3 ms·

> I really wonder what kind of pen testing certain people might try on this After getting spanked by DHS OIG in 2017ish, TSA has really stepped up their testin

by mike_d 3y ago

> I really wonder what kind of pen testing certain people might try on this After getting spanked by DHS OIG in 2017ish, TSA has really stepped up their testing program. They have an internal DHS red team as well as hiring outside experts for regular testing. Additionally they have a program called index testing where they take screeners from one airport and train them to do covert testing and send them to other airports, to both increase the volume of regular testing as well as exploit insider knowledge. Despite all the shit they catch, TSA has gotten really good at detecting some of the stuff that I would covertly travel with.

islewis 3y ago
> After getting spanked by DHS OIG in 2017ish I'd love to read more about this, but a quick google search didn't bring up much. Any good sources?
- mike_d 3y ago
  https://www.oig.dhs.gov/sites/default/files/assets/2017/OIG-17-112-Sep17.pdf https://www.oig.dhs.gov/sites/default/files/assets/2017/OIG-... This is the unclassified summary. It has been a while so I have just submitted a FOIA request to release it publicly, we will see where that goes.
techdragon 3y ago
Internal DHS red team sounds like one hell of a job if they include physical security checks (aka “Airport Security”) in the list of things the red team is allowed to attempt to bypass/exploit … like this could be a boring government desk job … or… it could be professional heist movie LARPing with all the fun of sneaking past the real security stuff but none of the risk of getting thrown into a jail cell to rot… and the follow on question is how they monitor and supervise this, like if it is physical pen testing the airport security line, do they carry any sort of documentation to stop things getting out of hand or is it entirely up to their superiors up the chain to stop them winding up in jail for real… I’m expecting it isn’t as exciting as it could be, but I really want to know more.
- kmoser 3y ago
  Several decades ago I was hired by a multinational bank to do software development, and one of my first tasks was to glean as much information as I could about one of the competitors' ATMs. My manager gave me a letter (on company letterhead) to carry with his contact info that described what I was doing, in the event security stopped me for spending an inordinate amount of time going through as many screens on the ATM as I could and writing down things about the UI. (Spoiler alert: nobody stopped me.) I'm not an expert in airport security at all, but I'd bet dollars to donuts that anybody doing physical pen testing of that type will carry documentation describing who they are, who they work for, and what they are doing.
  - techdragon 3y ago
    See this was my first thought but then it occurred to me that they’re trying to bypass people who are meant to be inspecting your stuff, does part of the job become “sneak past with this bit of paper” or do they carry nothing official on them to make the test more authentic, having paper documents risks biases towards staff procedures that would catch people with the document and thus end any pen testing attempts with potentially only a perceived improvement to security when they could be failing to catch people with usb drives or whatever else they are meant to be on the lookout for…
    - kmoser 3y ago
      I think your concerns are unfounded. TSA doesn't generally sift through every bit of paper in your possession, nor do they really care what's written on any of the paper you're carrying since it's unlikely to be a threat.
- owlbite 3y ago
  I'd be somewhat concerned about an overzealous officer with a gun who "stops" me before I can pull out the paperwork.
- mike_d 3y ago
  I have done physical security red teams. It is 98% paperwork and planning that lets you do the 2% fun stuff. You carry a "get out of jail free card" (basic example below) which needs to be signed by someone high enough up to be able to authorize the work you are doing. I also request that it include contact info for at least 4 people who are aware of the testing and will answer their phone. Depending on the type of engagement and location I will sometimes notify friends in law enforcement ahead of time. https://www.netspi.com/wp-content/uploads/2018/02/Physical-Penetration-Testing-Authorization-Sample.png https://www.netspi.com/wp-content/uploads/2018/02/Physical-P...
edrxty 3y ago
What were you traveling with that they detected?
miki123211 3y ago
Friend of mine worked in an adjacent industry (not TSA, not in the US even, for a contractor doing "mystery passenger" testing for major airlines I believe. Many countries require airlines to do their own checks at departure for international incoming flights, and levy big fines if a traveler with invalid documents is let through, so airlines do care about this a great deal. He once tried to travel internationally without a Passport / ID, I don't remember if this was within Schengen or not. He had a sob story about his mother dying and him trying to get home to her funeral. He was let through, partly because of people believing him, partly because of incompetence and people just not checking. A good few employees were sacked because of this.

by mike_d 3y ago

islewis 3y ago

> After getting spanked by DHS OIG in 2017ish I'd love to read more about this, but a quick google search didn't bring up much. Any good sources?

mike_d 3y ago
https://www.oig.dhs.gov/sites/default/files/assets/2017/OIG-17-112-Sep17.pdf https://www.oig.dhs.gov/sites/default/files/assets/2017/OIG-... This is the unclassified summary. It has been a while so I have just submitted a FOIA request to release it publicly, we will see where that goes.

techdragon 3y ago

Internal DHS red team sounds like one hell of a job if they include physical security checks (aka “Airport Security”) in the list of things the red team is allowed to attempt to bypass/exploit … like this could be a boring government desk job … or… it could be professional heist movie LARPing with all the fun of sneaking past the real security stuff but none of the risk of getting thrown into a jail cell to rot… and the follow on question is how they monitor and supervise this, like if it is physical pen testing the airport security line, do they carry any sort of documentation to stop things getting out of hand or is it entirely up to their superiors up the chain to stop them winding up in jail for real… I’m expecting it isn’t as exciting as it could be, but I really want to know more.

kmoser 3y ago
Several decades ago I was hired by a multinational bank to do software development, and one of my first tasks was to glean as much information as I could about one of the competitors' ATMs. My manager gave me a letter (on company letterhead) to carry with his contact info that described what I was doing, in the event security stopped me for spending an inordinate amount of time going through as many screens on the ATM as I could and writing down things about the UI. (Spoiler alert: nobody stopped me.) I'm not an expert in airport security at all, but I'd bet dollars to donuts that anybody doing physical pen testing of that type will carry documentation describing who they are, who they work for, and what they are doing.
- techdragon 3y ago
  See this was my first thought but then it occurred to me that they’re trying to bypass people who are meant to be inspecting your stuff, does part of the job become “sneak past with this bit of paper” or do they carry nothing official on them to make the test more authentic, having paper documents risks biases towards staff procedures that would catch people with the document and thus end any pen testing attempts with potentially only a perceived improvement to security when they could be failing to catch people with usb drives or whatever else they are meant to be on the lookout for…
  - kmoser 3y ago
    I think your concerns are unfounded. TSA doesn't generally sift through every bit of paper in your possession, nor do they really care what's written on any of the paper you're carrying since it's unlikely to be a threat.
owlbite 3y ago
I'd be somewhat concerned about an overzealous officer with a gun who "stops" me before I can pull out the paperwork.
mike_d 3y ago
I have done physical security red teams. It is 98% paperwork and planning that lets you do the 2% fun stuff. You carry a "get out of jail free card" (basic example below) which needs to be signed by someone high enough up to be able to authorize the work you are doing. I also request that it include contact info for at least 4 people who are aware of the testing and will answer their phone. Depending on the type of engagement and location I will sometimes notify friends in law enforcement ahead of time. https://www.netspi.com/wp-content/uploads/2018/02/Physical-Penetration-Testing-Authorization-Sample.png https://www.netspi.com/wp-content/uploads/2018/02/Physical-P...

edrxty 3y ago

What were you traveling with that they detected?

miki123211 3y ago

Friend of mine worked in an adjacent industry (not TSA, not in the US even, for a contractor doing "mystery passenger" testing for major airlines I believe. Many countries require airlines to do their own checks at departure for international incoming flights, and levy big fines if a traveler with invalid documents is let through, so airlines do care about this a great deal. He once tried to travel internationally without a Passport / ID, I don't remember if this was within Schengen or not. He had a sob story about his mother dying and him trying to get home to her funeral. He was let through, partly because of people believing him, partly because of incompetence and people just not checking. A good few employees were sacked because of this.