Discussion

Let's Get Physical

illithid0: From one red teamer to red teamer to another, glad your first assessment went so well and you had a great time. My first physical pentest made me want to never sit in front of a terminal again.People, as we like to say, are not paid enough to care. At-will employment, company-sponsored healthcare, etc. have employees so focused on their own wellbeing that protecting "the company" is the last thing on their minds, and I can't really blame them. That lady who you barged in on may very well have just been used to micromanaging jerks doing it to her all the time, so she has to seem busy.Physical security, in my experience, comes down to giving people something to protect which actually benefits them to protect. All the technical controls in the building can fail and one person with enough skin in the game can kill an intrusion attempt in seconds.

sillysaurusx: I want to hear about your first assessment please! (Former pentester here. I never got to do a physical red team but always daydreamed about it.)

simlevesque: I love pentesting stories. Great blog post, I was smiling while reading most of it.It reminded me of Deviant Ollam's stories such has his elevator security talk w/ Howard Payne: https://www.youtube.com/watch?v=oHf1vD5_b5I

crowfunder: This post was so engaging to read, it felt like the best war-story you'd randomly hear in the break room. Gotta check out the rest of OP's posts.

nathan_douglas: Great stuff. I love that there's this kind of modern noir tone to the writing.> I wanted to try and see if we could bypass the door entirely, and that’s where the canned air comes in. If you turn a can of compressed air upside down, it starts “boiling off cold gases.” These are not harmful in open spaces, and their temperature is well below freezing point even when gaseous. This can trigger a sensor that checks for temperature increases: First it sees a drop to -50C, thinks “Baby, it’s cold outside.” Then, the temperature starts rising again, and the sensor thinks “Oh, temperature going up?! Must be a human!” and opens the door. If this works, I will update my Mastodon. If it doesn’t, well I can still walk in after someone, so it’s a finding nonetheless.I enjoyed it a lot.