JACK: [MUSIC] Okay, so this one time in high school I had some friends over. Actually,
it was a sleepover. My parents weren’t home that night but I had permission to have friends stay
over. We stayed up late at night and we were playing outside in the front yard.
We had all the lights on out front and the garage door was open, too. We took a break from playing
and came in the house to get some snacks. We were sitting in the living room laughing and
eating chips, and just then a woman opens my front door and walks into my house.
We all freeze; nobody knows this woman. She looks at us, turns around, and walks back
outside. My friends ask who was that? I have no idea. I sprang up, peeked out the front window.
Nobody was there. I could feel my heart pumping. I slowly opened the front door and went outside.
As I got out there I saw someone going into my house through the garage door. I go after them,
following them. By the time I get inside there are three strangers standing in my living room looking
at my friends. It was freaky. I was bewildered. One turned to me and said you must be Albert.
I’m not Albert! I shouted. Then they said oh, you must be Eric, then. I’m not Eric,
either. Nobody here is Albert or Eric. Panic set in on the strangers in my house.
They all looked at each other with their eyes widening. I then spoke up, but there is an Albert
and an Eric that live next door. They looked at the piece of paper in their hand and back to me,
and immediately started apologizing. They came to visit the neighbors but they didn’t read the
directions right. The neighbors told them they’ll just leave the door open and they
should just walk on in since they’re arriving so late. But then they got the house wrong and
walked into my house instead. I can laugh about this now but I was freaked out at the time.
You ever make a mistake like this where when you misread one number it puts you in a situation that
has crazy consequences? JACK (INTRO): [INTRO MUSIC]
These are true stories from the dark side of the internet. I’m Jack Rhysider.
This is Darknet Diaries. [INTRO MUSIC ENDS] JACK:
I’m gonna try something a little different this episode. Usually I do one long story but instead
I’m going to do a few mini-stories. These are shorter stories which are too good to ignore
but not long enough for a full show. This first story is about a guy named Rob Fuller
who also goes by Mubix and I like using hacker names for people so I’m gonna call
him Mubix for the rest of the story. MUBIX: I work at Uber as a senior security
engineer. I’m a senior technical advisor for the HBO show Silicon Valley as well as the
host of the Hak5 show Metasploit Minute. JACK: Before he did all that he was a penetration
tester and his job was to hack into companies to test their security.
MUBIX: We were doing these tests pretty regularly for different companies.
JACK: He’d often come into work, be given a URL and a block of IP addresses,
and be told when to begin scanning to try to break into the client’s network. It’s exciting
work but it often gets repetitive. But there was one test he’ll always remember.
MUBIX: It was just a standard test out of the gate. It was really
cookie-cutter, even. We do the scope and call, we get all the IPs. The test was a bunch of IPs; it
was a company that, let’s just say made widgets. We were supposed to go after the widget maker and
the source code for the widget maker. JACK: Mubix and his team have everything they
need to start the mission to see if they can gain access to this widget maker server.
MUBIX: We start scanning and look at the website and it’s kind of off-ish.
The company that had these websites was like an LLC and the company that we had talked to
was a corporation co. It’s like this is weird but it’s similar. Same name, not a big deal.
JACK: Mubix double checks the IP addresses he was given to test and confirmed this was the same IP
block that the client gave him to test on. Him and his team proceeded to penetrate the website.
First he scans the entire IP range and starts looking for various points of entry.
There’s a web server, an e-mail server, and more but those sites look pretty secure.
No obvious vulnerabilities are reported on the scan. The members of his team start digging
into lesser-known vulnerabilities, trying to find anything that might be exploitable.
Thinking that he may not be able to get in using a web vulnerability,
Mubix gets a new plan and starts to… MUBIX: Set up a phish, get our phish ready,
find the different domains that we can send the phish to, find a couple of users.
JACK: A phish is an e-mail that is designed to trick the user to click on something they
shouldn’t be clicking so Mubix can infect their machine. But before they send the phish…
MUBIX: One of our guys on the team finds a remote code execution under one of the web apps.
JACK: Remote code execution means they can run commands on that web server. This is sometimes
called getting a shell. This is bad because people on the internet [00:05:00] should
never be allowed to execute commands on your web server directly. From there they
can do a lot of malicious things. MUBIX: He found a web application that he
could run code just remotely. JACK: The team brims with delight
upon getting this access. MUBIX: Yeah, the first shell that you
get on a pen test is really an amazing feeling. It’s great. Obviously you have bad feelings
for the company. It sucks that their security wasn’t good enough for their whatever it was or
it’s not so great for them but it’s still a great feeling that you had the skill,
or you had the timing, or whatever it was that ended up with you a shell. We all were really
excited. Everything else kind of dropped by the wayside because we had access internally.
We get into the command injection. Everybody’s really excited. We’re like awesome,
so we dumped the phish. We’re not going to do the phish anymore. We start looking at
where we can go from there. We get into the company, get the execution going,
get the call backs going to command and control stuff, we dump a Meterpreter
session on there. It calls back. JACK: A Meterpreter session is sort of a
super tool that lets you remotely control a computer. You can see what applications are
open and what it looks like from their desktop point of view, and what files are on the system,
and you can turn on the microphone, and run a programming script, and so much more.
This is part of a tool called Metasploit. MUBIX: Then we pivot into the network. It’s a
pretty Swiss cheese network. We find the same admin on every single box;
the Linux boxes have the same password as the Windows boxes. It’s just really a simple test
and we’re just hipping and hollering, very happy that all this is going on.
JACK: At this point they have gained access to a large number of systems in the network.
They have admin access to most Linux and Windows machines and have mapped out their
network pretty well. They’ve even gained access to their e-mail server and can read
all e-mails being sent in and out. MUBIX: We hadn’t found the goal yet. That
goal was the widget machine and the code for it. As we find more detail and try and figure out
where this widget machine is and where the source code for it is and stuff like that, no one on the
different team seems to have any information on this specific widget name. It’s like a key
word or a code name this company had for this new product they’re building now. We couldn’t find it
anywhere, we couldn’t find it anywhere. JACK: A week is up and it’s time to call the
client to give a progress report. MUBIX: We tell them hey, we broke in,
we found an easy web app, we found a bunch of admin access. They guy’s like,
that’s weird. We don’t really normally have admin shared at all. We do some really good security
there. That’s awesome, I’m really looking forward to the report. Then he asked about our goal. We’re
like yeah, we haven’t even found anyone who’s working on this widget thing. He’s like well,
that’s good. At least we have some security there where you’re not being able to find the developers
pretty well. He was really happy. JACK: The weekend passes. The team
starts again on Monday looking for this widget machine in their network.
MUBIX: [MUSIC] We’re still having zero luck at all finding anyone that has anything remotely
to do with this widget that we’re searching for. We can’t even find mention of it anywhere.
Like, we have access to pretty much everything this company does; e-mails,
wikis, and shares. JACK: Mubix and his team spend the
whole week scouring through the entire company looking for any information about that target
system they’re trying to find, a widget maker of some kind. But they’re finding nothing at all.
They read tons of e-mails, they map the entire network. They took full control of all
important systems and still couldn’t find it. At the end of the week they get on another call with
the client to give another progress report. MUBIX: We’re like we broke into all these things.
We couldn’t find the widget. Here’s the websites. The client’s like, that isn’t my website.
Those aren’t my IP ranges. We’re like
um, well, those are the ones you gave us. We quickly double-checked that we’re right.
The client goes and looks at the IP range that he sent me. He’s like oh, crap. That IP is one off.
We’re like uh, okay. Time to get lawyers involved and insurance involved. We need to
figure out how to fix this. JACK: Mubix and his team have realized
the severity of what’s wrong here. They have systematically and precisely broken into a
company that they do not have permission to break into. Not only that, they’ve scoured
through almost everything in that company, reading a lot of private information. This is
a serious [00:10:00] problem. This is worse than walking into the wrong house late at night. This
is more like when the SWAT team gets the address wrong and busts down the door of the wrong house.
Mubix didn’t get the IP address wrong, though; his client did. They gave him
the wrong IP to test against. MUBIX: Uh-huh. It was just the perfect
typo that went to this other company that did almost the exact same thing
which is insane. JACK: It’s kind of like if
someone misdialed your phone but the person who picked up had the same name as you and
went to the same school as you and worked at the same company as you, but it’s not you. Something
like this happening is incredible. MUBIX: It was just this weird stroke of luck or
fate, whatever, that the company we were a client of at the time, that had been on the
phone calls and stuff, was literally one digit in the IP range different than this other company.
The company that we’d broken into made very similar stuff with a very similar name.
They just didn’t make that particular type of widget.
We hadn’t noticed. We didn’t notice at all. JACK: Mubix and his team were getting increasingly
concerned. The tension in the office was very high.
MUBIX: Absolutely astronomical. The lawyers were looking up all kinds of cyber-law and
trying to find if we were on the hook for this even though it was their fault,
right, the point-of-contact’s fault. They combed through probably an entire weekend
without getting much sleep of all of the different laws and litigation and
precedence that’s out there and talking to our insurance to see what kind of liability we’re in
for and how much that’s gonna cost. JACK: The weekend passes. Monday comes
and it’s time to call the company they broke into and tell them what
happened. Lawyers prepare for the worst. MUBIX: They were bracing for the point-of-contact
to point blame at us, that we hadn’t verified it or that we hadn’t done due diligence on
the IP range. They were kind of legitimate claims, right; the pen test
company should have noticed. We should have noticed that the IP range was not
the same company but like, the company and what they did were so – the company name
and what they did were so similar. JACK: It’s time to call the client. They
wanted to speak to the head of security but they needed to get his e-mail address and phone number
but they found a clever way to get it. MUBIX: Easy; we had access to everything.
We just looked at their global address list for [inaudible] and find their security guy.
JACK: Since they had full control of their active directory server they could look anyone up
internally using their global address list. So Mubix, his manager, his team,
and the lawyers all get on the conference call. They call the head of security of the company
they just broke into. Mubix’s manager explains that they just broke into the
company and gained access to everything. MUBIX: He started apologizing, we all started
apologizing, and the security gentleman at the other company was like wait, what happened?
How’d that work? You broke in?
Great. We’ve been trying to get a pen test here for like, years and no one has ever given me
enough buy-in for it. I’m like what? You’re happy? Yeah, this is great. Do you have a report?
And we’re like yeah, here it is. Here’s the report out. He’s like, that’s amazing. Can we get you
guys back next year? It was like, holy crap. Now I can get budget for all the security problems,
the local admin stuff I’ve known for years and I just can’t get rid of it. It’s like oh my god.
[MUSIC] That could have gone so much worse.
The lawyers were on the phone and they couldn’t believe it.
It was unbelievable and he was so happy. JACK: At this point, two weeks into this,
Mubix still hasn’t even begun to test the actual company he was supposed to test against.
MUBIX: The other company was just so happy that there was not going to be a lawsuit
because technically they were at fault for providing us wrong information that they didn’t
even want another test from us. The security guy was okay. Their lawyers were kind of pissed
and their management were kind of pissed and I get it. They don’t know the technical aspects
of what went wrong and how serendipitous it was with the IP ranges [00:15:00] being so similar.
We didn’t get them back as a client but we got a new client.
JACK: This new company they actually tested against remained a client for years
and would get regular penetration tests from Mubix and his team but eventually years later
Mubix moved on from doing pen tests. MUBIX: I actually still talk to the
point-of-contract pretty regularly and he’s still telling that story to this day. The world aligned
in a lot of ways; one to screw us up by having the company so close to the original
and two to make it so that that new company wasn’t going to make us liable for it and was really
totally cool about it. JACK: [MUSIC]
Our next story is so strange that it stunned our guest and me. Maybe it’ll stun you, too. I
suppose an introduction is in order. ROBERT: Sure. Robert M. Lee. I am the CEO
and founder of Dragos. JACK: Robert started out in the
Air Force where he faced-off against many nation state attackers and advanced persistent threats.
He then moved onto the private sector doing incident response for cyber-attacks.
He then took an interest in industrial control systems and started his own
company called Dragos to defend against industrial attacks like attacks against
dams and nuclear facilities and water treatment plants. One day he gets a call from a client who
thinks they’re infected with malware. ROBERT: The client operates wind turbines and
effectively started noticing some abnormal behavior in their environment. They’re reaching
out and calling us to go do an incident response with them. When I first took the call, my question
immediately to them was well, how do you know – what are the indications that you have an
incident? How do you know that you already need an incident response? Usually there’s – unless it’s
entirely obvious, there’s questions. First off, a) we think we’re compromised.
These folks were pretty persistent that they were absolutely compromised but every question I asked
them around is data leaving your environment or are any of the turbines down? You know, any of the
normal things that might come up. They were just very cool-headed about it all and said no, no,
everything’s fine, we just know we’re compromised. It struck me to be kind of lackadaisical,
sort of laid-back attitude they were taking to the incident which my first indication this might
be an interesting case. JACK: Robert takes the case
and heads to the wind farm. ROBERT: This is not a huge wind farm.
We’re not talking your large operation. In the world of wind energy you’ve got everything from
those folks that are kind of your management companies to the folks that may be doing control
centers and SCADA, work for multiple companies. But you’ve got tons of these small little
companies that pop up that might have access to a dozen, twenty, fifty or so wind-generating units.
They’re not even really connected to the grid. They’re not really
normal electric providers like we think. They’re definitely not utilities; they’re just
generating a small amount of electricity and they sell it off to a larger company or somebody
who can get it onto the grid for them. JACK: He takes a look around the wind turbines
to see what the network looks like. The client was reporting that a dozen of their wind turbines
were infected with malware. Each of the turbines had their own Windows computer connected to it.
This computer would monitor the wind-speed, production output, health checks, and be
able to control parts of the turbine. ROBERT: As we got on-site we asked a) what
all took place? How do you know for sure that something is wrong? What made you so cool-headed
about knowing that there was an incident and not freaking out? They said oh, it’s real simple.
Our wind turbine network has been patching itself. [00:20:00] We were kind of pushed
back a little bit like, okay. So it’s been patching itself. That’s
definitely an interesting behavior. I’m like well, are you sure there’s not somebody from
IT that’s been doing patching or coordinating with the operations folks? They said oh no, no,
we checked with IT. It’s definitely just patching itself.
At that point we thought it was pretty interesting of course. We go take a look. As it turns out,
where there were Windows operating systems in the environment, they absolutely were being patched.
As we looked at it, it was pretty clear that there was malicious activity on the systems. It wasn’t
hurting anything. It wasn’t damaging anything but it was effectively early crypto-jacking software
where they were effectively using the spare resources on the system to be able to do various
crypto-currency type mining. I think this one was actually Bitcoin if I remember correctly.
JACK: The hackers who got into the computers at these wind turbines were using the systems
to mine Bitcoin. The way hackers like this work is they get dozens or hundreds
or thousands of computers that they don’t own to all mine Bitcoin for them at once.
A handful of computers mining Bitcoin like this isn’t much profit but if hundreds or thousands are
going all at once then the daily profit starts to become significant. Basically they infect
the machines with software that would utilize the spare CPU and graphics power to make money off it.
These wind turbines were connected to the internet and the hackers somehow found their way into these
systems and were making money from it. ROBERT: It seemed that the adversary was
keeping up with the patches. Our assessment of the situation was they were keeping other
malware and other adversaries off those systems by updating and then maintaining
them so that they could have their little crypto-currency farm there across the wind farm.
But probably the most interesting thing, what makes it really interesting from an IR story
has nothing to do with the fact that adversaries are taking advantage of Windows systems.
Sure, it’s interesting that it was a wind farm but what really got interesting is we made the
recommendation; here’s how we can clean this up. We figured it all out. Here’s this activity
group that’s related to cyber-crime. We can absolutely take care of this for you no problem.
It won’t be any big deal. The business leaders had come back to us and said well,
operations have pulled the data to show that we now have a faster and more reliable patch cycle
with the adversaries than our own IT departments.
It’s like look, you can’t really just let the adversary stay. There’s a lot
of risk in doing that. You don’t know what else the IP connections would be used for.
When they eventually make a mistake, all that risk is completely on you.
I advocated every which way I could but as much as I hate to admit it, the business owners decided
that they were going to let the activity remain but just put some additional monitoring in place
since they were affected and had deployed patches across the environment.
From then, operations respected what was done. These were systems that weren’t really
supported on the contract anyway. They didn’t have warranties that were gonna be voided by
the deployment of the patch. All of the normal considerations
that would have pushed against this had met this perfect storm where
they were completely comfortable with having the adversary being in that environment. It
was just stunning to me. From the adversary’s perspective, I imagine they were trying to do a
fairly low and slow approach to not be noticed in the first place, or not be
kicked out in the first place so it wasn’t like they were bogging down the systems to a point that
it was having an impact to the operations. The systems were definitely slower and the
resource utilization was high on them but it wasn’t
making it where they couldn’t produce energy from the wind turbines. Yeah, I was stunned.
Normally an operations team, industrial – your operators in the industrial control environments,
not in a million years would they allow that. Even if it somehow was better than IT they don’t want
random patches to go out whenever somebody feels like it, uncoordinated, unscheduled. But this was
a very small operation. We’re not talking like a national wind farm, a national company. This
was a smaller company that didn’t have a ton of resources in the first place. The idea of free IT
services probably seemed pretty enticing, I guess. I don’t know what went through their mind.
I was pretty stunned. I don’t want to instill the idea in people that this is common [00:25:00] at
all, or that this in any way representative of the electric industry. This is a small
junior company who didn’t know what to do in this situation and made a decision that they
were comfortable with that I wasn’t fully a fan of. As I think about this case study out loud now,
I can already see somebody being like, oh, the electric grid was threatened by blah, blah. No,
no. It’s a small number of wind turbines. It has no impact on electric grid whatsoever.
JACK: While Robert came to do incident response and clean the malware up, he left the wind farm
with malware still running. The client was happy that he was able to solve the mystery of why these
systems were patching. The client put together a plan to clean these systems up when the time
was needed and they made sure they had backups and isolated the systems so they wouldn’t be able to
get anywhere else. But they let the hacker stay on the systems and mine the Bitcoin and they let the
two live in a strange symbiosis harmony. [MUSIC] This summer I took a trip to Defcon,
the largest hacker conference in the world.
It’s just like you would imagine a hacker conference to be; lots of people wearing black,
dyed mohawks everywhere, antennas sticking out of backpacks, and blinking lights everywhere.
When I was there I got to meet Snow. She started telling me about an interesting story so I turned
on the mic and started recording. I started out by asking her how she got started as a hacker.
SNOW: It’s funny that you ask that question as we’re here at Defcon. Actually, everything that
brought me to do my career is because of Defcon. It was Defcon 18 or 19. My husband who’s been in
security for years finally decided to come and he asked me if I wanted to go. I had no interest
at all in attending a hacker conference. That was just not something I wanted to
do. But I wanted to go to Vegas and just wanted to sit out by the pool all day, and
sip on drinks and that sounded perfect. He actually ended up getting me a badge
and I think the very first talk I went and saw was something about malware reversing and it just went
over my head and I just had to get out of there as soon as possible. Where I went from there is I
found the lock-picking village. That day I picked my first couple locks and I got out of handcuffs.
I remember just feeling that rush was amazing and I loved it. From there I wandered around some
more trying to avoid talks as much as possible. I found the social engineering village. I remember
sitting in the room and watching the calls and just thinking that this was made for me.
JACK: The social engineering village at Defcon is an area where you can practice,
learn, and compete in social engineering. SNOW: Just watching people sit there and ask
like, creative ways they asked questions to get specific pieces of information and then –
I mean, they made it look easy and I knew it wasn’t that easy but how creative they were,
I think is what really sparked my interest. JACK: On stage during the competition you can
watch a live person in a sound-isolation booth on a call trying to trick someone
into giving them information they shouldn’t give out. It’s fascinating to watch this live
and to learn all the effective ways they’re lying to people to get what they want.
SNOW: After that I remember researching everything I could on social engineering.
I bought every book that was made. JACK: She went home from Defcon with a
completely new passion and she felt like she was pretty good at it so she came back
to Defcon the next year. SNOW: I went back and I competed
in the contest. JACK: She didn’t win but she learned a lot.
This contest is actually several months long and the final part being a live call on stage
at Defcon. [MUSIC] When she competed she saw what everyone else was doing and she learned
about all the places she forgot to look and all the things she forgot to do and all the different
techniques there are for lying to someone to get them to tell you the information you need.
She practiced and read even more and came back again to Defcon the next year and competed again,
this time ranking high but still not winning the competition. But Snow was determined so she went
back to studying social engineering some more and practiced even more and came back to compete for
a third year. SNOW: I won Defcon
22. I won the Black Badge. JACK: The coveted Black Badge at Defcon is rare.
It’s only given to contest winners and a select few, and besides the bragging rights of being the
winner, you also get free entry to Defcon for life. But what’s more is this started
Snow on a totally new path in life. SNOW: After I think my second year competing,
I had a good handful of people in the audience come up to me after and ask
if I would do that work for their companies. That’s really what got me going. I started my
own consultancy and I’ve worked for a handful of companies doing this. Ever since then I’ve been
just doing this work professionally. JACK: More and more companies are seeing how
the humans in the office are often the weakest link in the security
so they hire social engineers to not only test the security of the people in the company
but also they use it as an opportunity to teach them how to be safer. She tests for a variety
of security controls. SNOW: The main ones that I do
are physical security, phishing, which is [00:30:00] sending the e-mails,
vishing, with a v, voice phishing, and then I do a lot of open source intelligence-gathering. Before
I do any of these assessments I’m always going online, seeing what information I can use
to better craft my campaigns. JACK: For years she continued to do this
consulting work, testing networks and people, and one day she got a call from a Fortune 500 company
wanting her to do some social engineering tests against them.
SNOW: They just opened up a brand-new headquarters in Europe. They wanted to test their brand-new
European headquarter location. My goals for that assessment were mainly to see if I can make it
onto their floors. It was like, a twenty-floor skyscraper and they had five floors in there. That
was the main goal; get onto the floors, follow it up by seeing what information I could get
from the employees. However, the scope was really limited. I couldn’t do RFID cloning; I couldn’t do
any type of bypassing, lock-picking things like that. My hands were kind of tied in that sense.
[MUSIC] From there I decided to try to figure out who I wanted to be for this assessment.
While I’m doing open source intelligence-gathering I’m trying to find where they have their doors,
what kind of security is in place. That way I know what I’m getting into before I go on-site.
As I’m doing all this research, I’m not finding shit. It’s a brand-new building. It’s not even
on Google Maps yet. Most of my clients that I’ve done, I’m able to find their property management
companies, phone numbers, all their buildings so I can do street-view around the building,
all kinds of stuff. This one had nothing ‘cause it’s new. They didn’t even have a huge employee
presence online ‘cause that’s another thing I like to do; I like to look at Facebook, Instagram, even
LinkedIn to see who’s posting pictures of their employee badges. That way before I go on-site
I can create my own so I can blend in. I’m not finding anything during this phase. The
only thing I could think to do was show up on-site and before I actually start the assessment, do
reconnaissance. While I’m doing that I’m looking for employees wearing their badges. That way I
can snap some pictures, go back to my hotel room, create my own and then hopefully I can blend in.
I’m doing my reconnaissance. I’m walking around the building. Everything is very locked-down.
Most buildings will have a main entrance that people can come in and out of the lobby.
This one had turnstiles just into the building. They had RFID which was out of scope,
so I had a really hard time trying to figure out how to get into the building.
I was able to find a side door that was unlocked and go in that way. The second I’m in the lobby,
I’m looking around trying to find employees, trying to look for IDs,
and the receptionist looks at me. I must have stood out like a sore thumb ‘cause
she started grilling me all kinds of questions. I just explained I was waiting for a friend.
She said no, you’ve gotta wait outside. She kicks me out. Right there I’m like shit, my
cover is probably already blown, I haven’t found any pictures of employee badges. I’m stressing
out. This company paid a lot of money to fly me very far to test their security and I’m having a
hard time just finding stuff online, let alone [inaudible]. So I go back to my hotel and I’m
still trying to research. Hopefully I can find some nugget of information. I’m not
finding anything. Lots of pressure with these kinds of assessments ‘cause you wanna do good,
and especially if they’re sending you all that way to perform this kind of assessment. I’m
banging my head against the wall for a while and I finally come up with the idea because I saw a
news article they released that they had a bunch of new investors for this new building.
My idea was I was gonna be an investor-relations manager from the Americas building and I was
coming over to check out the new building and to set up meetings with potential new investors. When
you throw around the word investors with companies that big, they will bend over backwards for you.
[MUSIC] What I did is I found the phone number for a VP in the Americas. I spoofed my number
to look like it was calling from her and I called the European headquarters and said hey,
we’re sending out this investor relations manager. She just needs to do a quick tour
of the facility and then set up some times to meet with some investors. She’ll be there
tomorrow morning at 9 a.m.; please make sure she has a guest badge ready, and pretty much
give her whatever she wants ‘cause she could be bringing in a lot of money for us.
That conversation with the receptionist, she seemed very willing to help and very happy.
That kind of gave me a little boost like okay, this might work.
I show up the next morning at 9 a.m. I was wearing a business suit and I had a – [00:35:00] I
wasn’t able to find employee IDs from the Americas office so I created one from the Americas office
‘cause I wasn’t sure if they looked different in Europe which they actually did. I had an ID
created for that, I was in a business suit, I had a clipboard which was a forged document with just
a handful of questions. On the next page I had a bunch of information about local large companies
that could be potential investors. I show up to the receptionist that morning
hoping she wouldn’t recognize me ‘cause I changed my hair around, I changed my clothes,
and I had my badge on so that gave me a lot of credibility. I said hey,
I’m this person and I need to get onto – I have a meeting on this floor. She hands me a guest pass
and walks me right through to the turnstiles and the elevators and walks me right up to their
main floor which is I don’t know, floor five or six or something like that, and just leaves me
there to wait for their receptionist. I was like holy shit, I’m on the floor. I got the big goal.
I made it onto the floor. It’s just, it’s a rush. It is, oh yeah. It’s very scary and a
lot of people think that I’ve been doing this for years, like it’s easier, it doesn’t.
Every time before I do anything or if I’m talking to someone, I get that feeling in
my gut like oh god, I’m gonna get caught. But it is such a rush. I’m always nervous every time,
every time. I get onto the floor and I introduce myself to their receptionist, not the building’s
receptionist but my client receptionist now. She says oh, we’re so excited you’re here,
we’ve been waiting for you. She offered to get me some coffee and she said that she had the
facility manager that was gonna show me around and give me a tour of the building. He comes a little
bit later and he gives me a tour of every inch of their five floors. As we’re going on the tour I’m
trying to keep in mind I need to get information from him ‘cause that’s my second goal.
So I start saying things like well, I have a couple potential investors who are really
concerned about physical security. They’ve invested in other firms before and they’ve
been broken into so I need to make sure I can assure them that this is not an issue. I said
I need to know now where your issues are so I can make sure they’re fixed before I go back to them.
He went through and showed me a handful of places that were actually vulnerable. He
explained how one of the side employee entrances only, it was RFID protected. It had the red light
so it should have been locked; it actually was unlocked during business hours. That right there
is a huge finding. He showed me how if they did have meetings which were listed on their website
that they would let the receptionist just check anyone in without verifying
and a handful of other things that were just huge findings that should not be the case at all,
especially for a brand-new building. From my point of view, if I was an attacker,
I know exactly when I can get into the building, when it’s going to be unlocked. I
just have to look at their calendar which they actually had a couple events that next week,
and I would know that I just need to say hey, I’m here for this event and they would
let me right in, give me a guest badge and I would have full access to their whole office.
I was able to complete my two goals which I was so excited about. However, I wanted to see if I could
get just a little bit more information from him. I explained how I did have a phone call and asked if
there was an office I can sit in ‘cause I wanted to see if I would get access to an office.
They actually put me up in an office and they wrote my name even on the wall,
just like a name plate. I was left alone in this office with my name on it, which was really weird
and I wish I took a picture of it ‘cause it just was so surreal. As I was leaving for the
day ‘cause I was there, oh man, like four hours on-site. He gave me a very, very detailed tour. As
I was leaving, the receptionist actually offered a limo service back to my hotel which was pretty
badass. I didn’t take it because I was staying, actually at a hotel right across the street so
I thought that’d be a little suspicious. JACK: She got back to her hotel room bursting with
joy with the feeling of a job well done. SNOW: Just this huge rush. I remember going
out and getting a steak dinner that night. JACK: Snow delivered the report to the client,
outlining numerous vulnerabilities she found in her assessment.
SNOW: They were very surprised. They did not think I was gonna be able to get in.
I guess they actually had an internal bet; the guy from the Americas office and the European
office. They’re like, there’s no way. This is a brand-new building. We have RFID in place
everywhere. Every big security thing. We have cameras, we have all this, but
just by a simple lie and spoofing my phone number I was able to get so much credibility
that I didn’t look like a threat. JACK: Social engineering is becoming a
more common test for many companies. It’s always safe to [00:40:00] verify
the strange calls you get by calling that person back or e-mailing them to confirm
and to not let people tailgate you into a building, and to double-check people’s
credentials and not always trust when someone else vouches for them, or just
remember Ronald Regan’s Russian maxim… REAGAN: The maxim is ‘doveryai, yo proveryai’ -
trust but verify. JACK (OUTRO): [OUTRO MUSIC]
You’ve been listening to Darknet Diaries. You can find links and more information about each
guest in the show notes on darknetdiaries.com and this show is made by me, Jack Rhysider,
and theme music is by the ghostly Breakmaster Cylinder. Please help this show out by going
to darknetdiaries.com/donate. It means a lot to me when you do. Thank you.