5 ms·
I wonder how much different the whole thing is just because pen-testers get paid to do this by the same company, from somebody actually trying to do this for re
by baursak 9y ago
I wonder how much different the whole thing is just because pen-testers get paid to do this by the same company, from somebody actually trying to do this for real.
Getting caught for pen-testers means something completely different, I wonder how that affects tactics.
- fhood 9y agoYeah, I was surprised by the picking locks part. That tends to be either loud or slow, and either way nearly as incriminating if caught as it is possible to be.
- JshWright 9y agoDepends on the lock... A rake isn't that loud (could easily be covered by a cough), and will defeat a lot of cheap interior locks pretty quickly.
- DarronWyke 9y agoAnd if you straight up loid the lock, forget about noise. It's not all loud noises from bumps or popping hinge pins out.
- surge 9y agoPicking locks isn't like on TV. They aren't talking about bumping locks. Those of use that do it as a hobby do it during meetings and barely anyone notices. If you're making a lot of noise or voiding locks, you're almost certainly doing it wrong. You're supposed to be gentle, with very little pressure, you don't force it. Most standard door and office locks, I've been able to pop in under 2 minutes. they generally only have 4-5 pins, sometimes less, especially on the interior office locks (maybe 3 in some cases). The whole reason my lock pick group does tables at security conferences is to make people aware the locks are generally not great and you want a lock that will slow someone down long enough that even if they can pick it or bypass it, doing so would get someone's attention or take so long that even after hours a security guard on routine scheduled patrols would notice.
- DarronWyke 9y agoI know all of this, I know how to pick locks. Bumping is the most common attack as it requires relatively little skill and the least amount of time (short of dynamic entry). And most common locks are vulnerable to it, so that would include many office locks since they cheap out on them. Picking takes time, but if I can loid the latch or otherwise bypass the lock, I can get through the door a lot faster than picking it. An Abloy or S&G lock does you no good if your lock fitment is shit with your dead latch not engaging.
- bm1362 9y agoIt's probably easier to get an entry-level job with the company, or the facilities contractor, a vendor etc. The turn-around is longer though and you have to supply an id and SSN that could be bought, but you'll have more access and potentially be undetected.