on the door. He glanced up, &quot;Hi there, can I help you?&quot;<p>I smiled. &quot;Hi Steve! I&#x27;m Sophie from Sincerely Security. It&#x27;s nice to meet you in-person!&quot;<p>I will never forget the look on his face… Pure gold. &quot;Who?.... Wait, what? How? How did you get in here?!&quot;<p>We stayed in his office and talked for a long time. I went over exactly the steps that could have prevented my success. First of all, the desire to help others is human and natural. We don&#x27;t want to discourage that.<p>Second, I&#x27;m sure they did have some sort of policy that required visitors to check in showing government issued identification, but they weren&#x27;t following it.<p>We also need to post by every computer, phone and door: &quot;TRUST, BUT VERIFY.&quot;<p>An employee who does their homework can ruin my day.<p>Third, if it seems too good to be true, it probably is.<p>Is your company going to hire the team who designed Google&#x27;s offices? Magic 8 ball says no.<p>Lastly, the team who took me to the second location should have found someone else to escort me through the building.<p>I&#x27;ve been doing this job for a couple years now, and almost every job is a variant of this story. Very rarely do I go through an entire assessment without some sort of social engineering.<p>There are ways to protect yourself and your company from attacks like this. I think it starts by sharing stories like these, and educating and empowering each other to be vigilant.