Table of Contents

Title Page

Copyright Page

Dedication

Preface

Who this Book Is For

What this Book Covers

How this Book Is Structured

What You Need to Use this Book

Acknowledgements

Foreword

Chapter 1 - The Basics of Physical Penetration Testing

What Do Penetration Testers Do?

Security Testing in the Real World

Legal and Procedural Issues

Know the Enemy

Engaging a Penetration Testing Team

Summary

Chapter 2 - Planning Your Physical Penetration Tests

Building the Operating Team

Project Planning and Workflow

Codes, Call Signs and Communication

Summary

Chapter 3 - Executing Tests

Common Paradigms for Conducting Tests

Conducting Site Exploration

Example Tactical Approaches

Mechanisms of Physical Security

Summary

Chapter 4 - An Introduction to Social Engineering Techniques

Introduction to Guerilla Psychology

Tactical Approaches to Social Engineering

Summary

Chapter 5 - Lock Picking

Lock Picking as a Hobby

Introduction to Lock Picking

Advanced Techniques

Attacking Other Mechanisms

Summary

Chapter 6 - Information Gathering

Dumpster Diving

Shoulder Surfing

Collecting Photographic Intelligence

Finding Information From Public Sources and the Internet

Electronic Surveillance

Covert Surveillance

Summary

Chapter 7 - Hacking Wireless Equipment

Wireless Networking Concepts

Introduction to Wireless Cryptography

Cracking Encryption

Attacking a Wireless Client

Mounting a Bluetooth Attack

Summary

Chapter 8 - Gathering the Right Equipment

The “Get of Jail Free” Card

Photography and Surveillance Equipment

Computer Equipment

Wireless Equipment

Global Positioning Systems

Lock Picking Tools

Forensics Equipment

Communications Equipment

Scanners

Summary

Chapter 9 - Tales from the Front Line

SCADA Raiders

Night Vision

Unauthorized Access

Summary

Chapter 10 - Introducing Security Policy Concepts

Physical Security

Protectively Marked or Classified GDI Material

Protective Markings in the Corporate World

Communications Security

Staff Background Checks

Data Destruction

Data Encryption

Outsourcing Risks

Incident Response Policies

Summary

Chapter 11 - Counter Intelligence

Understanding the Sources of Information Exposure

Social Engineering Attacks

Protecting Against Electronic Monitoring

Securing Refuse

Protecting Against Tailgating and Shoulder Surfing

Performing Penetration Testing

Baseline Physical Security

Summary

Appendix A - UK Law

Appendix B - US Law

Appendix C - EU Law

Appendix D - Security Clearances

Appendix E - Security Accreditations

Index

This edition first published 2009

© 2009, John Wiley & Sons, Ltd

Registered office John Wiley & Sons Ltd, The Atrium, Southern Gate, Chichester, West Sussex, PO19 8SQ, United Kingdom

For details of our global editorial offices, for customer services and for information about how to apply for permission to reuse the copyright material in this book please see our website at www.wiley.com.

The right of the author to be identified as the author of this work has been asserted in accordance with the Copyright, Designs and Patents Act 1988.

All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, photocopying, recording or otherwise, except as permitted by the UK Copyright, Designs and Patents Act 1988, without the prior permission of the publisher.

Wiley also publishes its books in a variety of electronic formats. Some content that appears in print may not be available in electronic books.

Designations used by companies to distinguish their products are often claimed as trademarks. All brand names and product names used in this book are trade names, service marks, trademarks or registered trademarks of their respective owners. The publisher is not associated with any product or vendor mentioned in this book. This publication is designed to provide accurate and authoritative information in regard to the subject matter covered. It is sold on the understanding that the publisher is not engaged in rendering professional services. If professional advice or other expert assistance is required, the services of a competent professional should be sought.

ISBN 978-0-470-74761-2

Typeset in 10/12 Optima by Laserwords Private Limited, Chennai, India

Printed and bound in Great Britain by Bell & Bain Ltd, Glasgow

To Nique for being herself and to my family for supporting
and inspiring me.

Preface

This is a book about penetration testing. There is nothing innately new about that - there are dozens of books on the subject but this one is unique. It covers in as much detail as is possible the oft overlooked art of physical penetration testing rather than, say, ethical hacking. We won’t teach you how to use port scanners or analyze source code. There are plenty of places you can learn about that and, to a certain degree, if you’re reading this book then I’m going to assume you have grounding in the subject matter anyway. The purpose of this book is twofold: to provide auditing teams with the skills and the methodology they need to conduct successful physical penetration testing and to educate those responsible for keeping attackers out of their facilities.

My personal experience in physical penetration testing began about seven years ago when, following a scoping meeting to arrange an ethical hacking engagement at a data centre in London, the client asked almost as an aside, ‘By the way, do you guys do social engineering, that sort of thing - you know try and break in and stuff?’. I responded (like any junior consultant sitting next to a senior salesman) that of course we did! As it turned out we thought about it, decided to give it a shot and . . . failed. Miserably. Not surprisingly.

My team and I were hackers, lab rats. In effect, we didn’t know the first thing about breaking into buildings or conning our way past security guards. This is a situation now facing an increasing number of ethical hacking teams who are being asked to perform physical testing. We know it needs to be done and the value is obvious, but where to begin? There are no books on the subject, at least none available to the general public (other than the dodgy ones on picking locks published by Loompanics

Unlimited). So I decided to fill the void and write one. It has a special emphasis on combining physical testing with information security testing simply because ethical hacking teams are most likely to be employed for this kind of work (at least in the private sector) and because ultimately it’s your information systems that are the most likely target for any attacker. However, anyone with a need to understand how physical security can fail will benefit from this book - the culmination of a number of years of experience performing all manner of penetration testing in all kinds of environments.

Who this Book Is For

Anyone who has an interest in penetration testing and what that entails will benefit from this book. You might have an interest in becoming a penetration tester or you might work in the industry already with an aim to learn about physical penetration testing. You might want to learn how attackers gain access to facilities and how this can be prevented or perhaps you’re considering commissioning a physical penetration test and want to learn what this involves.

This book is written for you.

What this Book Covers

Unauthorized Access discusses the lifecycle of a physical penetration test from start to finish. This starts with planning and project management and progresses through the various stages of execution. Along the way, you’ll learn the skills that are invaluable to the tester including social engineering, wireless hacking, and lock picking.

The core subjects discuss what takes place during a physical penetration test, what you can expect and how to deal with problems. Equipment necessary to carrying out a test is given its own chapter.

Chapter 9 includes case studies that draw on my own personal testing experience, which I hope will inspire you. Chapters 10 and 11 focus on protecting against intruders and corporate spies and how this relates to the cornerstone of information security; the security policy.

The appendices deal with miscellaneous subjects such as law, accreditations and security clearance.

How this Book Is Structured

The two most important chapters in this book are Chapter 2 and Chapter 3. These contain the core theory and practice of physical penetration testing. The chapters that follow it discuss in depth the skill sets you will be required to master:

• Chapter 4 - This chapter discusses how to manipulate human nature. Social engineering is the art of the con man and probably the single most crucial set of skills you will learn. The practice of these skills is at the core of any successful operating team.

• Chapter 5 - Generally this concerns defeating locks. This chapter assumes no previous knowledge and these skills are not difficult to master. This is a crash course.

• Chapter 6 - Knowledge is power; the more you have the more powerful you become. This chapter covers the basics of how and where to gather information, from how to successfully leverage Internet search technologies and databases through to the physical surveillance of target staff and facilities.

• Chapter 7 - Despite the security shortcomings of wireless networks (both 802.11x and Bluetooth) being well documented, many companies continue to deploy them. I discuss equipment, how to crack encryption and bypass other security mechanisms. I provide you short-cuts to get you up and running quickly and introduce some newer techniques for compromising wireless networks that will guarantee that if you’re using wireless in your business now, you won’t be when you finish this chapter.

• Chapter 8 - This chapter offers an in-depth discussion of the equipment you need, where to get it and how to use it.

• Chapter 9 - This chapter offers a few historical scenarios taken from my case history. Names have been changed to protect those who should have known better.

• Chapter 10 - This chapter provides basic information about what a security policy should cover. If you’ve read this far and still don’t have a security policy, this chapter helps you write one.

• Chapter 11 - This chapter covers how to minimize your exposure to information leakage, social engineering and electronic surveillance.

• Appendix A - This provides a legal reference useful to UK testers.

• Appendix B - This provides a legal reference useful to US testers.

• Appendix C - This provides a legal reference useful when conducting testing in the European Union.

• Appendix D - This clarifies the differing terms used in the United States and United Kingdom.

• Appendix E - This tells you about the various tests you can take or the tests you want to be sure a tester has taken before hiring.

What You Need to Use this Book

I’ve written Unauthorized Access to be as accessible as possible. It’s not an overly technical read and although grounding in security principles is desirable, it’s not a requirement. Chapter 7 (in which the discussion focuses on compromising the security of wireless technologies) is technical from start to finish but it does not assume any previous knowledge and provides references to the requisite software and hardware as well as step by step instructions. If you have a grounding in penetration testing (or at least know what it is) so much the better but again this is not necessary.

What you need to use this book and what you need to carry out a physical penetration test are two different things (for that you should refer to Chapter 8). However, I strongly recommend you have the following:

• A modern laptop computer;

• A copy of the Backtrack 3 Live Linux Disc - available from www.remote-exploit.org;

• A Backtrack compatible wireless network card (see Chapter 8).

You may also wish to purchase a set of lock picks to practice what you learn. You should consider this to be the starting point. There is a vast array of equipment relevant to this field but you don’t, by any means, need all of it.

Acknowledgements

I would like to thank my superb editing team and of course my colleagues at Madison Gurkha for giving me the time to work on this. In particular I’d like to thank, in no particular order, the following: Andrew Dalton, Frans Kollée, Pieter de Boer, Tim Hemel, Arjan de Vet, Steve Witmer, Caroline van de Wiel, Hans van de Looy, Guido van Rooij, Remco Huisman, Walter Belgers, Ward Wouts, Thijs Hodiamont, Serge van den Boom, Marnix Aarts, Jan Hendrikx, Jack Franken, Haywood Mcdowell, Rob Lockwood, Corinne Hanskamp, Willem-Jan Grootjans and Gary Mcgath.

Foreword

Kevin Mitnick

Billions of dollars are spent each year by governments and industry to secure computer networks from the prying eyes of an attacker. As a security consultant, I have done quite a few system hardening jobs where the entire focus was upon the firewalls, server configuration, application security, intrusion detection systems, and the like. Some managers completely rely on this technology and put little or no emphasis on better securing their physical perimeter.

Those employed in the computer security industry are fully aware that once physical access to networks is obtained 90% of the obstacles are removed. The attackers are aware of this too, and have demonstrated their agility in bypassing standard security measures when foiled after attempts at remotely accessing a system. In addition to those on the outside that may attempt to circumvent your controls, there are many on the inside (employees and vendors) that already have access. Adding another layer of physical security may deter both of these groups. Consultants in the security field must continually expand their skill set to accommodate the ever-changing environments and protect their client’s assets. In this book Wil Allsopp has created a thorough reference for those looking to advance into the area of physical penetration testing. The book also serves as a guidebook for in-house security managers seeking to institute better policy safeguards.

Every month it seems that we are hearing in the media about large-scale attacks on corporations, the government and financial institutions. Many of these have involved physical barrier penetrations, with the most notable being a huge retailer whose credit card databases were compromised by a group that was reportedly inside the network for more than two years undetected. It was touted by the government as the largest theft to date of credit card numbers, which was placed at over 47 million accounts. How were they able to get in? One method was to swipe a wireless barcode scanner and extract the encryption key used to communicate with the wireless access point inside a retail location. The crooks also obtained physical access to a crawlspace above the store, spliced into the Ethernet, and planted their own secret wireless router. While this describes the most brazen of attackers, don’t be surprised to hear more stories like this in the future. The rapidly advancing technology side of computer security is making electronic intrusions increasingly more difficult for hackers, therefore we will see greater implementation of the physical security attack methods explained in this book, played out in tandem with a technical attack.

A few years ago I was performing a penetration test, which included a scope of testing physical security controls. The first morning I dressed in my suit and arrived in the lobby of the client’s office to meet with my contact. Noticing a display of business cards at the reception desk I pocketed a few inside my coat jacket. For the next two days I remained in my car, parked close by, just watching the building and observing behaviors of those coming and going. At about 8:30 each night a janitorial service arrived at the office complex to clean the offices. I knew this was my ‘in’. Armed with the business cards from the first morning, and once again outfitted in a suit, I walked up to the door and began banging on the glass. A few minutes later, one of the cleaning crew arrived to open the door. I explained that I had left my keys in my office while handing him ‘my’ business card; he stepped aside and waved me through.

Once I was in the building I began to search for my target’s cubicle (some research was performed beforehand to narrow down the location of his cubicle). I sat at the computer, turned it on, slid a Linux Live CD into the CD-ROM drive, entered in a few commands, and grabbed the Administrator’s password hash for that machine. It took only a few minutes to crack the password hash using rainbow tables. Once I had access to the computer I installed a Trojan on the system (this was the set goal), powered down the system, packed up my things and left the premises. This all occurred in about twenty minutes and the client had no idea that they had been compromised until the details were provided in the report.

Securing proprietary information is multi-faceted and can no longer be approached with by focusing on the technology alone. All potential access points must be scrutinized carefully to ensure that ingress is denied on multiple levels. In Unauthorised Access: Physical Penetration Testing For IT Security Teams, Allsopp addresses this concept with a relevant and pertinent outline for performing physical penetrations test by familiarizing the would-be tester with the methodologies and tools needed to perform the test, and illustrating them with the colorful recanting of tales from his vast experience as a security consultant. These stories help to provide real-world examples of the techniques that are being used by attackers every day.

Performing physical penetration testing within your organization should not only be reserved for businesses trying to safeguard information, but can be also be applied to provide better security against theft, trespassing, and guard against industrial espionage. This book will first take you through the terminology, planning, and equipment needed to perform the test. As Allsopp reminds you in later chapters, security is only as strong as its weakest link, which is most likely to be the very people employed by the target.

Once the lingo used in testing is defined, and some of the pitfalls regarding physical layouts of facilities that may be encountered are outlined, you are introduced to a primer on social engineering, which is the practice of using deception, manipulation, and influence to persuade the target to comply with your request. Allsopp recognizes that those best versed in social engineering possess certain personality traits that make them especially adept in this type of manipulation, but attempts to provide an introduction of some basic knowledge for the inexperienced to build on because he realizes the importance of mastering this skill. This is critical, as there is rarely a compromise of security that takes place without some level of social engineering.

For those that have already conducted a physical penetration test in the past, there are several chapters that should provide a few new things for your arsenal as the subject matter switches to information gathering, lock picking and wireless technology. The chapter on lock picking is brief, but provides excellent resources to learn more on the subject as well as giving the reader an overview of the basic steps in picking a lock along with general information on various locking mechanisms and how they can be bypassed. Even if you’re never picked a lock before, Chapter 7 will make you want to try.

Many might not consider wireless hacking as a ‘physical’ attack method, but if you consider that most wireless access points have a broadcast range of less than 300 meters without a long-range antenna, to take advantage of these devices you must place yourself within the allotted radius to compromise the target. Having in-depth knowledge of wireless devices can be used for more than just attacking them. If you can obtain physical access to cabling, a ‘hard-wired’ network could suddenly become a wireless one, if spliced into with a device placed in-line. Wireless technology is probably one of the most commonly misconfigured items providing perimeter security, and if compromised, it can easily become the low-hanging fruit sought by attackers.

After you are enlightened and possess a solid understanding of executing physical penetration tests, Allsopp gathers all the techniques discussed and rolls them into detailed true-life accounts in Chapter 9. The first example describes a pen test performed on a SCADA (Supervisory Control And Data Acquisition) system. There has been an elevated awareness of terrorism since 9/11, and SCADA systems have been receiving significant media attention since they are used to monitor and control critical infrastructure processes such as power generation, life support systems, water treatment, and telecommunications. Many speculators are afraid that the power grid could be compromised in a standalone terrorist act, or use in conjunction with a symbolic attack, to reduce the response time of emergency personnel to the scene. These systems are in perpetual production and are not usually connected to the internet, so taking them offline for maintenance and upgrades is very difficult, which makes their physical security all the more important.

Allsopp’s example of lax security at a power substation, unfortunately, is not limited to the UK. Often, these critical systems in many countries are left unmanned and may not be protected by anything more than a barbed-wire fence and padlocks. Sure, there may be some electronically locked doors and access gates, but as shown in prior chapters, these are easily bypassed by a determined intruder. Armed with a laptop and key information, if you can get past these controls, you are most likely going to find an unpatched system that could grant you ‘keys to the kingdom’.

The infusion of the real-life stories help to clearly demonstrate the typical shortcomings due to the lack of proper procedures, employee training, and policies in place. You can employ the latest technology and implement multiple layers of defense, but if your personnel are not properly trained to spot weaknesses and then act on them, all of these precautions are rendered almost useless. Allsopp addresses concepts to provide better policy, incident response, and access control. Much of this involves classifying assets so that employees are aware of what is most important to safeguard.

While this book is aimed at security consultants looking to add physical penetration testing to their repertoires it would also be a great read for those managing security for various organizations. It would be a useful reference tool for IT/Security Managers to implement better policy and training for its employees. If you could only walk away with one thing from this book it would be the lesson to teach your employees to challenge and verify. An apology is a much easier thing to give than having to explain how you were instrumental in allowing an intruder to bypass established protocols.

1

The Basics of Physical Penetration Testing

If you know the enemy and know yourself, you need not fear the result of a hundred battles.

Sun Tzu: The Art of War

There is an old saying that security is only as strong as the weakest link in the chain. This is an erudite and often overlooked truth. The weakest link is never the cryptographic keys protecting a VPN link or the corporate firewalls guarding the borders of a network, although these technologies certainly have their shortfalls. The weakest link in any security scenario is people. Some people are lazy and all people make mistakes and can be manipulated. This is the most important security lesson you will ever learn: security in any form always boils down to people and trust. Any decent computer hacker will tell you: if you want to be good, learn technologies and programming languages, reverse engineer operating systems, and so on. To be a great hacker requires learning skills that are generally not maintained by people of this mindset. Once you master the manipulation of people, you can break into anything - any system whether corporate, electronic or human is vulnerable.

This chapter covers the basics of penetration testing, the things you need to know before you dive into the more interesting practical chapters. This includes a guide to terminology unique to penetration testers, a little on legal and procedural issues (because an understanding of the relevant legislation is critical) and, of course, a discussion of why penetration testing is important, including a look at what organizations usually hope to achieve from engaging in a penetration test.

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!