pull down to refresh
17 replies \ @ek OP 26 Mar \ on: Social Engineering Practice 0x03 security
Update
I have been to the building today and I noticed that there's an unguarded backdoor with an elevator inside but the elevator only goes up to the 7th floor:
backdoor elevator
I didn't try the buttons but it looks like it will require a card since there's a reader. There was also a door to the staircase but it was locked.
However, that doesn't matter because I was able to enter the staircase and all floors I could have reached via this elevator through the front anyway: I entered the lobby and asked if I can wait here for my friend. The two guys in the lobby said 'sure.' After a minute or so of me "waiting" on the couch, I then asked if there's a restroom I could use. This is how I broke contact to try to explore the ground floor more freely, but there were also cameras everywhere.
When I left the restroom, I realized that the door to the staircase was literally the next door and it was indeed unlocked, so I quickly slipped through it and escaped the cameras.
staircase, first floor
After reaching the 8th floor, I noticed that the access to the 8th floor was locked like this:
staircase, 8th floor
This made sense because all the other floors were accessible via a car park anyway (see the buttons labeled P1-P7 in the first image).
What confused me was how the card reader was on the opposite wall of the door and not next to the door as on every other floor but I think that doesn't mean much.
door on floor 1-7
After I made my photos to do some research at home, I left and entered the 7th floor (doors were unlocked). I then noticed that the main elevators have buttons only outside, but none inside:
elevator touchscreen with only ground floor available ...
... with no buttons inside
I pressed 'ground floor' and left the building after that.
While writing this, I wonder what happens if you just smash a card reader. Not that I would actually try it, but I think it's somewhat reasonable to assume that if a door were only locked by a card reader, the door would unlock as some case of safety mechanism. But since the door can also be locked via a regular key (and the card reader probably simply controls the bolt as an more convenient method to unlock the same mechanism), one would still need to pick the lock.
My conclusion is that getting to the 8th floor definitely needs more sophisticated social engineering techniques than simply taking the stairs.
Nice idea @grayruby though!
reply
With this great recon, it seems like it would be more fun to try a non-social route.
First thought is lockpicking. Check out the lock again, look for the manufacturer and see if you can buy the same model. Then practice on it at home until you can lockpick it pretty quickly.
Another thought is to check the vendor of the elevator control panel. Then look for known security vulnerabilities. Maybe there is a way to clone a guest access keyfob, or there's a special access code for maintenance? This is probably less likely to work, but if it does it will be the most fun way to pwn the system.
Another possibility is that after you check out the system specs, you see that it does not track the identity of the keycard users. If that's the case, then you can just clone your friend's keycard and use it, it won't be traced back to him.
Social approach may depend on whether you want to get access to the 8th floor alone, or is crashing a party ok? Seems like the guard doesn't really check your credentials if he knows there's a party going on. So just ask your friend to tell you next time another tenant is hosting a pool party, then tell the guard "I'm here for the pool party." Just make sure you dress really cool and look the part when you do it. (This also involves your friend, but not in any way that can be traced back to him.)
reply
I was going to mention that about the system. I think it’s the best approach, along with lockpicking.
If you get a card with the same key, that’s enough. No one will question you.
reply
First thought is lockpicking. Check out the lock again, look for the manufacturer and see if you can buy the same model. Then practice on it at home until you can lockpick it pretty quickly.
this is a cool idea, I haven't thought of that! I wonder though if you can pick a lock that is additionally secured by a card reader. But a lock itself can be pretty hard to pick, too. I once had to get a door fixed and I used the opportunity to ask the artisan about locks and he showed me all the security features of my lock. I quickly lost hope to ever pick that lock, lol.
Another thought is to check the vendor of the elevator control panel. Then look for known security vulnerabilities. Maybe there is a way to clone a guest access keyfob, or there's a special access code for maintenance? This is probably less likely to work, but if it does it will be the most fun way to pwn the system.
Also very good idea but I need someone else's keyfob first unless it's really insecure. But it's definitely worth looking into!
is crashing a party ok?
Good question! Imo, it's okay. It does not get my friend into trouble and I simply want to get on the 8th floor. I don't even really want to stay there and get in the pool. I just want to prove to myself that I could get up there on my own.
So maybe I can just try to find a way to see if there's a party going on there so I don't even have to ask my friend.
reply
Damn you are really taking this mission seriously. I think you should try to figure out how to clone a key fob. Haha
reply
I am not here to fuck spiders
reply
reply
Wow, it’s one of my favourite things to say! @cryotosensei can confirm.
It’s Australian slang that means that you’re here for serious business, see this article.
Edit: Ok, that was a quite short article. Here is the definition from Urban Dictionary.
reply
It’s also one of my favourite things to say!
Join the club, @grayruby
reply
Dude I think you should reward the bounty to yourself haha
Though I guess you didn't actually get to the 8th floor... yet...
reply