Low Tech Hacking Street Smarts for Security Professionals Jack Wiles Dr. Terry Gudaitis Jennifer Jabbusch Russ Rogers Sean Lowther Neil Wyler, Technical Editor AMSTERDAM • BOSTON • HEIDELBERG • LONDON NEW YORK • OXFORD • PARIS • SAN DIEGO SAN FRANCISCO • SINGAPORE • SYDNEY • TOKYO Syngress is an imprint of Elsevier Acquiring Editor: Chris Katsaropoulos Development Editor: Mstt Cater Project Manager: Paul Gottehrer Designer: Russell Purdy Syngress is an imprint of Elsevier 225 Wyman Street, Waltham, MA 02451, USA # 2012 Elsevier, Inc. All rights reserved. No part of this publication may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or any information storage and retrieval system, without permission in writing from the publisher. Details on how to seek permission, further information about the Publisher’s permissions policies and our arrangements with organizations such as the Copyright Clearance Center and the Copyright Licensing Agency, can be found at our website: www.elsevier.com/permissions. This book and the individual contributions contained in it are protected under copyright by the Publisher (other than as may be noted herein). Notices Knowledge and best practice in this field are constantly changing. As new research and experience broaden our understanding, changes in research methods or professional practices, may become necessary. Practitioners and researchers must always rely on their own experience and knowledge in evaluating and using any information or methods described herein. In using such information or methods they should be mindful of their own safety and the safety of others, including parties for whom they have a professional responsibility. To the fullest extent of the law, neither the Publisher nor the authors, contributors, or editors, assume any liability for any injury and/or damage to persons or property as a matter of products liability, negligence or otherwise, or from any use or operation of any methods, products, instructions, or ideas contained in the material herein. Library of Congress Cataloging-in-Publication Data Application submitted British Library Cataloguing-in-Publication Data A catalogue record for this book is available from the British Library. ISBN: 978-1-59749-665-0 For information on all Syngress publications visit our website at www.syngress.com Printed in the United States of America 12 13 14 15 16 10 9 8 7 6 5 4 3 2 1 For information on all Syngress publications visit our website at www.syngress.com Contents Acknowledgments .................................................................................................. ix Foreword................................................................................................................. xi About the Authors ............................................................................................... xiii Introduction............................................................................................................ xv CHAPTER 1 Social engineering: The ultimate low tech hacking threat ...... 1 How easy is it? ............................................................................ 2 The mind of a social engineer..................................................... 3 The mind of a victim................................................................... 3 Tools of the social engineering trade.......................................... 4 One of my favorite tools of the trade ......................................... 5 Social engineering would never work against our company...... 7 What was I able to social engineer out of Mary?....................... 8 The final sting—two weeks later—Friday afternoon ................. 8 Why did this scam work?............................................................ 9 Let’s look at a few more social engineering tools ................... 10 Keystroke logger—Is there one under your desk? ............... 13 One of my lunchtime tools.................................................... 16 Let’s look at that telephone butt-in set on my tool belt ........... 18 Meet Mr. Phil Drake.................................................................. 19 Meet Mr. Paul Henry................................................................. 22 Traditional AV, IDS, and IPS considerations....................... 25 Traditional firewall consideration ......................................... 25 Flaw remediation ................................................................... 26 Do you have a guest user of your credit card?......................... 26 A few possible countermeasures............................................... 27 Always be slightly suspicious ............................................... 28 Start to study the art of social engineering........................... 28 Start a social engineering book library ................................. 28 Summary.................................................................................... 29 CHAPTER 2 Low tech vulnerabilities: Physical security ......................... 31 A mini risk assessment.............................................................. 32 What did I have at risk? ........................................................ 32 What were some possible threats while out on the lake? .... 33 What were some of the possible vulnerabilities? ................. 33 And finally, what about my countermeasures?..................... 34 iii iv Contents Outsider—Insider threats........................................................... 34 Some things to consider for the security of your buildings? ... 35 Check all locks for proper operation .................................... 35 Use employee badges ............................................................ 36 Shredder technology keeps changing as well ....................... 36 Keep an eye on corporate or agency phone books............... 37 Unsecured areas are targets for tailgating............................. 38 Special training for off-shift staff ......................................... 39 Bomb threats in Chicago........................................................... 40 Check those phone closets......................................................... 42 Remove a few door signs .......................................................... 42 Review video security logs ....................................................... 43 Consider adding motion-sensing lights..................................... 43 Subterranean vulnerabilities ...................................................... 44 Clean out your elephant burial ground ..................................... 46 Spot check those drop ceilings.................................................. 47 Internal auditors are your friends.............................................. 47 BONUS: Home security tips..................................................... 48 Summary.................................................................................... 49 CHAPTER 3 More about locks and ways to low tech hack them.............. 51 A little more about locks and lock picking .............................. 52 What kinds of locks are the most popular? .......................... 54 Purchasing better quality locks will be cost effective.......... 57 Be aware of lock vulnerabilities ........................................... 58 Forced entry—and other ways to cheat!................................... 60 A time-tested low tech method of forced entry.................... 61 Let’s break into a semi–high security room ............................. 63 Retracting the bolt to open the door ..................................... 64 Gaining access to the lock itself ........................................... 66 Keys and key control................................................................. 70 Social engineering and key access........................................ 70 Who has the keys to your kingdom ...................................... 70 Special key control awareness training................................. 71 Bait and switch war story that could happen to you ................ 71 Padlock shims are not a new threat ...................................... 73 Some places to go to learn and have some fun ........................ 74 My 110-year-old puzzle ........................................................ 75 More about keys and how to make one if you don’t have one ........................................................................... 76 Five pounds of my favorite keys........................................... 77 Ways to make a key if you didn’t bring a key machine .......... 79 Contents v One final lock to talk about and then we’re done .................... 81 Rim cylinder locks vs. mortise cylinder locks...................... 83 Summary.................................................................................... 85 CHAPTER 4 Low tech wireless hacking................................................. 87 Wireless 101: The electromagnetic spectrum........................... 87 Why securing wireless is hard .............................................. 90 802.11 and Bluetooth low tech hacks ....................................... 91 DoS and availability .................................................................. 91 Layer 1 DoS attacks .............................................................. 91 Layer 2 DoS attacks ............................................................ 104 Backdoors and cracks.............................................................