Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

5/15/2009
08:30 AM
50%
50%

'Kramer' Is In The Building

My firm, Secure Network Technologies, was recently hired by a large healthcare provider to perform a security assessment. As part of the job, my partner, Bob Clary, posed as an employee, similar to the "Seinfeld" episode in which Kramer shows up and works at a company where he was never actually hired.

My firm, Secure Network Technologies, was recently hired by a large healthcare provider to perform a security assessment. As part of the job, my partner, Bob Clary, posed as an employee, similar to the "Seinfeld" episode in which Kramer shows up and works at a company where he was never actually hired.The job included both an internal and external network examination. The company had a significant number of internal systems, so being on the inside to perform the needed scanning helped considerably.

The client also had moved into a new building and requested we test its physical security and social-engineer our way into the building to connect to the network. By leveraging the ability to be on the inside of the network, our vulnerability scanning and testing of its network security would be considerably more efficient.

So Bob entered the building as if he were just another employee. Unlike other social-engineering efforts that require disguises, following the company dress code of business casual seemed appropriate. Bob wore his favored attire of blue jeans and t-shirt, accompanied by white sneakers.

When he entered the building on day one, he walked by security and rode the elevator to the first available floor. Within minutes, he had located an empty cubicle, connected his laptop, and started scanning the network. On day two, he entered the building and successfully commandeered another floor and cubicle. Within the next few days, Bob was reserving conference rooms -- and in some cases, asking occupants to leave when they overstayed their reserved time.

This madness continued for the next four weeks. When Bob was not scanning the network or trying to locate vulnerabilities, he started collaborating with employees. Within this short period of time, he was participating in birthday parties, pot luck lunches, and numerous other social events. Additionally, Bob was frequently seen rummaging through filing cabinets, taking pictures inside the facility, and moving floor to floor, working at his computer in different places.

As we neared completion of the engagement, the normal process of examining the results and writing the report took place. Approximately two to three weeks had passed, and we were ready to deliver our report to the customer. The client was appalled by the lack of building security. Although we had documented the physical security deficiencies with photographs, we were asked if we would go back and provide some hidden camera video footage. We agreed, and Bob returned to his former nonemployer the next day.

With no surprise, Bob easily entered the building, returning to the most common areas inside of the facility. Interestingly, he was greeted by several of his "co-workers," frequently asking him about his recent disappearance and whereabouts.

It wasn't just the building security that the client needed to worry about in protecting its digital and nondigital assets: Employees need to be conscious of the threat of an inside imposter. Bob's ability to work at this facility without raising suspicion was similar to Kramer's caper. But, unlike Kramer, Bob left the facility without being fired and returned to his real occupation as a security expert. He now holds the company record for going undetected inside a facility for the longest period of time.

Steve Stasiukonis is vice president and founder of Secure Network Technologies Inc. Steve serves as president of Secure Network, focusing on penetration testing, information security risk assessments, incident response and digital investigations. Steve has worked in the field of information security since 1997. As a part of that experience, Steve is an ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-25250
PUBLISHED: 2021-04-13
An improper access control vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service and OfficeScan XG SP1 on a sensitive file could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privil...
CVE-2021-25253
PUBLISHED: 2021-04-13
An improper access control vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service and OfficeScan XG SP1 on a resource used by the service could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to exec...
CVE-2021-28645
PUBLISHED: 2021-04-13
An incorrect permission assignment vulnerability in Trend Micro Apex One, Apex One as a Service and OfficeScan XG SP1 could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target ...
CVE-2021-28646
PUBLISHED: 2021-04-13
An insecure file permissions vulnerability in Trend Micro Apex One, Apex One as a Service and OfficeScan XG SP1 could allow a local attacker to take control of a specific log file on affected installations.
CVE-2021-28647
PUBLISHED: 2021-04-13
Trend Micro Password Manager version 5 (Consumer) is vulnerable to a DLL Hijacking vulnerability which could allow an attacker to inject a malicious DLL file during the installation progress and could execute a malicious program each time a user installs a program.