6 ms·

I'll Let Myself In: Tactics of Physical Pen Testers (2017) [video]

209 points by 333c 7y ago

333c 7y ago
Previous discussion: https://news.ycombinator.com/item?id=18203270 https://news.ycombinator.com/item?id=18203270
spacedog11 7y ago
This is fascinating. Thanks for sharing
jedimastert 7y ago
Deviant Ollam has some of the most informative and approchable physical security and pen testing talks out there. He's great.
- farisjarrah 7y ago
  Deviant Ollam is great, so informative. I feel like another great conterpoint to Deviant Ollam is the Lock Picking Lawyer on youtube and reddit: https://www.youtube.com/channel/UCm9K6rby98W8JigLoZOh6FQ https://www.youtube.com/channel/UCm9K6rby98W8JigLoZOh6FQ He really doesn't waste any time and just gets in there and picks or tears down locks and tells you exactly how good or bad a lock is.
  - QuadrupleA 7y ago
    I somehow got recommended LPL via the YouTube algorithm, his videos are great - and slightly wrong somehow, a lawyer compiling a hoodlum's dream encyclopedia on how to get through any lock :).
    - Something1234 7y ago
      Gotta drum up business somehow...
    - hanniabu 7y ago
      It also helps call out lock manufacturer outrageous claims and deception tricking the consumer into feeling like the lock they're buying will be secure by using it.
- danpalmer 7y ago
  He’s great at what he does professionally. I get the impression from his talks that he holds some views that may be quite exclusionary - there a some throwaway sexist comments and some political views that some may find uncomfortable or exclusionary. Watch his talks for his content, if you are ok with these things, but not everyone may be ok with his personal side. That doesn’t matter to everyone when it comes to technical topics though. Edit: FWIW, I seem to remember this particular talk and the Elevator hacking one mentioned in another thread are fine. I believe it was several layers down the YouTube rabbit hole that I started to hear comments that I objected to.
debt 7y ago
Walk confidently and never make eye contact. Easiest way to get into anywhere. It forces people to verbally call you out which people rarely do. Looking lost or "looking for something" while wandering in is another great tactic.
- Spooky23 7y ago
  I worked in a mall as a teenager and rolled a big safe across the mall through the mall to a shared loading dock for the store owner. Rent a cop guys blocked my way at the door challenged me, and I just said “Wtf does it look like I’m doing, I’m moving a safe, get that door!” So they opened the door, and I rolled the safe into a white rental van and got in the passenger side without incident.
- c22 7y ago
  I agree with "walk confidently" but I find making eye contact, smiling, nodding, or even saying "hello" while you pass does wonders to subdue people's suspicions.
  - debt 7y ago
    I agree, but it requires quickly reading the situation. Sometimes it can be as effective as not making eye contact.
  - bitbang 7y ago
    It's more the reason why you avoid eye contact. Looking nervous while shifting eyes to avoid eye contact looks suspicious. Avoiding contact because you are otherwise distracted thumbing through forms in a clipboard makes it look like you have a purpose for being there.
- chaoticmass 7y ago
  Obligatory Sneakers scene reference: https://www.youtube.com/watch?v=oG5vsPJ5Tos https://www.youtube.com/watch?v=oG5vsPJ5Tos
  - MichaelApproved 7y ago
centizen 7y ago
Ollam is top class, he manages to get so much good information across without getting long winded, and never sounds condescending.
chris_wot 7y ago
You probably should also look at "The Search for the Perfect Door", pretty fascinating. https://www.youtube.com/watch?v=4YYvBLAF4T8 https://www.youtube.com/watch?v=4YYvBLAF4T8
thejenk 7y ago
Deviant Ollam does another talk with elevator consultant Howard Payne just about elevator security which is fantastic. It's very similar to this one, but goes deeper into the single subject. There are a few versions on YouTube of various lengths, but here's the 2 hour version: https://youtube.com/watch?v=ZUvGfuLlZus https://youtube.com/watch?v=ZUvGfuLlZus
donatj 7y ago
It's nice to see this getting some love but a little bitter sweet because I posted it a year ago and it went nowhere. Oh well. Deviant Ollam is always an interesting listen. He's got a very good way of explaining things in understandable layman's terms.
aszantu 7y ago
Interesting
DigitalTerminal 7y ago
20:22 how does this help with underdoor tools you can still pull the lever down, cant you?
tzs 7y ago
What people can do without anyone noticing is unbelievable. Once upon a time, I worked at a Unix workstation manufacturer [1], which was having some financial problems. The hardware developers worked in a room in the center of our offices. It had no windows, and one door to a hallways. If you went right down that hallway, you would pass my office and another programmer's office on your left, and my supervisor's office and the office of the head of software on the right, and then reach the back door to the office. If you went left, you'd have to go past the reception desk and through an open area to reach the front door. Next to the front door was the office of the guy in charge of engineering. The way the desks were arranged in all four offices in my hall, and in the engineering head's office near reception, you could easily see if anyone walked by. The hardware developers had a large format printer in their area. That thing was something like 5 ft side, 4 feet tall, 3 feet deep, and weighed maybe 300 lbs. One morning they printed something just before noon, then went to lunch. When they got back from lunch maybe 30 minutes later, the printer was gone. During the time they were out of the hardware area, I was in my office, and at least two other people were in their offices in my hall. The receptionist was at the front desk the whole time, and the engineering head was in his office. None of us saw what happened to the printer. Later that afternoon the company we rented it from called and said that they had successfully repossessed it from us, so apparently a couple repo men managed to stroll into the office, passing several people, walk into the hardware area, disconnect the printer, and walk out with it, with nobody noticing. Our office was just engineering. Sales and admin were in a different building in the same office park. Manufacturing, shipping, and the warehouse were in a third building there. Meetings with outsiders, even outsiders who were there to meet with engineers, took place in the conference rooms in the sales/admin building. We generally didn't have visitors in the engineering building except when interviewing someone for a job, and we always knew when those were expected. [1] Callan Data Systems

209 points by 333c 7y ago

333c 7y ago

Previous discussion: https://news.ycombinator.com/item?id=18203270 https://news.ycombinator.com/item?id=18203270

spacedog11 7y ago

This is fascinating. Thanks for sharing

jedimastert 7y ago

Deviant Ollam has some of the most informative and approchable physical security and pen testing talks out there. He's great.

farisjarrah 7y ago
Deviant Ollam is great, so informative. I feel like another great conterpoint to Deviant Ollam is the Lock Picking Lawyer on youtube and reddit: https://www.youtube.com/channel/UCm9K6rby98W8JigLoZOh6FQ https://www.youtube.com/channel/UCm9K6rby98W8JigLoZOh6FQ He really doesn't waste any time and just gets in there and picks or tears down locks and tells you exactly how good or bad a lock is.
- QuadrupleA 7y ago
  I somehow got recommended LPL via the YouTube algorithm, his videos are great - and slightly wrong somehow, a lawyer compiling a hoodlum's dream encyclopedia on how to get through any lock :).
  - Something1234 7y ago
    Gotta drum up business somehow...
  - hanniabu 7y ago
    It also helps call out lock manufacturer outrageous claims and deception tricking the consumer into feeling like the lock they're buying will be secure by using it.
danpalmer 7y ago
He’s great at what he does professionally. I get the impression from his talks that he holds some views that may be quite exclusionary - there a some throwaway sexist comments and some political views that some may find uncomfortable or exclusionary. Watch his talks for his content, if you are ok with these things, but not everyone may be ok with his personal side. That doesn’t matter to everyone when it comes to technical topics though. Edit: FWIW, I seem to remember this particular talk and the Elevator hacking one mentioned in another thread are fine. I believe it was several layers down the YouTube rabbit hole that I started to hear comments that I objected to.

debt 7y ago

Walk confidently and never make eye contact. Easiest way to get into anywhere. It forces people to verbally call you out which people rarely do. Looking lost or "looking for something" while wandering in is another great tactic.

Spooky23 7y ago
I worked in a mall as a teenager and rolled a big safe across the mall through the mall to a shared loading dock for the store owner. Rent a cop guys blocked my way at the door challenged me, and I just said “Wtf does it look like I’m doing, I’m moving a safe, get that door!” So they opened the door, and I rolled the safe into a white rental van and got in the passenger side without incident.
c22 7y ago
I agree with "walk confidently" but I find making eye contact, smiling, nodding, or even saying "hello" while you pass does wonders to subdue people's suspicions.
- debt 7y ago
  I agree, but it requires quickly reading the situation. Sometimes it can be as effective as not making eye contact.
- bitbang 7y ago
  It's more the reason why you avoid eye contact. Looking nervous while shifting eyes to avoid eye contact looks suspicious. Avoiding contact because you are otherwise distracted thumbing through forms in a clipboard makes it look like you have a purpose for being there.
chaoticmass 7y ago
Obligatory Sneakers scene reference: https://www.youtube.com/watch?v=oG5vsPJ5Tos https://www.youtube.com/watch?v=oG5vsPJ5Tos
- MichaelApproved 7y ago

centizen 7y ago

Ollam is top class, he manages to get so much good information across without getting long winded, and never sounds condescending.

chris_wot 7y ago

You probably should also look at "The Search for the Perfect Door", pretty fascinating. https://www.youtube.com/watch?v=4YYvBLAF4T8 https://www.youtube.com/watch?v=4YYvBLAF4T8

thejenk 7y ago

Deviant Ollam does another talk with elevator consultant Howard Payne just about elevator security which is fantastic. It's very similar to this one, but goes deeper into the single subject. There are a few versions on YouTube of various lengths, but here's the 2 hour version: https://youtube.com/watch?v=ZUvGfuLlZus https://youtube.com/watch?v=ZUvGfuLlZus

donatj 7y ago

It's nice to see this getting some love but a little bitter sweet because I posted it a year ago and it went nowhere. Oh well. Deviant Ollam is always an interesting listen. He's got a very good way of explaining things in understandable layman's terms.

aszantu 7y ago

Interesting

DigitalTerminal 7y ago

20:22 how does this help with underdoor tools you can still pull the lever down, cant you?

tzs 7y ago

What people can do without anyone noticing is unbelievable. Once upon a time, I worked at a Unix workstation manufacturer [1], which was having some financial problems. The hardware developers worked in a room in the center of our offices. It had no windows, and one door to a hallways. If you went right down that hallway, you would pass my office and another programmer's office on your left, and my supervisor's office and the office of the head of software on the right, and then reach the back door to the office. If you went left, you'd have to go past the reception desk and through an open area to reach the front door. Next to the front door was the office of the guy in charge of engineering. The way the desks were arranged in all four offices in my hall, and in the engineering head's office near reception, you could easily see if anyone walked by. The hardware developers had a large format printer in their area. That thing was something like 5 ft side, 4 feet tall, 3 feet deep, and weighed maybe 300 lbs. One morning they printed something just before noon, then went to lunch. When they got back from lunch maybe 30 minutes later, the printer was gone. During the time they were out of the hardware area, I was in my office, and at least two other people were in their offices in my hall. The receptionist was at the front desk the whole time, and the engineering head was in his office. None of us saw what happened to the printer. Later that afternoon the company we rented it from called and said that they had successfully repossessed it from us, so apparently a couple repo men managed to stroll into the office, passing several people, walk into the hardware area, disconnect the printer, and walk out with it, with nobody noticing. Our office was just engineering. Sales and admin were in a different building in the same office park. Manufacturing, shipping, and the warehouse were in a third building there. Meetings with outsiders, even outsiders who were there to meet with engineers, took place in the conference rooms in the sales/admin building. We generally didn't have visitors in the engineering building except when interviewing someone for a job, and we always knew when those were expected. [1] Callan Data Systems