Tactics of Physical Pen Testers

Summary

The speaker, a physical security expert, debunks the myth that lock picking is the primary method used for covert entry. Instead, he shares practical and often overlooked techniques such as hinge pin removal, latch slipping, and exploiting poor door fitment. He also discusses electronic access control vulnerabilities, the use of common keys for access points, and the importance of being confident and appearing to belong when gaining unauthorized access. The talk is filled with real-world examples and advice on improving physical security measures.

Takeaways

• 🔓 The speaker emphasizes that lock picking is often the least common method used to gain unauthorized access to buildings, suggesting that other techniques are more frequently employed.
• 🛠️ The script highlights various physical security vulnerabilities, such as easily removable hinge pins and improperly installed latches, which can be exploited to bypass locked doors.
• 🔑 The importance of understanding the type of lock and security system in place is underscored, as knowing the common keys or methods to exploit them can be advantageous in physical penetration testing.
• 💡 The concept of 'social engineering' is implied through stories where confidence and appearing to belong can lead to successful unauthorized access, such as posing as an elevator repair technician.
• 🛡️ Simple and inexpensive solutions, like security hinges and jam pins, are suggested to improve physical security and prevent easy access through doors.
• 👮‍♂️ The role of security guards and their interaction with intruders is discussed, noting that their training and vigilance can vary significantly.
• 🚪 The script points out that electronic access control systems, such as HID proximity cards, can be vulnerable to cloning and sniffing attacks.
• 🔍 The use of everyday objects and tools, such as under-door tools and wire bridges, to gain access is demonstrated, showing that specialized lock-picking skills are not always necessary.
• 🏢 The speaker shares anecdotes from physical security testing jobs, illustrating the diverse methods used to infiltrate buildings and the human elements that can be manipulated.
• 🔗 The importance of cross-training in both physical and electronic security domains is suggested, as knowledge in both areas can enhance the effectiveness of a security professional.
• 📈 The script concludes with a call to action for security professionals to be aware of the physical side of security, implying that a comprehensive approach is necessary to ensure robust security measures.

Q & A

What is the common misconception about the job of a physical security expert as described in the script?

The common misconception is that physical security experts, often referred to as 'break-in guys', primarily use lock picking to gain access to secure spaces. However, the script clarifies that lock picking is actually a less common method and is far down on the list of techniques used.

What is the first method mentioned in the script that can be used to bypass door security without picking the lock?

The first method mentioned is knocking out hinge pins, which allows the door to be removed from its frame, bypassing any locks on it.

What is a security hinge and how does it prevent the hinge pin removal method?

A security hinge is a type of hinge that has a peg which goes into a hole when the door is closed. This prevents the door from being removed from the frame even if the hinge pins are knocked out, as the peg blocks the attack.

What is a jam pin and how does it help in making a conventional hinge more secure?

A jam pin is a security-enhancing replacement for the screws in a conventional hinge. It transforms the hinge into a security hinge by preventing the hinge pin from being knocked out without the need to rehang the door.

What is the importance of properly installed latches in door security as highlighted in the script?

Properly installed latches, specifically dead latches, are crucial for door security because they prevent the door from being opened by latch slipping tools. If the latch is not installed correctly, it can be easily manipulated, compromising the security of the door.

What is a crash bar and why is it vulnerable to certain attacks as described in the script?

A crash bar is a type of door mechanism often used for emergency exits. It is vulnerable to attacks because it can be triggered by inserting a rod or other object through a gap in the door and pressing the bar, allowing unauthorized access.

What is the purpose of the 'thumb turn flipper' tool mentioned in the script?

The 'thumb turn flipper' is a tool used to manipulate thumb turn locks or deadbolts from the outside. It is used to unlock doors that have a thumb turn on the inside, allowing access without the need for a key.

What is the significance of the 'under door tool' in the context of the script?

The 'under door tool' is significant because it demonstrates how attackers can exploit poorly secured doors with lever-style handles. By reaching under the door and manipulating the handle, an attacker can open the door without needing to pick the lock.

What is the role of the 'postal switch' in a Door King access control system as described in the script?

The 'postal switch' in a Door King system is a momentary switch that, when activated, can trigger the door's relays to fire, effectively unlocking the door. It can be used as a bypass method if an attacker can access the switch.

What is the 'CH-751' key mentioned in the script and why is it significant?

The 'CH-751' key is a very common key used for various locks, including filing cabinets. It is significant because it can often open many locks by default, making it a useful tool for physical security testers.

What is the '1284X' key and why is it noteworthy in the context of the script?

The '1284X' key is a key used by the Ford Motor Company for their fleet vehicles, such as Crown Victorias. It is noteworthy because it is not a restricted key and can open many police vehicles and even start their engines, highlighting a potential security vulnerability.