Red team hacker on how she 'breaks into buildings and pretends to be the bad guy'

A hacker walked into a "very big city" building on a Wednesday morning with no keys to any doors or elevators, determined to steal sensitive data by breaking into both the physical space and the corporate Wi-Fi network. Turns out she didn't need to do any breaking in at all. She rode the elevator up to the reception floor …

[DrkShadow]

> Their goal is usually to connect to the corporate network and steal something that only a high-level exec should be able to access.

I see words like this, and I think... nothing? Nothing? Things that only a high-level exec should be able to access? Like their e-mail?

The development team doesn't add execs to the code repositories. The execs have no experience there. They're not added to the bug trackers, even -- they're not going to do that, report it through someone else. They're *certainly* not given access to the Cloud management console -- again, no experience, it's just a security risk at best. They aren't HR, so that data is confidential. (Personal calendar events? with other executive invitees?..)

Really truely, a executive should have access to .... nothing but their own, individual e-mail. Maybe a cloud drive for their docs, but in my experience the execs prefer to keep them local -- so that and backups. The printer that they used was an inkjet on the desk -- not networked, and not shared. If they have access to more, IT has screwed up indeed.

They _manage_, they have no need to access the results, methods, documentation, sources, or anything else. They manage, their information comes to them via subordinates, maybe someone has put together pretty-dashboards, and they have no need for more. ("Engineering managers" or "technical managers" may be an exception -- but executive?..)

[Headley_Grange]

It's the way you get the Execs' attention cos it makes it up close and personal to them.

[Henry Hallan]

What "high-level execs" often do have is authorisation to pay out large sums of the company's money: pay bogus invoices etc.

Many cyber-crims don't want the software or corporate secrets - they want the money

[MachDiamond]

Many cyber-crims don't want the software or corporate secrets - they want the money"

Possibly if there aren't controls that will trip an alarm. If you can get the Exec's platinum card creds, you can exploit that, but if you want them to cut a check with a lot of zeros, that can be much more difficult. It's not that they can't do that, it's just that a check request gets sent through to accounting who will need to know what account the check is balanced against and a really big check may require two person sign off.

Information, on the other hand, can be sold. It can be sold over and over again. Plenty of people would love to know the names, personal information and salaries of everybody on the C-level of a large corporation. What products are in development? What's the new marketing campaign going to look like? What new patents, copyrights or trademarks are in the works? Is the company going to kill off a division or are they planning to buy up a competitor?

[Anonymous Coward]

Any number of insider trading scenarios spring to mind. Execs wield some fairly beefy powers depending on how you look at it. Plus if you own an exec you can fake being an exec...

[Anonymous Coward]

I have seen many clients where their bosses demand access to everything, just because they are the boss. They think they should be able to access anything any of their employees can, even if they don't need access to it. We patiently explain why this is a bad idea. Some will get it. Some won't.

[Mr. Impartial Pants]

Yes gracie, there is interesting stuff in executive e-mail

The SEC is currently seeking extradition of one Robert Westbrook, 39, of London for securities fraud and all kinds of assorted criminal acts netting him $3.75 million.

Authorities said Westbrook's "hack-to-trade" scheme involved gaining access to executives' email accounts between January 2019 and May 2020, and using material nonpublic information to buy stocks and options prior to at least 14 earnings announcements.

Still nothing?

[AceRimmer1980]

Execs?

I've worked mainly at small companies where the owner/founder/CEO is also the owner of the AWS/Github account, and absolutely they would have highest level access, even if they have to call on the assistance of the intern to actually do anything.

[Stuart Castle]

Depending on how the company is sttructured, and their position within the corporate structure, the exec may have access to a lot of info that could be of interest to hackers. They may have access to company finances, the design or engineering documentation for the company for instance.

I'm not saying that is the right way to set things up. Unless the exec has a specific need to access that info, they shouldn't have access to it. No one should have access to info at work they don't need to do their job, but not all companies are set up that way..Some have grown up from one man bands, where the founder is doing everything, so needs access to everything, and have carried on with that mind set, never really properly designing security. Companies in multi occupancy buildings are often like that because once they get big enough to start thinking about things like having an IT department, they are probably big enough to have the whole building.

[Cav]

Nonsense. Execs have those dashboards you mention and automatically generated reports. They will be logging in to authorize payments, time off, read minutes of confidential meetings, policies etc, etc. Many things that are not distributed via insecure email.

[Cav]

And no, they won't be using costly, wasteful ink jet printers when there are networked, cheap printers available for things that absolutely have to be printed.

[Lazlo Woodbine]

Until our most recent Head Teacher, I resisted all requests to give them full access, either because they really were not IT savvy, or because I didn't trust them not to steal all our data and take it to another school.

Our current Head, he actually knows what he's doing, so he has almost complete access, read only though...

[nautica]

Don't fear 'artificial intelligence'. Fear natural stupidity.

"The fact that jellyfish have survived for 650 million years without brains gives hope to many people."---David Avocado Wolfe

[Ken Moorhouse]

Re: David Avocado Wolfe

Just be thankful that nobody has invented a keyboard for jellyfish to operate.

[yetanotheraoc]

Re: David Avocado Wolfe

New game: "AI or Jellyfish?". As in, who wrote the following nonsense ....

[krakead]

Re: David Avocado Wolfe

Are you sure? Have you looked at Xitter lately?

[Empire of the Pussycat]

"We had found the credentials for their corporate Wi-Fi network in the trash [...]" Seriously?

'Corporate WiFi' secured by static credentials and no NAC? Was it the local cafe?

Bragging about 'hacking' such a soft target seems embarrassing.

[Boris the Cockroach]

Re: "We had found the credentials for their corporate Wi-Fi network in the trash [...]" Seriously?

Its how we found useful information once or twice.

people do just throw away vital information into the trash without bothering with the shredder first

[Empire of the Pussycat]

Re: "We had found the credentials for their corporate Wi-Fi network in the trash [...]" Seriously?

The point is that this was clearly an amateur/incompetent target - that's assuming they didn't just make it up.

Bragging about it is like a mugger boasting about how hard they are for beating up a toddler.

[Anonymous Coward]

Re: "We had found the credentials for their corporate Wi-Fi network in the trash [...]" Seriously?

"The point is that this was clearly an amateur/incompetent target"

You'd be surprised how many times, even at big companies, security is always a nuisance, until such a person is wreaking havoc at CxO level !

You've not been long enough in security, compadre. *

* Yes, that's a Handsome Jack quote from Borderlands 2 :)

[Brewster's Angle Grinder]

No Robolution? No sale!

Actually, just last night I went mano a mano with Jack and then blatted the warrior.

Classic sniper gameplay failure mode: you spend all your skill points on becoming a fantastic sniper and then go face to face with a boss where you can't snipe. Fortunately, I'd kept hold of a decent SMG, a decent shotgun, and a decent assault rifle. I perched in the rocks and emptied them into the warrior's face. That did for the sod.

(I got it as a bundle with the DLC and the pre-sequel. So Tiny Tina's Dragon Keep - here we come!)

[Evil Scot]

Re: "We had found the credentials for their corporate Wi-Fi network in the trash [...]" Seriously?

Although sometimes the Phisher shows little or no competence.

I apparently fell for a Phishing scheme where my manager was offering free sandwiches.

Or so the web page said when I clicked on the link.

Said manager was undergoing Chemotherapy with the NHS.

Offer Email was sent early morning EST.

So the lack of local knowledge about simple things such as Time Zones (I had eaten) and staff health in a global company informed me that this was a security test from the US and I knew this link was safe.

[Stuart Castle]

Re: "We had found the credentials for their corporate Wi-Fi network in the trash [...]" Seriously?

Re "You'd be surprised how many times, even at big companies, security is always a nuisance, until such a person is wreaking havoc at CxO level !"

I wouldn't. Where I work, most of the users are highly skilled in computing, including in security based areas. We still have a to have a technician go round the buildings with a device looking for unknown Wifi networks because some users, rather than request an extra network connection for a 2nd computer or other device they have obtained and want to use, they will buy a cheap home router, clone their office desktop PC MAC to it, then connect their office PC (and any other devices they want) to the home routers.

That said, that doesn't happen so much now. As stated above, we have a Wifi network they are supposed to use for this. We also used to get told that our Wifi signal is weak in some areas (in fairness - it is) as an excuse for bringing in their own routers, but if a user reports weak Wifi now, we will install a Wifi access point in the area they are complaining about..

[Missing Semicolon]

Re: "We had found the credentials for their corporate Wi-Fi network in the trash [...]" Seriously?

Nice, you fix the problem of shadow IT by ... improving the IT service!

[Jamie Jones]

Re: "We had found the credentials for their corporate Wi-Fi network in the trash [...]" Seriously?

Have you ever worked in the real world, or just in an office full of nerds?

It sounds like the latter.

[Lazlo Woodbine]

Re: "We had found the credentials for their corporate Wi-Fi network in the trash [...]" Seriously?

You seriously over-estimate the competence of staff,

The number of times I've covered for store managers and found the alarm code written on the wall within arms length of the alarm box.

The problem with long, complicated WiFi passwords is they're long and complicated, so people write them down for when they get a new phone or tablet. Those post-its rarely end up in the shredder...

[jake]

Re: "We had found the credentials for their corporate Wi-Fi network in the trash [...]" Seriously?

Part of pen testing is proving to the C*s that human stupidity knows no bounds, and that they are not immune ... I once found a comprehensive list of machine names and login/password pairs written in sharpie on the underside of the leaves of a faux ficus in the office of the secretary of a VP. They included complete access to the corporate mainframes (including R&D). Quite a few people got reamed, and I'm absolutely certain that Amdahl's internal security culture was much better by the time Fujitsu bought them ...

[MachDiamond]

Re: "We had found the credentials for their corporate Wi-Fi network in the trash [...]" Seriously?

"Bragging about 'hacking' such a soft target seems embarrassing."

It's not bragging, it's highlighting that such sloppiness is still out there. When I troubleshoot electronics, I start at the power supply. It can be the root problem often enough, but it can also be the easiest thing to repair. If you can find credentials in the trash, that's just a night of getting coated in cold coffee grounds rather than a week of online "hacking". It also means that getting in is less likely to sound an alarm.

[Stuart Castle]

Re: "We had found the credentials for their corporate Wi-Fi network in the trash [...]" Seriously?

If it's a shared building the "Corporate Wifi" will likely be shared amongst the users. We don''t know what companies occupy the building. We don't know how big the building is, or how many companies are in it. They may be large companies with their own IT support teams,, who make heavy use of the network (although these *should* have their own network that is locked down as much as possible, using the building's "corporate Wifi" mainly as a guest network) or they may be a bunch of small companies staffed by the owner and a couple of employees who just need the "Corporate Wifi" to connect their phones, tablets or laptops to the Internet..

Can't say I've been to many shared building (I used to work for a company in one, but this was *way* befoe Wifi was a thing), but I should imagine if it's just a building with dozens of individual businesses, each with one or two staff, they probably get quite a high turnover of users. Bearing in mind any tech support will likely be the cheapeast possible, it's entirely possible someone just created a generic account to access the Wifi, like you get in shops, restaurants or pubs when the owner wants to provide Wifi, but can't (or won't) pay for one of the big cloud Wifi providers to provide it..

That said, ANY network (wired or wireless) should not have any access to a network connected to any real corporate systems. Or, if it is necessary to provide access, require a VPN.

[Azamino]

Re: "We had found the credentials for their corporate Wi-Fi network in the trash [...]" Seriously?

My shop offers a 'coffee shop' wifi network for staff to use with personal phones and client equipment. It is blocked from the corporate network and has the usual restrictions on gambling sites etc and 12ft.io but otherwise pretty open. Reception hands out passes that last 24 hours to visitors, sounds like it was something similar that the author found in the bins.

I would be happy not to read stuff like "hijack the amygdala", distracting bored office workers really isn't that difficult.

[DS999]

She doesn't fit the hacker stereotype

Which I imagine helps her when it comes to in person social engineering. If your target isn't on their guard you've already won 90% of the battle. The rest is just having a good story that's not so elaborate as to seem contrived but elaborate enough that the target is happy to cut it short by giving you what you're asking for.

[jake]

Re: She doesn't fit the hacker stereotype

What, pray tell, is "the hacker stereotype"?

Please tell me you don't think it's the idiots you see portrayed in the movies ...

_{Remember, movie rolls are usually written by people whose complete knowledge of system security can be found written on an old AOL floppy ...}

[MachDiamond]

Re: She doesn't fit the hacker stereotype

"What, pray tell, is "the hacker stereotype"?"

Lack of sun. Poor wardrobe choices/fit. Would have a hard time getting a date. Awkward.

Somebody coming in with up-to-date business wear that fits well, well groomed, fashionable hair style, if they wear glasses, the frames are what's 'in' this week, are all ascribed to somebody other than a hacker. TV and movie stereotypes aren't exact, but often good first order approximations. Ideally, a good pen tester will have the look for the part they are playing. A security company representative coming in to do an on-site analysis in advance of a bid won't be wearing an expensive suit. They will be wearing nice business casual and their glasses, if they wear them, will be a step or two down from $1,000 name-brand frames. A sales team will be wearing suits or more formal business costumes. A tech will be wearing relevant clothes. If you are there to lube the elevator cables, a collared shirt will be out of place.

[David Hicklin]

Re: She doesn't fit the hacker stereotype

"What, pray tell, is "the hacker stereotype"?"

Well they all seem to be presented as people wearing a hoodie with the hood up and an X painted on the back of it....

[Sorry that handle is already taken.]

Re: She doesn't fit the hacker stereotype

What, pray tell, is "the hacker stereotype"?

Weeeeell... I just looked up gender diversity in IT security and while it isn't as low as I had assumed, it still isn't very close to parity.

[MachDiamond]

Re: She doesn't fit the hacker stereotype

"I just looked up gender diversity in IT security and while it isn't as low as I had assumed, it still isn't very close to parity."

Girls are still taught in plenty of places that they aren't good at maths or science and get pushed towards older gender role jobs. That takes a fair amount of time to overcome. There needs to be role models to point to. This is why there can be fewer women in high salary corporate jobs. Those aren't positions often open to 20 somethings or even 40 somethings in many cases. There are many more in startups and smaller enterprises where there isn't the same requirements of "time in rank" that mean only older people will get those positions.

A bigger question is what jobs are women interested in/not interested in. Forced parity just leads to lower standards.

[Paul 195]

Re: She doesn't fit the hacker stereotype

Plenty of women are interested in careers in technology but have such an awful time from men who can't believe a woman can be technically competent that they switch career direction. My spouse is one such. Admitttedly, her career as a real-time software dev started in 1989, but a lot of comment threads on el Reg lead me to believe that things haven't improved massively in the interim.

Having worked for a few years at a company that took the idea of diversity in hiring and promotion seriously, rather than just paying it lip service, I can tell you that I worked with several female engineers who were very talented, and because women have to work so hard to get taken seriously in software engineering roles I will say hand on heart that as a percentage I've met more mediocre and or incompetent male engineers than I have female ones.

[lglethal]

Re: She doesn't fit the hacker stereotype

What are you trying to say Jake? You really mean all Hackers don't wear hoodies and Sunglasses whilst sitting in the dark in their basement?

Stopping destroying my dreams!!!!

[Jamie Jones]

Re: She doesn't fit the hacker stereotype

What, pray tell, is "the hacker stereotype"?

Please tell me you don't think it's the idiots you see portrayed in the movies ...

What DS999 thinks is the hacker stereotype is irrelevant. It's what the mark think is the hacker stereotype that counts, and for them, your fictional description is probably accurate.

[Anonymous Coward]

Re: She doesn't fit the hacker stereotype

I think in this story substitute grifter for hacker and you're closer to the role being played (Mickey in Hustle or Sophie in Leverage spring to mind).

[Jamie Jones]

Re: She doesn't fit the hacker stereotype

I got chastised recently on here for questioning if it's really hacking (pedantically, cracking) if there was no actual code breaking.

The consensus was that even if someone gets into a system because the password was written on the subway walls, it would still count as hacking.

[tyrfing]

Re: She doesn't fit the hacker stereotype

A successful break-in involves *whatever gets you in*. Often there is no code-writing involved at all.

It's like when you're changing a business process. Sometimes it involves code, but that's the easy part.

Getting people to actually change what they're doing to a different, better way is much more difficult.

Some of the other commenters are saying things like "I bet their security is much better now." I'm not so optimistic.

After the break-in the people who directly allowed it due to bad practice may actually change that practice. At least for a short time.

Go back five years later and there will probably be someone else doing the same thing though. Among other things because likely very few people are still around in the same role from that long ago.

[Sorry that handle is already taken.]

Train your users not to trust anyone

My organisation has a "report phish attempt" button in the email client and periodically sends out fake phishing emails to randomly selected staff members. Falling for the emails enrols you in mandatory email security training.

Then one day fairly recently a legitimate email went out with a link to an online training course on an external system nobody had ever heard of, when we have our own internal systems for online training. It ended up being reported as phishing by so many staff that it was followed up by a surprisingly tersely worded email informing us of its legitimacy. I assumed it was legitimate but reported it too because I enjoy the chaos...

Anyway you'd think they'd have thanked the staff for taking (that part of) security seriously. Oh well.

[Ken Y-N]

Re: Train your users not to trust anyone

At a certain company, legitimate external emails have links to an internal page that lists legitimate external emails - now that's a good phishing route; include the internal URL as almost no-one will verify...

[Chasxith]

Re: Train your users not to trust anyone

My firm did the same thing. The fun bit was everyone getting their P60 (end of tax year docs) from an external contractor no-one had ever heard of, with an incorrect company name appended to the email. The attachment? A macro-enabled MS word document! (.docm)

Naturally a large number of people reported it as dodgy to InfoSec, who did appreciate the response in a "we're really not impressed with Accounts" manner.

Accounts themselves sent a snotty email a day later complaining about all the enquiries they had received and telling us that we should have known the external accounting contractor existed.

This scenario also regularly happens to our CEO who types in a similar manner to really bad/obvious scam emails - lots of Times New Roman, bold fonts and weird formatting.

[Bebu]

Re: Train your users not to trust anyone

our CEO who types in ... lots of Times New Roman, bold fonts

No Comic sans? Only seemed like a clown then?

_{Curiously a very long ago I knew a chap who used MS Comic Sans as the default typeface for plain text as it made it easier for him to read his email (in his opinion.) Although to be honest he had to deal with more than his fair share of clowns and the generally clueless.}

[anon45678]

Re: Train your users not to trust anyone

Comic sans and dyslexia - maybe they were following this website

> Use sans serif fonts, such as Arial and Comic Sans, as letters can appear less crowded. Alternatives include Verdana, Tahoma, Century Gothic, Trebuchet, Calibri, Open Sans.

https://www.bdadyslexia.org.uk/advice/employers/creating-a-dyslexia-friendly-workplace/dyslexia-friendly-style-guide

[Anonymous Coward]

Re: Train your users not to trust anyone

"My organisation has a "report phish attempt" button in the email client and periodically sends out fake phishing emails to randomly selected staff members. Falling for the emails enrols you in mandatory email security training.

Then one day fairly recently a legitimate email went out with a link to an online training course on an external system nobody had ever heard of, when we have our own internal systems for online training. It ended up being reported as phishing by so many staff that it was followed up by a surprisingly tersely worded email informing us of its legitimacy. I assumed it was legitimate but reported it too because I enjoy the chaos...

Anyway you'd think they'd have thanked the staff for taking (that part of) security seriously. Oh well."

Probably we work for the same company, then.

Over the last years, I had a couple of very suspicious emails I had to report. They were legit. but from a *very* clueless outsourcer.

WTF is sending legit emails with only images in them ???

[Ken Moorhouse]

Re: Train your users not to trust anyone

The thing that makes me laugh (or cry) is that the banks think they know all about security, and they ram this down your throats at every opportunity when questioned about it.

Well now, if you have the same type of business credit card account as me, you will probably be receiving the occasional email from them. Try this out at the next one you receive and let me know how you get on...

Towards the end of the email it will say:-

"We want you to recognise a fraudulent email. For security purposes, <card company> will greet you with the last four digits of your account number as shown at the top of this email."

Ok, let's look again at the top of the email ************0123. Yeah right, so this is a fraudulent email then (my account does not end in 0123)?

They've obviously not bothered to check their template for obvious mistakes. Muppets.

[Ken Moorhouse]

Re: the banks think they know all about security

Just had a survey email from this particular bank. Looking at the address it came from it looks legit. However, when you look at the underlying address beneath the "Click here to provide feedback" button it does not look like a valid URL. Upon further investigation it seems the bank is using a "vanity" domain. They do realise that the name of the bank is shared with some allegedly questionable bedfellows? This really does go against the advice they give you about what an email from a bank should look like. It's not as if they are using the "bank" domain, which is supposed ro be for banks, but I don't trust anything coming from any of these gravy-train (from the registrar's pov) domains either. Why do they not use their normal .co.uk domain?

[David Newall]

landlord overreach

"hired by the multi-tenant building owner who was worried about the inhabitants being "a little too relaxed" about office security"

I feel as if this is not appropriate. Heart in the right place, but he was conspiring to break in to offices that weren't his, and that's not okay.

[lglethal]

Re: landlord overreach

I suppose it depends if he had some contractual role to do with providing office security, which the tenants were undermining through their actions.

But yeah if not, I would hope he at least had the permission from the CEO's of each firm. Otherwise that's a really good way to get sued and end up with ex-tenants...

[keithpeter]

Fake company researching for quote

"We presented our case for getting into the building, and she immediately grabbed the global security operations manager, who I named on the work order."

Well done however...

UK public sector education, semi-public buildings: the employee requesting the quote would have 1) agreed a date and time for the onsite survey 2) put that together with names of the surveyors in the visit calendar for reception - noone is getting in unless they are a student, staff or have a visit logged in the calendar 3) would accompany the surveyors while on the premises, or delegate another staff member to do so.

Noone has to have armed services experience or advanced qualifications, they just have to follow the procedure.

Now, that fake pdf policy on a survey arriving by email... that is a different kettle of phish. Hasn't happened yet and we do training but...

[Jamie Jones]

Re: Fake company researching for quote

Well if that's the case, things have changed dramatically in the last 20 years!

[keithpeter]

Re: Fake company researching for quote

Oh yes: FE Colleges and some aspects of University provision are now taking 'safeguarding' very seriously. Gone are the days when you could wear overalls, carry a toolbox, and just walk in.

[Anonymous Coward]

congrats for the post, very interesting

nothing else to say :)

Someone in IT sec.

[Flightmode]

Interview with Alethe Denis

If you want more about Alethe Denis, Jack Rhysider of Darknet Diaries did an interview with her in December 2021, episode 107, simply called "Alethe". He's done a number of episodes on both digital and physical pentesters and social engineering, well worth checking out.

[Jamie Jones]

"The attacker did such an excellent job of building that trust, of posing as an internal employee or a person who was entitled to that access," she said. "And the person they were talking to had no idea — there was no way for them to identify that anything was wrong — and that is truly a failure of the process."

When I left university many years ago, I was back with my parents, and wanted to keep access to JANET/the internet without the huge modem costs.

I had visited the local University before, to meet some people I knew from "online" so I knew the setup of the local common computer rooms.

So one day, I drove down there, about 8pm. Security on the gate asked what I wanted, but didn't ask for ID (I said I was working on a computer project in the computer centre).

I got in.

I went down most evenings for about a year. It got to the point that security would see my car arrive, wave, and open the barrier without any interaction. I even used to chat regularly to the security guards in their office, as over night, you had to walk past them to get to the only available toilet.

Hey, I was keeping the place safe from thieves, and would power off all the unused terminals.. I was doing them a service!

I was never caught. - I stopped going because I got a job and moved away.

It's suprising what you can get away with if you just look like you belong somewhere.. It's like the old adage of "just wear a high-viz jacket, or a jacket with "security" on it"

[Anonymous Coward]

> It's suprising what you can get away with if you just look like you belong somewhere.. It's like the old adage of "just wear a high-viz jacket, or a jacket with "security" on it"

Way back when, the advice I heard was "carry a clipboard and look busy".

Nowdays maybe not a clipboard, but you get the idea.

[Marty McFly]

Exactly what is needed

It isn't sexist, it is a fact. Knowledgeable, good looking women will get what they want. Especially if they have some insider jargon & lingo, and dress like they belong there. The rest is all just confidence, play acting, and the ability to think quickly.

Which is why she, and what she represents, is exactly what is needed to do a physical pen test on a 'secure' office building. Any targeted attack on an organization would use the same technique.

This story shows how vulnerable organizations are to a dedicated attacker with a specific target. Extend this story out to retrieving the device after the data exfiltration. InfoSec would run in circles trying to figure out where the hole was after the fact, and never find the 'smoking gun'.

[theOtherJT]

Learned helplessness...

...is a massive problem when dealing with this sort of social engineering.

What's more likely, that the person I'm about to ask to leave the building is a professional thief / pen-tester or that for the 3rd time this month someone new has been hired and no one bothered to tell the IT department about them or issue them any ID?

Oh, you're here to attend a meeting in room D? I don't see any meetings scheduled for room D, that seems suspicious totally normal because no one in the exec team ever bothers to book rooms they just show up and kick anyone else who's using it out.

Should I question that this person crawling around under a desk might be inserting some sort of network sniffing kit, or is it more likely that facilites have unplugged something when they wanted a socket during cleaning last night - like they do every night despite how many times we tell them to stop - and this person is just putting it back in again?

99% of social attacks work not because we're all so gullible, but because we've lost hope of ever making all the stupid shit that happens every day stop.

[Anonymous Coward]

Re: Learned helplessness...

"What's more likely, that the person I'm about to ask to leave the building is a professional thief / pen-tester or that for the 3rd time this month someone new has been hired and no one bothered to tell the IT department about them or issue them any ID?"

Remembers the occasion quite a few years ago when I went into the office, sat down and started working and someone I didn't recognise came over and asked me "who are you, why are you here? and how did you get in?" - me: "I work here", them: "No you don't, I've been here for 7 months and I've never seen you before", me: "Yeah? I've been here for 3+ years but normally I work on-site in <insert different country name> or from home when I'm back in the country".

[nautica]

Re: Learned helplessness...

"...but because we've lost hope of ever making all the stupid shit that happens every day stop."

There is an extremely large element of truth to what you say.

I would add that one major contributor is that it is extremely hard work to make "...all the stupid shit that happens every day stop", for the very simple reason that it requires that laser-focused thinking about how to solve the problem be employed, and continuously. Most people and most organizations are not up to this task.

"Two percent of people think. Five percent of people think they think. The rest would rather die than think." [paraphrase]--Bertrand Russell

[Mr. Flibble]

Re: Learned helplessness...

I wish I could award more than 1 up vote for this!

[martinusher]

WiFi is secure -- if you know how to use it

A lot of companies don't get this WiFi thing even today, they still rely on supposedly secret passwords or MAC address whitelists to access their network. When you do access the network you do access the corporate network -- you might not have access rights to individual resources but you can see everything and everybody so its just a matter of finding a suitably insecure resource and you're in.

Right back at the very beginning, back when Intel, Microsoft and Cisco decided to take a proactive approach to wireless security (as in "fed up waiting for the IEEE to get its act together") their innovations included adapting 802.1x for wireless authentication. This had innumerable benefits, one being that people were only allowed on the network if they presented valid credentials (or, alternatively, if the network was configured appropriately (using virtualization) guest users were steered off the corporate network proper and outside the DMZ. This was routine practice 20-odd years ago and applied correctly made even WEP quite secure. So the notion that "finding a piece of paper in the trash" was any use to anyone in modern times should be laughable.

(802.1x was originally devised for wired networks and can be used to prevent the connection of unauthorized devices to a network.)

[SteveTM]

This isnt the norm. I've worked in comms for years and the buildings I enter have a locked door either requiring a code or a keycard and a code.

[Anonymous Coward]

I wonder if all these "Red Team hackers" ever run physical tests on their rival IT security companies?

I remember that the local office of a *well known* international IT security company used to host Meetup events frequently. Their local office was L-shaped with their main open-plan room being out-of-sight of their conference room (walk through the office and at the end of the room turn left around a corner).

When I went there once to attend a Meetup everyone (including staff) was in the conference room and so I walked unaccompanied/unobserved through their office, past whiteboards containing company (and customer) related info, past desktops where it would have been easy to install a hardware keylogger, and into the conference room.

The same office was broken into at least 2 times that I heard of ("random" attempted thefts allegedly).

Security? They've heard of it (from their customer marketing literature)....... Another case of "do as we say, not as we do"

[Ken Moorhouse]

TFL office security (many years ago)

I used to work at one of their buildings in central London. There was an entrance from the street and one from inside the station. This latter had a dedicated security guard checking Id. In the mornings there would sometimes be a few people going in at the same time as it was start of day for them. One day there was a bit of a queue to get in, with a somewhat irritated guy arguing with the security guard.

"Sorry, can't let you in without Id. I will have to report you to the Premises Manager."

"But I *am* the Premises Manager."