1. Exquisite Tweets from @HydeNS33k

    miketweaverCollected by miketweaver

    Gather ‘round ye lads and lasses! Sit ye for a while, and harken to my mournful tale pic.twitter.com/LuAPxsirso

    Reply Retweet Favorite

    HydeNS33k

    Jek Hyde

    This is the story of a physical penetration test I did a few months back. The client has given permission for me to tell it.

    Reply Retweet Favorite

    HydeNS33k

    Jek Hyde

    This is both the test I am most proud and most ashamed of. You’ll see why soon pic.twitter.com/3hhYrvlRX7

    Reply Retweet Favorite

    HydeNS33k

    Jek Hyde

    The client had hired me to test 2 of their facilities. A manufacturing plant, plus data center & office building nearby

    Reply Retweet Favorite

    HydeNS33k

    Jek Hyde

    First step: OSINT. I look at maps, satellite images, study what I can of their delivery and supply schedules. Etc. pic.twitter.com/slRmvqcF8z

    Reply Retweet Favorite

    HydeNS33k

    Jek Hyde

    The manufacturing facility looked like a prison. No windows, heavy iron gates, no landscaping. A monstrosity of architecture

    Reply Retweet Favorite

    HydeNS33k

    Jek Hyde

    This facility had armed guards, badge readers, biometric security controls and turnstiles at every entrance.

    Reply Retweet Favorite

    HydeNS33k

    Jek Hyde

    I remember thinking, “It’s got to be hell to work in there. I wonder if I can use that…” pic.twitter.com/UJKFs1DUXF

    Reply Retweet Favorite

    HydeNS33k

    Jek Hyde

    One thing was for sure… The chances of tailgating into this building were non-existent. pic.twitter.com/IPreWJIFVU

    Reply Retweet Favorite

    HydeNS33k

    Jek Hyde

    I was going to have to get down and dirty with my social engineering.

    Reply Retweet Favorite

    HydeNS33k

    Jek Hyde

    First stop: LinkedIn. Your LinkedIn is my best friend. The more information you have on your LinkedIn, the more options I have

    Reply Retweet Favorite

    HydeNS33k

    Jek Hyde

    I have several fake LinkedIn profiles that you are probably connected to. *Just leaving this here* pic.twitter.com/R1KM6Drml2

    Reply Retweet Favorite

    HydeNS33k

    Jek Hyde

    I scour profiles of employees who work at these facilities, and cross-reference them to other social media sites

    Reply Retweet Favorite

    HydeNS33k

    Jek Hyde

    And I find a lovely young woman who I’m going to call Mary.

    Reply Retweet Favorite

    HydeNS33k

    Jek Hyde

    Mary was a brand-new hire working as an assistant at the manufacturing facility. Mary had a public Facebook account too

    Reply Retweet Favorite

    HydeNS33k

    Jek Hyde

    On Mary’s public Facebook account, she documented all of her family’s adventures. pic.twitter.com/U1t76SrrCP

    Reply Retweet Favorite

    HydeNS33k

    Jek Hyde

    Side note: Now I know where Mary went to high school, her mother’s maiden name, the names of her pets, etc. pic.twitter.com/fxnaDB9eSH

    Reply Retweet Favorite

    HydeNS33k

    Jek Hyde

    Answers to those “security questions” you use to reset your passwords are very easy to find if you aren’t careful with that information. pic.twitter.com/i2ZhnU1kQV

    Reply Retweet Favorite

    HydeNS33k

    Jek Hyde

    Not to mention that now I know where Mary works, where her kids go to school, where they vacation… I could go on. Scary stuff

    Reply Retweet Favorite

    HydeNS33k

    Jek Hyde

    This is not an advanced investigation. I’m not a PI & I don’t have the resources of the NSA. One can do a lot of damage with simple methods

    Reply Retweet Favorite

    HydeNS33k

    Jek Hyde

    Most notably to me, were photos Mary posted of her time volunteering with a certain maternity support center

    Reply Retweet Favorite

    HydeNS33k

    Jek Hyde

    Her passion for children and caring new moms was very plain. So of course, I took advantage of it. pic.twitter.com/xKg99kPnKO

    Reply Retweet Favorite

    HydeNS33k

    Jek Hyde

    For this assessment I played two roles. For the first, I spoofed my phone number to make it look like it was coming from headquarters pic.twitter.com/UtY2x5C8q4

    Reply Retweet Favorite

    HydeNS33k

    Jek Hyde

    I called the front desk of the manufacturing facility and was transferred to Mary. “Hi Mary!” I said, “My name is Barbra.”

    Reply Retweet Favorite

    HydeNS33k

    Jek Hyde

    “I am a project coordinator with facilities management. We are renovating a few of our facilities.”

    Reply Retweet Favorite

    HydeNS33k

    Jek Hyde

    “We are sending an interior designer out to you tomorrow so she can put together proposals to update your space!” pic.twitter.com/utr2Sqr5as

    Reply Retweet Favorite

    HydeNS33k

    Jek Hyde

    Mary replied, “Well that’s great! But why the short notice?” I could feel her getting suspicious, so I pulled out my trump card…

    Reply Retweet Favorite

    HydeNS33k

    Jek Hyde

    *Sigh* “Well Mary… You really should have heard from me sooner. I’ve just been so overloaded at work…” pic.twitter.com/AJu1q9cW1T

    Reply Retweet Favorite

    HydeNS33k

    Jek Hyde

    “I feel like I can’t catch up, and to top it off the baby is due in 6 weeks. If my boss finds out I messed this up he’s going to flip.” pic.twitter.com/sjPwDQ64iR

    Reply Retweet Favorite

    HydeNS33k

    Jek Hyde

    I was really getting into this, voice shaking. (Yes, I know, I’m a terrible human being.)

    Reply Retweet Favorite

    HydeNS33k

    Jek Hyde

    She cut me off, “Oh hunny hunny it’s ok. We will work this out! Tell me about the baby! Is it your first? Boy or girl?!” pic.twitter.com/1hf2W7T873

    Reply Retweet Favorite

    HydeNS33k

    Jek Hyde

    Our Mary was committed at this point. NOT because she is stupid, but because she is a GOOD person. She wanted to help me

    Reply Retweet Favorite

    HydeNS33k

    Jek Hyde

    We talked babies and birth plans for a while (never pick a pretext you can’t speak about at length)

    Reply Retweet Favorite

    HydeNS33k

    Jek Hyde

    Mary took down the name of the “designer” who was coming by the next day and we said our goodbyes.

    Reply Retweet Favorite

    HydeNS33k

    Jek Hyde

    Mary could have saved her company a lot of heartache by simply verifying that I was who I claimed to be.

    Reply Retweet Favorite

    HydeNS33k

    Jek Hyde

    I showed up the next day as “Claire” with a fictional architecture firm that I had made business cards & a website for pic.twitter.com/gMxU56xK70

    Reply Retweet Favorite

    HydeNS33k

    Jek Hyde

    My alter-ego Barb had done most of the leg work for me. When I arrived, Mary and her boss were waiting for me with smiles

    Reply Retweet Favorite

    HydeNS33k

    Jek Hyde

    I gained rapport with the staff there by asking them to tell me what they wanted in an office space.

    Reply Retweet Favorite

    HydeNS33k

    Jek Hyde

    I might have claimed to be on the team that put together the Google offices… (this is my inner demon child) pic.twitter.com/w7KgmR2yih

    Reply Retweet Favorite

    HydeNS33k

    Jek Hyde

    “You want a standing desk? New chairs over here?! Ergonomic keyboards for everyone! Let’s look at swatches!” pic.twitter.com/81uddKoT2g

    Reply Retweet Favorite

    HydeNS33k

    Jek Hyde

    We became best buds. I was given complete and unaccompanied access to the facility where I stayed for several hours.

    Reply Retweet Favorite

    HydeNS33k

    Jek Hyde

    I gained network access and stole several thousands of dollars in physical primitives by picking my way through cheap locks pic.twitter.com/rrLOOdmJL9

    Reply Retweet Favorite

    HydeNS33k

    Jek Hyde

    This client had been pretty confident that I wouldn’t get into either facility, much less be able to hit both in a short time span

    Reply Retweet Favorite

    HydeNS33k

    Jek Hyde

    So the timeline was left to my discretion, but it was assumed that I would need to fly to the area twice

    Reply Retweet Favorite

    HydeNS33k

    Jek Hyde

    I didn’t see the need in burdening them with two round-trip expenses.

    Reply Retweet Favorite

    HydeNS33k

    Jek Hyde

    I went back to Mary’s office & said, “Well I think I have what I need from here. How do I get to the office center?”

    Reply Retweet Favorite

    HydeNS33k

    Jek Hyde

    She looked at her watch & said, “It’s almost lunch time. I’ll take you there!” A whole group of us piled into the parking lot pic.twitter.com/dG8CmmRGn7

    Reply Retweet Favorite

    HydeNS33k

    Jek Hyde

    And they took me to a nearby taco shop. That’s right. My Marks took me to get tacos… I love my job pic.twitter.com/tPbeky3s8p

    Reply Retweet Favorite

    HydeNS33k

    Jek Hyde

    After lunch they drove me to the offices and a few of them came in with me to show me around.

    Reply Retweet Favorite

    HydeNS33k

    Jek Hyde

    I took FOREVER looking around this office space, and eventually they said their goodbyes because they had to go back to work pic.twitter.com/R8pa4hfgqs

    Reply Retweet Favorite

    HydeNS33k

    Jek Hyde

    They had a strict policy of escorting visitors. But I had been seen walking around with trusted insiders so no one questioned me pic.twitter.com/ibExCk2TkI

    Reply Retweet Favorite

    HydeNS33k

    Jek Hyde

    I was free to take my time. I made myself at home. My main objective at this site was to weasel my way into private corner offices pic.twitter.com/u3VMYj75pO

    Reply Retweet Favorite

    HydeNS33k

    Jek Hyde

    When I accomplished my goals, I tracked down my POC’s office. This is the best part of every job...

    Reply Retweet Favorite

    HydeNS33k

    Jek Hyde

    Steve was there, hard at work when I disturbed his groove by knocking on the door. He glanced up, “Hi there, can I help you?”

    Reply Retweet Favorite

    HydeNS33k

    Jek Hyde

    I smiled. “Hi Steve! I’m Sophie from Sincerely Security. It’s nice to meet you in-person!”

    Reply Retweet Favorite

    HydeNS33k

    Jek Hyde

    I will never forget the look on his face… Pure gold. “Who?.... Wait, what? How? How did you get in here?!” pic.twitter.com/ZylXSaXmRI

    Reply Retweet Favorite

    HydeNS33k

    Jek Hyde

    We stayed in his office and talked for a long time. I went over exactly the steps that could have prevented my success. pic.twitter.com/YwxhBsaGP2

    Reply Retweet Favorite

    HydeNS33k

    Jek Hyde

    First of all, the desire to help others is human and natural. We don’t want to discourage that. pic.twitter.com/M1ePhgncmE

    Reply Retweet Favorite

    HydeNS33k

    Jek Hyde

    Secondly, if it seems too good to be true, it probably is.

    Reply Retweet Favorite

    HydeNS33k

    Jek Hyde

    Is your corp going to hire the team who designed Google’s offices? Magic 8 ball says no. pic.twitter.com/Zs7Ism2gEM

    Reply Retweet Favorite

    HydeNS33k

    Jek Hyde

    The team who took me to the second location should have found someone else to escort me through the building.

    Reply Retweet Favorite

    HydeNS33k

    Jek Hyde

    What do you think? How do you think your company could protect against an attack like this? I want to hear your thoughts. pic.twitter.com/kq8FFyVZ5E

    Reply Retweet Favorite

    HydeNS33k

    Jek Hyde