The locks on the building were of good quality.  They were 6 pin Schlage tumbler locks that incorporated 1 or more security pins.  Here's what the internals of a lock look like:

Theoretically any lock of this type is pick-able.  Raking is the first technique we used, unsuccessfully.  We then began trying to single pick the pins.  Over 30 minutes went by between the two methods used.  While impatiently waiting I looked around, hunting for other avenues into our goal.

While standing there, I noted the screws in the window were on our side of the door!  After unscrewing a screw we found the shank appeared to be long enough to go through he door.  Removing the other 9 screws, and a weather seal, out came the window, and we were on the 3rd floor.  From our reconnaissance earlier in the day we knew there was motion sensors run the length of the hallway.  Crawling over to the closest door, in order to evade the sensor, my partner began picking the interior door on the office.  After 20 minutes, without progress, we decided for him to make the LONG crawl down the hallway to where we had identified a poorly installed door that exposed the plunger.  Popping the plunger with a “Lucky-7,” house number from Home Depot, the door was opened.  He came around to the other door closer to me, opened the door, and I crawled my way over to the now opened interior door.

With no interior motion sensors we had free reign in the office.  We obtained several documents containing social security #'s and other confidential data.  Taking several tables that were available we stacked them and I jumped over the drop ceiling into the datacenter- mission completed!  We took some video, gathered evidence, and left a note for our point of contact on a monitor in the datacenter.  Everything was put back the way it was originally, the window in the hallway door was re-installed, and we made our exit through to the stairwell onto the main street- a clean getaway!

Our contact arrived at 7:30 the following morning, just as every other day.  He went to his desk, found nothing out of the ordinary, and worked through the morning.  Around noon he had to enter the datacenter for a task that needed physical access to one of the servers.  He looked over to the monitor and found our note: “Dear <Point of Contact>, Please call us to discuss your physical security.  Jeromie & Eric.”

I will be following up with several articles about circumventing several physical security devices such as HID Proximity cards, some good info and sources for lock picking, creating lockpicking tools, and definitely more on my infosec penetration testing as well.  Be sure to follow-me on Twitter!
Should you need any security assessment, regulatory compliance, web-application testing, social engineering, or red-team engagement, I would certainly appreciate the opportunity to earn your business!

An organization in California recently found a note in their data center one morning. It said “Dear Administrator, Please Call XXX-XXX-XXXX in order to discuss last night's physical security breach.” "This has to be a joke," the administrator thought. The organization has security guards, cameras, motion sensors, and interior locks on everything including the bathrooms. No alarms were tripped, no sensors showed any error or warning conditions.

The organization had hired us to conduct an Internal & External Vulnerability Assessment & Penetration Test, along with a Physical Security Penetration Test. The goal was to see if we could physically penetrate the organization and reach the data center in the middle of the night. This is a brief synopsis of our methodologies, the attack, and take-aways. This will be a multi-part Blog. Make sure to follow me on Twitter at www.twitter.com/Security_Sifu.

Remote Reconnaissance

Our initial site discovery was conducted on line. By reviewing information available on the Internet we were able to identify employees, vendors, high-level building information, and areas of interest and concern. Senior titles and emails were acquired. These could be use for a variety of email and phone based social engineering ruse. Maltego is an awesome graphical way to analyze information on the Internet, and relationships between content. It was used to graphically, and quickly, assess relationships the organization holds with business partners, associations, and manufacturers.  Below are a couple of screenshots from  Maltego.

Google Maps showed the businesses in the immediate area. Identifying how big the street was, the types of adjoining and nearby businesses, and the type of neighborhood helped determine foot traffic levels at night, the amount of car traffic, etc. A review of the physical location via Google Site Maps Street View showed the rear of the building would have less visibility than the street-facing stairwell. There is an apartment complex behind the building- this may heighten the amount of potential people monitoring/seeing the building throughout the night.

Reconnaissance Day

Our customer occupies the entire 3^rd and 4^th floors in a 4-story multi-tenant building. We took a variety of pictures and videos during this day, identifying and documenting the countermeasures and areas of weakness. One of my favorite new toys is a video camera, microphone and 3 megapixle camera that is housed in a pen. Not only does it produce a good picture and video, it was VERY cheap! I also walked several areas using my Blackberry, acting as though I was texting while walking, when in reality I was video taping the environment. Primary take-away's were large gaps in the front doors, the lack of motion detectors on the 1^st floor, access to the plunger on a poorly installed interior door, and identification of the datacenter. Monitoring the location we noted was the guards who leave at 10PM. The cleaning crew appeared to set all of the alarms on their way out.

My next blog will be about the hit the following night, I'm just about done writing it.  Make sure to follow me on Twitter at www.twitter.com/Security_Sifu.