Perimeter
2/22/2011
12:22 PM
Connect Directly
RSS
E-Mail
50%
50%

Using HVAC To Set Up A Hack

Social engineering caper begins with posing as heating ventilation and air conditioning repairmen

My firm was recently hired to perform a network assessment for a large financial institution. The goal of this engagement was circumventing physical controls and gaining access to the organization's internal network infrastructure. The firm's management was concerned that its server room could be easily penetrated, despite training its employees to look for security badges and to question wandering visitors and vendors.

We decided to pose as heating ventilation and air conditioning (HVAC) contractors -- a decision that paid off when we first walked in the door.

Before that, though, we first had to gain as much intelligence as possible about the location. The firm was located in an opulent office park owned and maintained by a management company that also kept an office on-site. My partner and I visited the leasing office as owners of a technology company interested in leasing space. We met with the property manager and were able to get a tour of all the offices and suites located within the building of our customer.

During the tour, we were able to get critical pieces of information that would allow us to determine the best identity needed to gain access to the customer's office. We learned that tenants placed service and maintenance calls through the management company, and the management company would then dispatch certain vendors to address and repair the problem. With a few more probing questions, we obtained the service dispatch forms, the frequency of preventive maintenance performed, but, most importantly, a list of contractors. To get ready for our entry attempt as the HVAC contractor used by the facility, we prepared our usual theatrical props of embroidered shirts, tool belts, ladders, and our van with the HVAC company logo plastered on both sides. Concealed within our toolbelts and boxes were the items we needed to gain internal network access -- a wireless access point and the necessary cables.

When we entered the building in our HVAC repairmen disguises, right away we were met by a person who questioned our activity. We told her that a complaint had came through the management company that the heating and ventilation system was out of balance and needed adjustment. She immediately acknowledged our service call by expressing her complaints about the facility being too warm. She then guided us from location to location, indicating the system was moving either too much air or not enough. This guided tour was helpful in gaining us credibility within the office, but her presence made it impossible to plant the wireless access point. We endured more than 30 minutes of listening to her complaints about the temperature and environment and addressed here specific areas of concern. We told her that we agreed her issues were valid and that we would immediately address them, and then we noticed that she was beginning to relax and trust us.

As we walked through each part of the office looking for a chance to plug in our device, our escort noted that the most important area of heating and cooling was the room that housed all the computers. She swiped her card in the entryway to the computer room, and then led us into this forbidden area. Although the area appeared to be at normal temperature, she requested we check the room's cooling system. Now was our chance: We carefully positioned our ladder to obscure any view of us positioning our wireless device, while at the same time trying to distract her attention. We successfully installed the wireless access point, and then wrapped up our visit so we could come back later and gain access to the network while sitting in the parking lot.

We left the duped guide with a list of "to do" items that we never repaired, and realized the value of what the HVAC repair person brings when social engineering your way into a secured location. There are similarities with gaining access to office networks disguised as a copier technician: While the copier or printer could be working fine, someone always hates it. Turns out the HVAC person has the same luxury of ease-of-entry: The financial services firm had no requests for service, but chances are someone in the office will always want to voice their personal needs or comfort, thus giving us an "in."

Unfortunately, personal comfort ended up leaving the company's network wide open for a breach.

Steve Stasiukonis is vice president and founder of Secure Network Technologies Inc.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-4973
Published: 2014-09-23
The ESET Personal Firewall NDIS filter (EpFwNdis.sys) driver in the Firewall Module Build 1183 (20140214) and earlier in ESET Smart Security and ESET Endpoint Security products 5.0 through 7.0 allows local users to gain privileges via a crafted argument to a 0x830020CC IOCTL call.

CVE-2014-5392
Published: 2014-09-23
XML External Entity (XXE) vulnerability in JobScheduler before 1.6.4246 and 7.x before 1.7.4241 allows remote attackers to cause a denial of service and read arbitrary files or directories via a request containing an XML external entity declaration in conjunction with an entity reference.

CVE-2014-6646
Published: 2014-09-23
The bellyhoodcom (aka com.tapatalk.bellyhoodcom) application 3.4.23 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

CVE-2014-6647
Published: 2014-09-23
The ElForro.com (aka com.tapatalk.elforrocom) application 2.4.3.10 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

CVE-2014-6648
Published: 2014-09-23
The iPhone4.TW (aka com.tapatalk.iPhone4TWforums) application 3.3.20 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

Best of the Web
Dark Reading Radio