An organization in California recently found a note in their data center one morning. It said “Dear Administrator, Please Call XXX-XXX-XXXX in order to discuss last night's physical security breach.” "This has to be a joke," the administrator thought. The organization has security guards, cameras, motion sensors, and interior locks on everything including the bathrooms. No alarms were tripped, no sensors showed any error or warning conditions.

The organization had hired us to conduct an Internal & External Vulnerability Assessment & Penetration Test, along with a Physical Security Penetration Test. The goal was to see if we could physically penetrate the organization and reach the data center in the middle of the night. This is a brief synopsis of our methodologies, the attack, and take-aways. This will be a multi-part Blog. Make sure to follow me on Twitter at www.twitter.com/Security_Sifu.

Remote Reconnaissance

Our initial site discovery was conducted on line. By reviewing information available on the Internet we were able to identify employees, vendors, high-level building information, and areas of interest and concern. Senior titles and emails were acquired. These could be use for a variety of email and phone based social engineering ruse. Maltego is an awesome graphical way to analyze information on the Internet, and relationships between content. It was used to graphically, and quickly, assess relationships the organization holds with business partners, associations, and manufacturers.  Below are a couple of screenshots from  Maltego.

Google Maps showed the businesses in the immediate area. Identifying how big the street was, the types of adjoining and nearby businesses, and the type of neighborhood helped determine foot traffic levels at night, the amount of car traffic, etc. A review of the physical location via Google Site Maps Street View showed the rear of the building would have less visibility than the street-facing stairwell. There is an apartment complex behind the building- this may heighten the amount of potential people monitoring/seeing the building throughout the night.

Reconnaissance Day

Our customer occupies the entire 3^rd and 4^th floors in a 4-story multi-tenant building. We took a variety of pictures and videos during this day, identifying and documenting the countermeasures and areas of weakness. One of my favorite new toys is a video camera, microphone and 3 megapixle camera that is housed in a pen. Not only does it produce a good picture and video, it was VERY cheap! I also walked several areas using my Blackberry, acting as though I was texting while walking, when in reality I was video taping the environment. Primary take-away's were large gaps in the front doors, the lack of motion detectors on the 1^st floor, access to the plunger on a poorly installed interior door, and identification of the datacenter. Monitoring the location we noted was the guards who leave at 10PM. The cleaning crew appeared to set all of the alarms on their way out.

My next blog will be about the hit the following night, I'm just about done writing it.  Make sure to follow me on Twitter at www.twitter.com/Security_Sifu.

Download the Vmware Virtual Appliance

I have been conducting security assessments since 1995. When I started my consultancy, Garrison Technologies, in 1994 commercial firewalls did not exist. That being said, the ride has been interesting. I had seen the ISS scanner well before it was commercial- often shared amongst the hack and phreak crowds in the late 80's. I utilize a combination of open source and commercial tools when conducting my assessments. For the last year Rapid7's Nexpose has been one of the more prominent tools in my bag.

I was approached back around August 13^th to beta test and give any feedback I may have. I installed the application on a Vmware virtual appliance running Ubuntu 8.10. Installation basically consisted of installing Rapid7, and then installing Metasploit with the web interface. It was straight forward- no stumbling blocks yet..

Upon launching the scanner, and logging into the console, nothing appeared noticeably different. When reviewing scan results is when the integration was revealed. The # of exploits available were shown along with the # of vulnerabilities in the environment. Equally, when diving into results there was an additional Exploitation box where exploits where indeed available within Metasploit. Clicking through the URLs launched the Metasploit web interface, pre-loaded with results from the scan. While it was clear the UI was not written by the same group, the functionality worked great!

Download the Vmware Virtual Appliance if you:

• Are using Nessus to scan your environment
• Have a SAAS solution that is using Nessus as a back-end scanning engine
• Looking to validate the results of your vulnerability scans
• Are looking for a comprehensive vulnerability & penetration testing toolset

Those of you who are running Nessus, or leveraging vendors who use Nessus as the underlying scanning engine, I urge you to at minimum try a virtual appliance. I personally see huge reductions in false positives, and identification of vulnerabilities that Nessus does not. Equally, if you need to validate the results of your scans, to ensure the results are accurate & compromise is indeed possible, this is a great merger.