H0w? Are You For Real?

How? Evasive facility breach in 15-minutes or less

CAVEATS

• Properly scoped with clearly defined intent & goals
  • Goal #1 = Always Physical Access
  • Goal #2 = Whatever keeps your client (CEO, Stakeholders, CLO/General Counsel) up at night
  • Goal 3+ = May increase time on target
• Solid Operating Methodology (that is followed to the T)
• Go in with the mindset of "Once your cover is blown, the engagement is over"
• Don't be a hero and stick to the plan!

How? Evasive facility breach in 15-minutes or less Cont.

1. Good Remote Recon reduces the need for On-site Surveillance
2. Properly executed Threat Profiling ensures effective Facility Exploitation
3. Well understood Client Intent and LoA increases success
4. Solid Action Logging reduces conflict and CSAT/Legal issues

All of the above are the perfect ingredients for a smooth, effective, and impact Facility Breach

Got it... But How?

• It takes longer than 15-minutes... 
  • Remote Recon
  • On-site Surveillance
  • Threat Profiling
• It only takes 15-minutes (in most scenarios)
  • Facility Access (Exploitation) - Goal #1
  • Post-Exploitation - Goal #2

Let's dive into the weeds a bit...

Remote Recon

Things to look for:

• Workplace dress code
• Nearby lunch/break venues
• Operating hours
• Badge design (orientation, logos, photos)
• Helpful websites:
  • Google (Maps, Images, Web)
  • Facebook
  • Instagram

Search the following:

• Company name
• Address
• Hashtags
• Tagged section
• Analyze who follows / comments / shares posts

Search the following:

• Job Postings
  • Technologies Used
• Employee names / titles
• Company events

Leverage this information to assist in an SE scenario or to talk your way out of getting caught.

Google Maps

Bing Maps

ArcGIS

Attack Path Planning

• Ingress/Egress Points
• Potential chokepoints (for badge cloning)
• Structure floor plan
• Trash receptacle placement?

On-Site Surveillance Staging

• Figure out where you want to be for on-site surveillance 
• Note areas of no/insufficient coverage 
• Note areas where you want to avoid

on-site Surveillance

• You're on-site, and everything you do can compromise the engagement
• Do NOT expose yourself more than needed!
• If you have what you need from Remote Recon, confirm and move on
• This isn't a stakeout; get what you need and get out
• Sound, light, movement & reflection awareness
• Don't be a hero, stick to the plan!
• If it sounds like a questionable decision in your head, it probably is

Mobile Recon Types

1. Dynamic Analysis - Vehicle in motion
2. Static Analysis - Vehicle is stationary (*optional/only if required)

Tooling

• Mobile Phone / GoPro / Dashcam

Body Posture

• Don't be a lookie-loo  
• Let your tooling do the work
• No more than two passes, ideally more than 20 minutes apart
• Use your Remote Recon output to determine your route
• Only having the tooling required to accomplish the job

Tooling

• Telephoto Capable Camera
• Something to take notes

Considerations

• Don’t get closer than necessary!
• Use adjacent parking lots/businesses if possible

Employees

• Badge exposure policy?
• Operating Hours
• What is the general business attire?
• Does it look like employees tailgate each other?

Guards / Service Providers

• Guard Desk / Receptionist Location
• Guard Shift Change Times
• Armed / LEO?
• Roaming Guard Presence & Frequency
• Shifts?

Security Cameras / Controls

• Placement, viewing angles, coverage area and types?
• Request to Exit (REX) 
• Push to Exit (REX)
• Anti-piggybacking
• Mechanical / Digital (RFID) Locks
• Mantraps / Turnstyles

Reader Protocol (e.g., Prox. EM, iCLASS, multiCLASS)

• Single factor (e.g., just card)
• Multi-factor (e.g., keypad / bio-metric)

Facility

• Chokepoints
• Vehicle/Foot Traffic

Security Cameras

• Placement, viewing angles, and coverage
• Type:
  • Varifocal Lens
  • AI
  • License plate
  • PTZ

Reader Protocol (e.g., Prox. EM, iCLASS, multiCLASS)

• Single factor (e.g., just card)
• Multi-factor (e.g., keypad / bio-metric)

Facility

• Chokepoints
• Vehicle/Foot Traffic

Mechanical Lock Types

• Traditional locks
• High-security locks
• Latch guards

Motion Sensors

• Request to Exit (REX) 
• Push to Exit (REX)
• Anti-piggybacking

Floor / Parking Area Access

• Man traps
• Stairwell
• Turnstyles
• Elevators

Tools

• Mental notes
• Mobile phone

Considerations

• Reference Camera Placement / Viewing Angles before approaching
• Blend in w/ employees
• Don’t be obvious when taking photographs
• Dim device screen all the way, on vibrate, disable shutter sound, use ide button shutter, sometimes video is better (extract screenshots later)
• Have an evacuation plan

Threat Profiling

Compilation of remote & on-site recon to determine the most likely path to success with the least resistance while remaining within the limits and intent of the engagement.

15-Minute Access Window

Badge Cloning

Shameless Plug...

Three Days / Tampa, FL

- Pre-sales & Authorization

- Remote Reconnaissance

- Digital Surveillance

- Surreptitious Entry Tactics

- Badge Cloning & Replication

- Post-Exploitation

- Live Facility Breach Exercise

Upcoming Dates (2024):

May 8 - 10

July 17 - 19

October 16 - 18

PRIVATE TRAINING AVAILABLE

Tooling Available