Join us for the Human Behavior Conference on Oct. 30th
When I was asked to be part of my first onsite social engineering (SE) engagement, I was SO thrilled, psyched, excited, and exceedingly nervous. However, when I was asked to write a blog about it afterward, I was more like, but was it actually real? Did I do what I thought I did? It was all a haze of sleepless nights and surging rushes of adrenaline. Working at Social-Engineer LLC (SECOM) for over 5 years now, many valuable lessons have been hammered into me, but now… they were made real, very real.
New lessons were also learned, and I learned those only from working with the amazing team we had onsite. I’ll break it down simply here, and then explain more as we go along in the story:
Now that you’re primed and ready for this adventure, let’s get started on the wild ride of a story that was my first Onsite SE gig.
Our assignment was to break into 9 different buildings over a span of three days. We had 3 instructors and leaders alongside a group of people who’d never done this before. Our preparations began months prior, with our team doing open-source intelligence (OSINT) gathering on the sites we were going to attack. First, we started looking into vendors, for pictures, outfits the employees and their service providers wore. From there we came up with several pretexts using utility workers, local contractors, and more. Finally, the week of the engagement arrived, however, tragedy struck. Two of our three leaders in the engagement were pulled away from us because of different circumstances.
The only fearless team leader we had left then asked that key question which guided the rest of the week, “So, have you given any thought to your pretexts?” We had a conference room round table meeting over coffee to discuss. Now while I thought I had a decent pretext as a local utility guy, with some prior work experience to back it up, it was another teammate who struck gold. She found out that they had a brand of the clock that was about to go through a licensing update. With confidence, she rallied us and supplied us with falsified letters, information on their processes, and what exactly they did for the company. We felt somewhat ready, very enthusiastic, and exceedingly nervous.
So, readying our business casual outfits and our trusty clipboards, we set out for our first attempt at our first building. There, we would meet our match. A trained, aware, and diligent security guard who would not let us through. We were disappointed, but not burned yet. And, we had a little more to go off of for our next attempt. Now, at the second building, we had to gain access through a badge-only door. So, we began tailgating a pair of employees, when suddenly my partner turned to the side and confidently walked up to a different entrance. I paused for a moment, hurried after her, and found her with her hands around her eyes looking in through a glass door. A door which, much to my surprise, a distracted employee opened for us a moment later. We were in, into the breakroom at least.
From there, we took a video of the whole building. We explored the top floor and the main floor, weaving in and out of cubicles. We exited past the guard, then re-entered to attempt to get into the bottom floor. On our second entry, we learned even more. “How?” you may ask. I simply engaged and chatted with the guard while my partner slipped into the bottom floor. What was the result? Success! I learned so much about their security protocol, possible ways around it, where it would be difficult to get into, and where it would be easy. My partner, meanwhile, got into the floor we missed and found more documents to photograph and cubicles to investigate! It was a success! We were thrilled and very keen to try some more.
Later that day, as we were scoping out future sites for an evening attack, I got antsy to go into one of the buildings and try it alone. I needed to see whether or not I could do it by myself. So, after getting approval, I got another one of my teammates to take me there. Wielding my clipboard once more, I walked in through the front door, just as they were closing. And, I was …IN! That was the most surreal moment for me, personally. I was in, just me, convincing people of my pretext and getting more information (including just exactly what a guest badge looked like on the way out). That’s when I knew for sure I could do it, not only with anyone on my team but on my own as well.
The rest of the day was spent preparing for a nighttime engagement, re-educating us on proper documentation, and really bonding as a team. Just a note, I love the people I work with but especially our last remaining team lead for the project. We know he was stressed, taking a group of noobs and training us all, but he did it. We learned what was important to take note of, and that, we didn’t really need some of the props we brought. Though, they certainly made me feel better for sure.
The next few days were spent breaking in and out of buildings, day and night, practicing skills that we needed. We tried, failed, tried again, and succeeded. We learned to push past what was comfortable for us and saw how each different team combo resulted in success in different ways. What did I learn? A lot of things.
This job was interesting for me in a way I’m not sure everyone will get, not because of some deeper understanding, but because of how it made me feel. As time goes on, and I do more jobs I will remember the names and faces of the people who were part of my first engagement; the people whom we were technically compromising but got to know. They’re almost friends in a way, and I look forward to the training they’ll receive and then testing them again. I will also remember how my team stepped up at every opportunity, and I look forward to doing so much more with them.
When I first started planning this blog, I had several ideas for how I wanted it to go. When I started writing though, I felt it was more important to just share the story, to let you know what it felt like to actually do it. While I can’t give you all the gritty details, I do look forward to meeting some of you at conferences and sharing funny stories. I also look forward to making many more friends on jobs like this. I know as well, as a team we’re going to have so many more success stories to share soon enough. So, when you try out social engineering for yourself, remember to push past your own limitations. Try it, build confidence, smile, make friends, and you’ll learn some of these exact same lessons I did. I also hope you find a team as great as the one we have…But for that, I think you’d need to come work for Social-Engineer.
Written by: Colin Hadnagy
Sources:
https://www.social-engineer.com/social-engineer-pentesting/
https://www.social-engineer.org/newsletter/what-is-your-favorite-osint-tool/
Today, the cybersecurity industry focuses a lot more on complicated solutions and tools. Companies are always looking to improve their security measures with the latest technologies. However, attackers often choose
As the year progresses, so do the social engineering scams. We know these scams are on the rise, but what exactly are they, and how do we protect our companies
