[Music]
me
[Music]
you will know why
we are doing this okay
i'm daniel eisler i'm social engineer
pentester and security consultant i'm
the team leader of friendly rats
the social engineering unit of dreamlab
technologies in chile
let's start this
what is a red team or what we know or
what we think about red team
i like
this definition of dale pearson
i don't know if everyone are occurred
with this but i like
this definition
what do we expect from our red team
we always think in the unit about red
team and we always say we want to
emulate a real attack we want an mma
scenario you know yeah everything counts
we want the company to know anything
until the end we cannot have prior
information or there may only legal
political restriction that is the
perfect scenario for us but
what real happens
it shouldn't
not be the same as a real attack
it's not an mms scenario it's not
everything counts
the company asks to know every move that
we make
the company provides
information and aggregates specific
goals
and restrictions conditions are added
to the service
and it's chosen to leave only some
vectors in black box guess
what usually those of social engineering
types of company that hires red team
services
the first one whoever hires the service
has the knowledge
and the maturity but
not the company
the person who hires prefers to
transform it into an internal pen test
with several access granted
the third one
instead of looking for threats and
recognizing vulnerabilities their
vulnerabilities they prefer to try
specific topics
and there's a fourth one
there is a maturity and experience that
allows an integral exercise of red team
to take place so
let's forget the three and stay with the
last one yes
that company that we all want to work
with
that one that allows us to live what we
have always heard about in the stories
of others
but now we can experience this in first
hand
something that invite us to try all our
tools creativity and strategies
full pandemic
tory city mandatory quarantine a client
decides to activate a red team service
reinforcing the circumstances as a
perfect scenario for eventual attack
and consequently a perfect opportunity
for simulation in red team format
the request was received with enthusiasm
but the entire team
until
they mention it will include
physical access tests dumpster diving
connection of hid devices access to
critical spaces detection and
exploitation of vulnerabilities in
workstations
the service will start with an intrusion
the entire service is gonna last two
weeks
and we need to get in like a worker and
the crown jewels are critical spaces
no matter which are the crown jewels or
the threads to be emulated this stage
provides clear directions for process of
information gathering and even limits
the parameters on places to be searched
it even established first indications of
possible threats
day 0
scotch tape
the ocean process is initiated with
specific focus on specific areas
collaborators and job information
available online
it is possible to identify several
employees who deliver enough information
in order to begin to build a pretext
among them it is important to remember
the person whom we will call
brian jackson
who works on the c-level area and expose
corporate critical information on social
media and his accounts profiles are
public
now i'm able to configure a persona and
the pretext to present during the
nutrition a collaborator
photos of corporate id and access card
to the building are found on social
networks
remember that we are in the middle of a
pandemic and no non-essential services
were available so our provider who
prints the cards on lanyard
was not a possibility
the only viable option was to design a
replica in photoshop
but remember we didn't have the
equipment to make a replica of
acceptable quality so
we dust off an old printer and look for
possibilities to print
after a couple of tries we managed to
get a
close
at a pretty decent level with a
transparency mika and scotch tape yes
scotch tape
to access the offices we had to pass
through two controls with guards
day one
danny boy
[Music]
hoping to find workers in the
proximities of the building to clone at
least a couple of access cards
we found something that we never expect
to make a basic description of what i
got
it was more like a scene
from i am leather
[Music]
my name is robert neville
if anyone is out there
please
but
not that kind of legend
more like a legend in downtown santiago
chile okay
so the options to clone was immediately
immediately discarded without any other
option i decided to test the axes by the
main entrance
and one of the guards came from inside
and taxed me
foreign
just when one person was coming out from
the only door available
where also biometric validation and
request
i managed to access by tailgating and
have a given half step inside the person
returns and interrogates me
i went on my way noticing his bewell
reward he was a worry you know
he the world the world stayed
a few meters later i managed to
understand why he was so
bewilderment
he was the only person on the floor
of more than a hundred workers and i had
just tailgating the guard and the only
person on the floor
being at the workstation
chosen for the simulation i begin to sit
down comfortably
and to do what should be done in those
cases
the most complex and difficult thing
when one reached this point
to calm down
and be there
to be like someone who works there
yes i know it sounds obvious and even
ridiculous
but the most current thing in physical
penetration testers is that at this
point they look like
the tasmanian monster and drugs looking
for something to eat
so
just
calm down
yes
he took my bat
are you tired to not have a real
credential
get this one
yes that was paced with scotch tape and
printed on a transparency mika by a
printer of no more than 50 bucks in fact
this one
i was doing my best not to look at my
momma worthy piece of heart call now
he starred the dumpster diving
collecting a set of about 28 inches of
loose documents
and he took them to his workstation
which in about two hours was transformed
into four
workstations
full of documents in search of possible
critical information
danny boy phone access credentials
printed emails
process descriptions on ip
addresses
[Music]
day 2 monolithic
keys
sorry
i started the day with a passive
recognition with a coffee in my hand
greeting the guard
that this day was a new one he asked me
very seriously to send an email from my
supposed boss
justifying my presence in the office
to which i respond positively mentioning
that i will request the sending of the
email as soon as possible
i detect a set of computers there were
next to him
they were for a public use
and remind
unlocked i asked to the guard if i can
use one of the mouses of this computer
for a while he says yes
so then i bend down to disconnect the
cable from the cabinet and take
advantage to the justify situation to
connect my rubber
mouse
so but
don't
get excited because the computer were on
isolated network segment
and does not compromise any critical
information
it was expected but it's always good to
roll out you know
so
always bring your
rubber mouse
i returned to my workplace
in one of the rounds of the guard i
decided to follow him and realize a
possible
vulnerability generated by the content
contingency through the operation of
remote desktop desktop computers
so
let's check it out this
if one of the computers was turned off
restarted or had some kind of connection
error the collaborators called to the
reception to request technical support
from the same guard how step 1
the worker identified himself by phone
with the guard and indicate the
connection problem step 2 indicates the
location of the workstation step 3 the
worker calls back now straight to their
extension at the workstation
step 4 the worker dictates his username
and password to the guard on the guard
enter it bingo we will have access just
implement a keylogger and you're
done what was the problem
most computers were notebooks or hard or
hard wireless
keyboards and our device this one or
keylogger was exclusive for capturing
keystrokes on wired keyboards
i managed to find a computer with a
wired keyboard
and there's this one with a large sign
that says
please
do not
turn off
with a respect
and only press the reset button
after installing our keylogger on the
usb port
of the keyboard
i quickly made my way to my workstation
and i heard in the distance the guard's
phone on the start of the protocol that
you already know monitoring the key
logger
in real time with wi-fi i realized that
the information was incomplete
i looked for another computer with a
similar characteristics but
i do not find any
nor did i think
in that time about moving
the keyboard from the previous one to
another compatible one which now that i
think
about it it was quite logical and will
not have raised alerts from that red
team onwards we always carry a wired
keyword
so
back to the first notebook which i
didn't turn off remember it didn't turn
off only rested button
so i rested again
it hasn't shut down which is what they
were asking not to do it
so this time i need to document the
action as a proof of findings with my
hearts beating like you know what sounds
russian techno mm-hmm i sneak
up to leave a record for the audio
recording i managed to record the
conversation i start recording the
keystrokes on the keyboard with the our
keylogger
but they're surprisingly stop
registering
what happened
the guard
start
to put the password of the user in the
phone
and suddenly in the middle
of the password he decides to
move
to the keyboard of the notebook
why
i don't know
maybe he's a funny guy
so at this point
don't worry we have a lot of information
so at this point in the test the rest of
the team was already remotely performing
tests with the ip founds yeah
credentials detected and information
collected in the dumpster diving
stage yeah i decided to begin our
recognition of other floors
especially the one that was selected as
the crown duo
by the client yeah and also the floor
where jackson's remember this guy
do you remember him
brian jackson yeah the guy from the
ocean well keep this made in mind don't
forget it please
accompany by the classic launch reheated
in october where you know tupperware
very typical chilean
tupperware
so i head to the floor in question that
we knew contain a common area to eat
again
the entrance is by biometric
authentication but
in this case
there was an intercom
i enter as the nephew who arrives at the
house of the uncles he never sees
and comes to ask for a favor and tries
to hide stupidly
carrying my topper as a sacred offer i
head to the guard pause to greet him
again
i tried to disguise my impression by
seeing the three giant monitors
with a huge number of cameras by which
not only the cctv is monitored
but also
all my movements
all my movements all my movements
all my movements all my movements all my
movements all my movements all my
movements
since i was the only employee
within the entire company
[Music]
oh to reheated food
he was stupefied in front of the
microwave for a minute and 30 seconds
he reviewed everything he has done in
the last 48 hours
he thought that at any moment the chief
of security could have entered with the
police
and ruined all the service he thought
that all his movements were recorded
and apparently he has no
race any alerts having entered
at least 70 workstations
hmm
i completely lose my appetite
i throw away the kitchen go to the
entrance allowing access to the crown
jewel
that could only be accessed by
biometrics or door unlocking by the
guard next to it
while looking at the screen like the
southern people who watched the mona
lisa the louvre and think how to steal
it
or saga lafiniakis thinking about his
next play in hangover
[Music]
the obvious questions and answers are
the gates of heaven
[Music]
standing next to me and looking at the
screen like a father watching the sunset
advising his son while the fish
and gives him advice he will remember
all his life
[Music]
the team supports his decision to bring
forward the projected actions in the
next 14 days to execute them in the
coming hours
one
lock picking tools
two
raspberry
this time the same guard from the
previous day asked him to send an email
explaining the work he was doing with
the proper authorization
that to date they have received nothing
he goes back to his workstation
russian technology
i turn us ragnar facing dignified death
[Music]
ragnar's x
and shield and now yes
i go back to my workstation
on the previous day we were able to
identify the blue team office that was
under lock and key
in order to access this i carry a lock
picking set and a raspberry pi
after having a hat a prudent time and
reviewing not having left any finding
undocumented
two men up here
at that moment my breath stopped
my pupils dilated
and this time the russian techno was
accompanied by horns
a big leather drum an ancient good old
voices of viking can't take over my head
my breath again
i wait
promise
i wait
the maintenance men come out of the last
office of that hallway
and go to another wing of the floor
i take the raspberry pi
smell of herring
yes herring the fish
i go straight to the door of the
bloating office
the door is unlocked i enter i closed
the door i literally threw myself under
one of the desk with a network point
available
i connect the rust
and i wait for the response of the team
drums
gold medals
nordic wind
smell of herring
horn
text message drums go away the smell of
herring
silence
i go out
leave the door as it was before
go back to my workstation quickly order
all the equipment save it and head to
the crown jewel
drums
russian tech
ignore the greens
[Music]
the door is closed
i look at the biometric reader as if
there is a way to open just thinking
about it doing it
i looking at the intercom thinking about
the pretext that could give me access
a small
woman from external cleaning company
she opens the door i follow her and
looks at me briefly surprises until she
see my credential hanging from my pocket
look at me and smile
i stop at the front desk she goes
straight to the crown jewel screen door
i hope she comes in
the door for security has delayed closer
i wait guess what
drones
the door is almost closed
i'm right at an angle where the guard
still can't see me
i stop the door to a finger to close
the woman walks into an office
i walk in and i head to the general
management office
drums
i'm recording everything with hiding
camera
i read all the names of each office
much
brian jackson from the ocean stage i
record all available information on
workstation
[Music]
i walked the entire floor and suddenly
gone are the herring
the drums
the northern green
russian techno
this time i just a real beat
on my breathing
i think about valhalla
my teammates
the kitchen didn't finish
the mona lisa and saga la finiakis
i immediately
realized jackson
ignoring the stupidity of the error
honestly
well
[Music]
foreign
i step into the elevator
[Music]
i walk away from valhalla
and suddenly
michael jackson's don't stop till you
get enough
start in my mind
and i think about the phone call i will
never gonna get
the hand
ah
how i got covered in this red team
i don't have
[Music]