I'll Let Myself In: Tactics of Physical Pen Testers

2,878,394
0
Published 2017-12-11
Join us at the annual information security conference in Deadwood, SD (in-person and virtually) — Wild West Hackin' Fest: wildwesthackinfest.com/

Wild West Hackin' Fest 2017
Presented by Deviant Ollam: enterthecore.net/

Description: Many organizations are accustomed to being scared at the results of their network scans and digital penetration tests, but seldom do these tests yield outright "surprise" across an entire enterprise. Some servers are unpatched, some software is vulnerable, and networks are often not properly segmented. No huge shocks there. As head of a Physical Penetration team, however, my deliverable day tends to be quite different. With faces agog, executives routinely watch me describe (or show video) of their doors and cabinets popping open in seconds. This presentation will highlight some of the most exciting and shocking methods by which my team and I routinely let ourselves in on physical jobs.
________________________________________________________________
While paying the bills as a security auditor and penetration testing consultant with The CORE Group, Deviant Ollam is also a member of the Board of Directors of the US division of TOOOL, The Open Organisation Of Lockpickers. His books Practical Lock Picking and Keys to the Kingdom are among Syngress Publishing's best-selling pen testing titles. In addition to being a lockpicker, Deviant is also a GSA certified safe and vault technician and inspector. At multiple annual security conferences Deviant runs the Lockpick Village workshop area, and he has conducted physical security training sessions for Black Hat, DeepSec, ToorCon, HackCon, ShakaCon, HackInTheBox, ekoparty, AusCERT, GovCERT, CONFidence, the FBI, the NSA, DARPA, the National Defense University, the United States Naval Academy at Annapolis, and the United States Military Academy at West Point.

His favorite Amendments to the US Constitution are, in no particular order, the 1st, 2nd, 9th, & 10th.

Deviant's first and strongest love has always been teaching. A graduate of the New Jersey Institute of Technology's Science, Technology, & Society program, he is always fascinated by the interplay that connects human values and social trends to developments in the technical world. While earning his BS degree at NJIT, Deviant also completed the History degree program at Rutgers University.

Wild West Hackin' Fest Socials
Twitter: twitter.com/wwhackinfest
LinkedIn: www.linkedin.com/company/wild-west-hackin-fest/

Wild West Hackin' Fest Shirts & Hoodies
spearphish-general-store.myshopify.com/collections…

Backdoors & Breaches - Incident Response Card Game
Backdoors & Breaches: www.backdoorsandbreaches.com/
Play B&B Online: play.backdoorsandbreaches.com/

Antisyphon Training
Pay What You Can: www.antisyphontraining.com/pay-what-you-can/
Live Training: www.antisyphontraining.com/course-catalog/
On Demand Training: www.antisyphontraining.com/on-demand-course-catalo…

Educational Infosec Content
Wild West Hackin' Fest YouTube: youtube.com/wildwesthackinfest
Active Countermeasures YouTube: youtube.com/activecountermeasures
Antisyphon Training YouTube: youtube.com/antisyphontraining

All Comments (21)
  • @AttentiveDragon
    Sometimes you click on a video on a whim, not sure if you'll find it interesting, and then 40 minutes later you're disappointed that it's over and wish for more. This is one of those videos.
  • @micjolly4623
    I work as a HVAC service tec, I get into everywhere. Bank vaults, operating rooms, server rooms, roof tops, back rooms of police stations, very little questions. People just trust service people and never question all the tools.
  • Lockpicking Lawyer: This is how I defeated the lock. Deviant Ollam: This is how I defeated the door.
  • @plasticflower
    This seems like one of the most interesting and fun lines of work I've ever heard of. I just can't imagine someone ever going to work thinking "ahh, just another boring day of circumventing security measures to get into a building"...
  • @staninjapan07
    The most worthwhile random YouTube click for a long time. Thanks.
  • @leftyeh6495
    Number 1, look like you belong there. Couldn't tell you how many times I've walked around a secured facility (as an actual vetted service tech with temporary credentials and either an escort or temp keycard) and nobody asks any questions. I have a shirt that matches the name on the truck, generally normal looking for a service electrician (shirt, bluejeans, workboots, safety glasses) and I know I'm supposed to be there. Without fail nobody will ever give me a second glance except to wonder what I'm working on. The people having issues are more than happy to let me into any room I ask for when I give them an explanation that they don't understand. Only places I've worked with real security were military. Kind of places where I needed to explain to the guards and inspectors what I was doing, why I was doing it, what exact tools I needed, and they would let me wait for however long it took them to decide if it was legit or tell me nope, not going to happen right now. Toolbelt would be inspected, sometimes not allowed. Metal detector, no phone, no anything. Walk into rooms with 100% blacked out monitors with everyone in there waiting for me to leave so they could resume operations. All while having guards with m4's supervising.
  • @ChristnThms
    Funny thing... I don't, and never have worked security of any sort, but have employed several of these tricks. I work building maintenance, mostly for office buildings. You'd be surprised (or maybe not) how often people will lock themselves out of something, and request that I defeat their lock in order to get them in without calling a locksmith or similar professional. The irony, of course, is that they fail to grasp that if I can get in without a key, that anyone else can as well... The cognitive dissonance is strong.
  • @neojack333
    a few years ago my gf broke her key inside her U-shaped lock for her bycicle. THe bycicle was attached in a crowed public place (marché Jean-Talon , Montreal). i wen there with my grinder. It was a total mess, heavy grinding noise and sparks, but only one guy asked me "hey it is your bike ?" i just answered "yes, my key is broken inside". and then, without checking the lock, he actually HELPED me lol. by the time we finished, about 5-10 people were gathered, and they applauded when i released the bike. I left and laughed real hard internally, because really, I could have stolen it with people applauding me in the end. It's just like if you act like you own stuff, people believe you naturally.
  • @clankplusm
    i learned the whole thing at around 7:00 about dead latch etc as a kid when i was 8, or so, breaking into my brothers room (he's basically a decade older than me) when he wasn't home using a spoon's handle. eventually he got a new locking doorknob with the dead latch or whatever, and i learned within like 10 minuites that if i pulled the door with some force towards me, there would be a noticeable click, and suddenly i could go to town and shimmy the door again. after i got in i spent like 2 minuites playing around with the bolt and the latch and noticed how it all worked. i also noticed the strikeplate for the latch was new, it just wasn't adjusted and people protect server rooms with this stuff, that a curious and boredom-motivated 8 year old with a spoon can defeat.
  • @deltaray3
    Sometimes you don't even have to look like you belong. Once I was able to get all the way into a "secured" server room during the day wearing shorts and a t-shirt with no special tools and it was a network admin who just let me in, no questions. I told them one of the problems was that they had too many people on the allowed list and didn't know everyone. Generally all the people on the list should know each other or it's too many. The number of people who told me after that one that "Well you look trustworthy" just about made me cry.
  • @danm3188
    Sheesh. I watch this video on a whim, and now I need to spend $60 on keys I'll probably never use!
  • I've been a hobby lock picker (for fun and profit) for more than 35 years, and have seen this vid popping up for several days now. but I didn't want to watch a 45 min vid. OMG the massive level of information within this vid is amaze-balls. The way its presented makes the vid move FAST. Like others have said. I now need to spend about $60 on a new keychain.
  • @HouseMouset22
    im a delivery guy in new york city, linear and door king make shit systems that take forever to navigate. the information in this video has saved me many minutes so far and for that i thank you.
  • That "look like you belong" is something I learned at community college, I worked part time for IT and they ran out of student-worker badges. By that time I was familiar with my job and unconcerned, it blew my mind that nobody would care or question someone rolling a cart piled with dozens of computers in and out off buildings and the parkinglot.
  • @fullfire0
    Key list FEO-K1 Elevator Key C415A Filing cabinet key CH751 Filing Cabinet key 1284X Cop Car / Taxi Car keys Jigglers Wire Loop (Paper clip with burned insulation of tips) 16120 Door King Key 222343 Linear Key (A126) Cuff Key Build yourself a master key ring!
  • @JenosIdallian
    From watching a story about Ted Gowdy leaving the senate, to a lecture on why talking to the police is bad, to a lecture about how to break into.... well... everything. The YT algorithm is sending me some really strange messages.