Perimeter
2/22/2011
12:22 PM
50%
50%

Using HVAC To Set Up A Hack

Social engineering caper begins with posing as heating ventilation and air conditioning repairmen

My firm was recently hired to perform a network assessment for a large financial institution. The goal of this engagement was circumventing physical controls and gaining access to the organization's internal network infrastructure. The firm's management was concerned that its server room could be easily penetrated, despite training its employees to look for security badges and to question wandering visitors and vendors.

We decided to pose as heating ventilation and air conditioning (HVAC) contractors -- a decision that paid off when we first walked in the door.

Before that, though, we first had to gain as much intelligence as possible about the location. The firm was located in an opulent office park owned and maintained by a management company that also kept an office on-site. My partner and I visited the leasing office as owners of a technology company interested in leasing space. We met with the property manager and were able to get a tour of all the offices and suites located within the building of our customer.

During the tour, we were able to get critical pieces of information that would allow us to determine the best identity needed to gain access to the customer's office. We learned that tenants placed service and maintenance calls through the management company, and the management company would then dispatch certain vendors to address and repair the problem. With a few more probing questions, we obtained the service dispatch forms, the frequency of preventive maintenance performed, but, most importantly, a list of contractors. To get ready for our entry attempt as the HVAC contractor used by the facility, we prepared our usual theatrical props of embroidered shirts, tool belts, ladders, and our van with the HVAC company logo plastered on both sides. Concealed within our toolbelts and boxes were the items we needed to gain internal network access -- a wireless access point and the necessary cables.

When we entered the building in our HVAC repairmen disguises, right away we were met by a person who questioned our activity. We told her that a complaint had came through the management company that the heating and ventilation system was out of balance and needed adjustment. She immediately acknowledged our service call by expressing her complaints about the facility being too warm. She then guided us from location to location, indicating the system was moving either too much air or not enough. This guided tour was helpful in gaining us credibility within the office, but her presence made it impossible to plant the wireless access point. We endured more than 30 minutes of listening to her complaints about the temperature and environment and addressed here specific areas of concern. We told her that we agreed her issues were valid and that we would immediately address them, and then we noticed that she was beginning to relax and trust us.

As we walked through each part of the office looking for a chance to plug in our device, our escort noted that the most important area of heating and cooling was the room that housed all the computers. She swiped her card in the entryway to the computer room, and then led us into this forbidden area. Although the area appeared to be at normal temperature, she requested we check the room's cooling system. Now was our chance: We carefully positioned our ladder to obscure any view of us positioning our wireless device, while at the same time trying to distract her attention. We successfully installed the wireless access point, and then wrapped up our visit so we could come back later and gain access to the network while sitting in the parking lot.

We left the duped guide with a list of "to do" items that we never repaired, and realized the value of what the HVAC repair person brings when social engineering your way into a secured location. There are similarities with gaining access to office networks disguised as a copier technician: While the copier or printer could be working fine, someone always hates it. Turns out the HVAC person has the same luxury of ease-of-entry: The financial services firm had no requests for service, but chances are someone in the office will always want to voice their personal needs or comfort, thus giving us an "in."

Unfortunately, personal comfort ended up leaving the company's network wide open for a breach.

Steve Stasiukonis is vice president and founder of Secure Network Technologies Inc.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-9710
Published: 2015-05-27
The Btrfs implementation in the Linux kernel before 3.19 does not ensure that the visible xattr state is consistent with a requested replacement, which allows local users to bypass intended ACL settings and gain privileges via standard filesystem operations (1) during an xattr-replacement time windo...

CVE-2014-9715
Published: 2015-05-27
include/net/netfilter/nf_conntrack_extend.h in the netfilter subsystem in the Linux kernel before 3.14.5 uses an insufficiently large data type for certain extension data, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) via outbound network traffic that trig...

CVE-2015-2666
Published: 2015-05-27
Stack-based buffer overflow in the get_matching_model_microcode function in arch/x86/kernel/cpu/microcode/intel_early.c in the Linux kernel before 4.0 allows context-dependent attackers to gain privileges by constructing a crafted microcode header and leveraging root privileges for write access to t...

CVE-2015-2830
Published: 2015-05-27
arch/x86/kernel/entry_64.S in the Linux kernel before 3.19.2 does not prevent the TS_COMPAT flag from reaching a user-mode task, which might allow local users to bypass the seccomp or audit protection mechanism via a crafted application that uses the (1) fork or (2) close system call, as demonstrate...

CVE-2015-2922
Published: 2015-05-27
The ndisc_router_discovery function in net/ipv6/ndisc.c in the Neighbor Discovery (ND) protocol implementation in the IPv6 stack in the Linux kernel before 3.19.6 allows remote attackers to reconfigure a hop-limit setting via a small hop_limit value in a Router Advertisement (RA) message.

Dark Reading Radio
Archived Dark Reading Radio
After a serious cybersecurity incident, everyone will be looking to you for answers -- but you’ll never have complete information and you’ll never have enough time. So in those heated moments, when a business is on the brink of collapse, how will you and the rest of the board room executives respond?