Perimeter
2/22/2011
12:22 PM
50%
50%

Using HVAC To Set Up A Hack

Social engineering caper begins with posing as heating ventilation and air conditioning repairmen

My firm was recently hired to perform a network assessment for a large financial institution. The goal of this engagement was circumventing physical controls and gaining access to the organization's internal network infrastructure. The firm's management was concerned that its server room could be easily penetrated, despite training its employees to look for security badges and to question wandering visitors and vendors.

We decided to pose as heating ventilation and air conditioning (HVAC) contractors -- a decision that paid off when we first walked in the door.

Before that, though, we first had to gain as much intelligence as possible about the location. The firm was located in an opulent office park owned and maintained by a management company that also kept an office on-site. My partner and I visited the leasing office as owners of a technology company interested in leasing space. We met with the property manager and were able to get a tour of all the offices and suites located within the building of our customer.

During the tour, we were able to get critical pieces of information that would allow us to determine the best identity needed to gain access to the customer's office. We learned that tenants placed service and maintenance calls through the management company, and the management company would then dispatch certain vendors to address and repair the problem. With a few more probing questions, we obtained the service dispatch forms, the frequency of preventive maintenance performed, but, most importantly, a list of contractors. To get ready for our entry attempt as the HVAC contractor used by the facility, we prepared our usual theatrical props of embroidered shirts, tool belts, ladders, and our van with the HVAC company logo plastered on both sides. Concealed within our toolbelts and boxes were the items we needed to gain internal network access -- a wireless access point and the necessary cables.

When we entered the building in our HVAC repairmen disguises, right away we were met by a person who questioned our activity. We told her that a complaint had came through the management company that the heating and ventilation system was out of balance and needed adjustment. She immediately acknowledged our service call by expressing her complaints about the facility being too warm. She then guided us from location to location, indicating the system was moving either too much air or not enough. This guided tour was helpful in gaining us credibility within the office, but her presence made it impossible to plant the wireless access point. We endured more than 30 minutes of listening to her complaints about the temperature and environment and addressed here specific areas of concern. We told her that we agreed her issues were valid and that we would immediately address them, and then we noticed that she was beginning to relax and trust us.

As we walked through each part of the office looking for a chance to plug in our device, our escort noted that the most important area of heating and cooling was the room that housed all the computers. She swiped her card in the entryway to the computer room, and then led us into this forbidden area. Although the area appeared to be at normal temperature, she requested we check the room's cooling system. Now was our chance: We carefully positioned our ladder to obscure any view of us positioning our wireless device, while at the same time trying to distract her attention. We successfully installed the wireless access point, and then wrapped up our visit so we could come back later and gain access to the network while sitting in the parking lot.

We left the duped guide with a list of "to do" items that we never repaired, and realized the value of what the HVAC repair person brings when social engineering your way into a secured location. There are similarities with gaining access to office networks disguised as a copier technician: While the copier or printer could be working fine, someone always hates it. Turns out the HVAC person has the same luxury of ease-of-entry: The financial services firm had no requests for service, but chances are someone in the office will always want to voice their personal needs or comfort, thus giving us an "in."

Unfortunately, personal comfort ended up leaving the company's network wide open for a breach.

Steve Stasiukonis is vice president and founder of Secure Network Technologies Inc.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-8142
Published: 2014-12-20
Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.36, 5.5.x before 5.5.20, and 5.6.x before 5.6.4 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate keys w...

CVE-2013-4440
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 generates weak non-tty passwords, which makes it easier for context-dependent attackers to guess the password via a brute-force attack.

CVE-2013-4442
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 uses weak pseudo generated numbers when /dev/urandom is unavailable, which makes it easier for context-dependent attackers to guess the numbers.

CVE-2013-7401
Published: 2014-12-19
The parse_request function in request.c in c-icap 0.2.x allows remote attackers to cause a denial of service (crash) via a URI without a " " or "?" character in an ICAP request, as demonstrated by use of the OPTIONS method.

CVE-2014-2026
Published: 2014-12-19
Cross-site scripting (XSS) vulnerability in the search functionality in United Planet Intrexx Professional before 5.2 Online Update 0905 and 6.x before 6.0 Online Update 10 allows remote attackers to inject arbitrary web script or HTML via the request parameter.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.