Physical Security: From Locks to Dox

Transcription

1 Physical Security: From Locks to Dox Introduction to Red Team Physical Security Penetration Testing Jess Hires Jax Locksport

2 Disclaimer This information is to be used for professional and/or hobbyist use only. I am not responsible for any actions you take with the knowledge gained from this presentation. Don't get yourself in trouble. 2

3 About Me Jess Hires Information Security Analyst Founder of Jax Locksport and B-Sides JAX Founder and Coordinator of TOOOL Jax Coordinator of Jax2600/DC904 President of Jacksonville Linux Users Group Teacher of Linux, lock picking, and hacking 3

4 About This Talk Physical Security knowledge can be a critical asset on a Red Team Penetration Test. Touching on Penetration Testing Methodology Heavy on Exploitation 4

5 Topics Covered Penetration Testing Methodology Lock Identification Tools Required Attacking Locking Systems 5

6 Terminology Locksport The practice of picking locks or defeating physical security measures for fun or competition. Physical Security Using physical measures to prevent unauthorized access to valuable data or assets. 6

7 Terminology Penetration Test A test to find weaknesses in an organizations security plans, with a deliverable report of findings and remediation steps. There are several types. Red Team The team that conducts the Penetration Test. Members will often specialize in multiple disciplines, including network security and physical security. 7

8 Penetration Testing Methodology A framework for performing Penetration Tests. Pre-Engagement Interactions Reconnaissance Phase Vulnerability Analysis Phase Exploitation Phase Post-Exploitation Phase 8

9 Phase 1: Pre-Engagement Interactions Make sure your test aligns with your client's needs. Define: Scope Boundaries (off-limits) Trophies Time constraints 9

10 Phase 2: Reconnaissance Know yourself, know your enemy. Most important part of a penetration test Information gathering Passive and Active 10

11 Passive Reconnaissance Reconnaissance that is (virtually) undetectable. Google Maps Website Photos on social media Promotional videos Virtual tours 11

12 Active Reconnaissance Reconnaissance that could be easily detected. Visit the target site Take a tour Get creative 12

13 Phase 3: Vulnerability Analysis Detect weaknesses and potential road blocks. Define Targets Potential Difficulty Potential Value Define Obstacles Things to avoid Determine attack method Plan Exploitation Phase 13

14 Potential Difficulty vs Potential Value Low Difficulty High Difficulty Low Value Maybe a Target Never a Target High Value Always a Target Strategic Target 14

15 Targeting Desk Drawers Low Difficulty, Low Value Usernames and Passwords Personally Identifiable Information (PII) Filing Cabinets Low Difficulty, Low Value More PII and other sensitive information 15

16 Targeting Storage Rooms Low to High Difficulty, Low to High Value Storage media RFID tags Server Rooms Low to High Difficulty, High Value For the network Penetration Test 16

17 Targeting Vaults High Difficulty, High Value Company Secrets Other valuables? 17

18 Obstacles Perimeter Security Fences Guard Stations Locks Identify locks on your targets Higher security locks Security Cameras 18

19 Lock Identification Attacks are much different depending on the lock. Pin/Wafer Tumbler Lock picking, raking, bumping Multiple Dial Combination Lock decoding Single Dial Combination Lock manipulation Electronic Locks shoulder surfing, finger printing RFID Locks tag duplication And many more... 19

20 Pin Tumbler Lock 20

21 Tubular (Ace) Lock 21

22 Wafer Tumbler Lock 22

23 Warded Lock 23

24 Lever Lock 24

25 Multiple Dial Combination Lock 25

26 Single Dial Combination Lock 26

27 Electronic Lock 27

28 Higher Security Locks Some locks will pose more of a threat than others. Pin Tumbler locks with Sidebars Finger Pins and Angled Pins Disc Detainer locks Group 1 Combination locks Other exotic locks 28

29 Medeco Angled key cuts, rotating pins, sidebar 29

30 Medeco 30

31 Medeco 31

32 Medeco 32

33 Schlage Primus Finger pins, sidebar 33

34 Disc Detainer Lock Angled key cuts, rotating discs 34

35 Disc Detainer Lock 35

36 Phase 4: Exploitation Destroy those security mechanisms. Infiltration Social Engineering Bypass Lock Picking Exfiltration Trophies 36

37 Social Engineering Sometimes you can enter an area by tricking a legitimate person to let you in. Badges and Uniforms Delivery/Vendor Visitor New Employee Confidence 37

38 Bypass Doors and locks can sometimes be bypassed entirely, without needing to manipulate a lock. Latch tool Under Door and Push to Exit tools Specialty lock bypass tools Remove door from hinges Drop ceiling and raised floors 38

39 Loiding A flat tool used to depress the plunger of a door lock (called loiding, or carding). Also known as the credit card method Tool is called a loid, also known as Shovit Tool Open Out or Open In doors Not usable on deadbolts Light to moderate forensic evidence 39

40 Shovit Tool 40

41 Shovit Tool Open Out Door 41

42 Under the Door Tool Opens doors with lever handles from the outside. Tool is slid under the door, turned up to catch on door handle, and a wire is used to pull the lever down Easy to make Little to no forensic evidence 42

43 Under the Door Tool 43

44 Push to Exit Tool Open doors with push bars from the outside. Slide tool between the door and frame, turn it so it will strike the push bar, and pull to open the door An air wedge may be used to help the tool fit Easy to make Little to no forensic evidence 44

45 Push to Exit Tool 45

46 Lock Bypass Tools Sometimes the inner workings of a lock can be manipulated without interacting with the pins. Insert tool into keyway, past the core, to interact with internal lock mechanisms Various tools for various locks Specialized situations Little forensic evidence 46

47 Lock Bypass Tools 47

48 Knife Tool 48

49 Drop Ceiling and Raised Floor Harris, Shon. CISSP All-in-One Exam Guide, 6th Edition. New York: McGraw Hill, Print. 49

50 Lock Picking Pick all the locks! Single Pin Picking Raking Small set of tools needed Time depends on lock and skill Light forensic evidence 50

51 Lock Operation A standard pin tumbler lock. 51

52 Lock Operation Pin tumbler lock cutaway. 52

53 Lock Operation Lock with proper key. 53

54 Lock Operation Lock with improper key (one bitting too high). 54

55 Lock Operation Lock with improper key (one bitting too low). 55

56 Single Pin Picking Apply torsion. As a pin binds, lift it to the sheer line. 56

57 Single Pin Picking When a binding pin is set, a different pin will bind. 57

58 Single Pin Picking When all pins are set, the lock will open. 58

59 Raking Try to set many pins quickly. 59

60 Security Pins Various shaped pins for pick resistance. 60

61 Tubular (Ace) Lock 61

62 Specialty Lock Picks Some locks require additional tools and training. Wafer locks Warded lock Tubular (Ace) lock Disc Detainer lock Exotic shaped locks 62

63 Wafer Lock Picks (Jigglers) 63

64 Warded Lock Picks 64

65 Tubular Lock Pick 65

66 Disc Detainer Lock Pick 66

67 Cruciform Keyway Pick 67

68 Pick Gun A pick gun can make quick work of a pin tumbler lock, by snapping all of the pins simultaneously. Also known as Snap Gun Energy exerted on key pins is transferred to driver pins Creates a brief gap between keys pins and drivers pins, allowing the lock to be opened Easy to learn Moderate forensic evidence 68

69 Pick Gun 69

70 Bump Keys Using Bump Keys (or bumping) can also be a very easy way to open a pin tumbler lock. Same principle as a Pick Gun Keys are easily available, and can be duplicated Easy to learn Heavy forensic evidence 70

71 Bump Keys 71

72 Bump Keys and Hammer 72

73 Decoding Many multiple dial combination locks have a notch in each wheel, which can be easily decoded. Decoder Tool Makeshift tools Very quick if it works Little to no forensic evidence 73

74 Decoder Tool 74

75 Multiple Dial Combination Decoding 75

76 Manipulation The Art of Safe Cracking. Uses touch and sight Must be able to visualize internal components Time consuming No tools required Difficult to learn No forensic evidence 76

77 Sargent and Greenleaf

78 S&G 6730 Back 78

79 LaGard 3330 Insides 79

80 Combination Lock Side View 80

81 All Wheels Left Left Contact Point 81

82 All Wheels Left Left Contact Point

83 All Wheels Left Right Contact Point 83

84 All Wheels Left Right Contact Point

85 Manipulation Graph As wheels set, the nose drops into the drive cam. Differences in depth are measurable on the dial. Measure 1/4 or 1/8 of a dial position for precision. Dial every other number and measure the left and right contact points. Mark these on graph paper. Dial stickers are available to help with this Tape with fine markings works well too 85

86 Manipulation Graph 86

87 Some Wheels Set Left Contact Point 87

88 Some Wheels Set Left Contact Point

89 Some Wheels Set Right Contact Point 89

90 Some Wheels Set Right Contact Point

91 LaGard 3330 All Wheels Set 91

92 LaGard 3330 Bolt Retracted 92

93 More About Safe Cracking Safe Cracking for the Computer Scientist by Matt Blaze 93

94 Other Exploitation Activities Getting into a secure area can be of great benefit for the network portion of a penetration test. Install LAN taps Connect drop boxes 94

95 Phase 5: Post-Exploitation Maintaining access and covering your tracks. Key Decoding Key Duplication RFID Tag Duplication 95

96 Key Decoding Use a key gauge to decode keys. Different for each key/lock manufacturer Codes can be used to cut new keys 96

97 Key Gauge 97

98 Key Duplication Creating a duplicate key can ensure future access. Clam Shell duplication tool Used to create a mold, and cast a duplicate key Online key duplication services Only need a photo 98

99 Deliverables Show your client the damage. Findings and Documentation Areas exploited Trophies and Photos 99

100 Questions & Comments Thank you! Jess