The Real Threat is Human: The Secrets of On-Prem Pen Testing

As organizations continue to invest in AI driven defenses and advanced detection, one critical reality remains. Attackers are still finding success by exploiting human behavior inside physical environments. From badge cloning to tailgating and in person social engineering, physical security is becoming an overlooked entry point in otherwise mature security programs. As external defenses strengthen, the path of least resistance is shifting and many organizations are not prepared for it. So where does physical security fit in a modern threat landscape shaped by AI? In this expert led discussion, Tevora’s Threat Services team, Jonathan Nyman and Andrew Peng, share real world insights from on premise penetration testing, moderated by Kevin Dick, Sr. Director of Threat Services. The session explores how attackers are gaining access, where organizations are falling short, and how AI is influencing both offensive and defensive strategies.

Key Takeaways:

• Why human behavior remains the most exploitable attack vector
• How physical environments are becoming a blind spot in modern security programs
• What a real world on premise penetration test looks like in practice
• How attackers use tactics like tailgating, badge cloning, and social engineering
• Where AI is strengthening detection and where it is enabling new attack techniques
• Practical ways to improve physical security and reduce risk

Whether you are evaluating your current security posture or looking to strengthen your overall program, this session provides a closer look at a threat vector that is often underestimated but highly effective.

Thank you everyone for joining the webinar. We’re excited to talk to you guys and really dive into a topic that’s been kind of interesting and been on the uptick, but a little bit orthogonal to the age of AI and other webinars that you usually been hearing from, and that is physical pen testing. In the past few years, we’ve actually really ramped up our physical pen testing services, doing a lot more of them, and really taking advantage of that vector in the wake of really returned office changes from Covid, which are still kind of with us today, and here to talk about this with us, I’ll be moderating today. I’m the director of our threat services over at Tevora, and we’ve got a few of our senior consultants on the line, including Jonathan Nyman and Andrew Pang who I’ll hand over to Jonathan to give an intro of himself before we dive in.

My name is Jonathan Nyman, as Kevin mentioned, I’m a consultant here at Tevora. Been here about six years now, I’ve been really trying to spearhead this physical services that we do, and try to relay the importance of it. Excited to dive into this conversation, and I’ll pass it off to Andrew.

Thanks, Jonathan. Hey everyone. This is Andrew Peng. I’ve also been with Tevora for a while now, about seven years. I believe physical pen testing should be important for customers and clients to take a look at. I myself, had some experience doing them as well, and they’re a ton of fun from my side. I think there’s a lot of learning experiences both from the offensive side and the defensive side. 

Well, excited to hear your thoughts, and maybe share some of your experiences over the past few years of really ramping up and doing a lot more physicals. I did want to start it off with the basics of what is a physical pen test is? What are the guardrails? What are you typically doing?

Physical penetration tests is at its core, trying to break in, breaking and entering into a secured location, typically that looks like office spaces, but we also do some more infrastructure stuff, or maybe retail locations, but the ultimate goal is to do it undetected. To avoid getting caught, avoid pulling our get uut of jail free card. The whole point is covert entry, and from there, depending on what the goals are, what the concerns are, what we’re trying to do is establish initial access on the internal network, and trying to use that as the physical side of things, as a different vector for getting that initial kind of internal access. We also will look at specialized concerns. If there’s a concern about data theft or physical hardware theft, or just safety concerns. Can someone get in and become a threat? But again, it really depends on what the actual concerns are, what the industry is, and how we tailor that experience. We’re really trying to simulate things that are going off in the real world, things like corporate espionage, crimeware gangs. How usually ransomware gangs work is they’re buying the initial access. You have people out there just selling the initial access, getting that in various ways. We do see that sometimes from the physical side and then also nation state actors, there’s not really a line they’re not willing to cross. We’ve seen this in real life, of what looks like setting up base camps in front of their targets, valuable targets. At its core, we’re doing it like everything else. We’re emulating real threats that we’re seeing and using it as a different vector to get that initial access into a corporation or company.

It sounds like it’s definitely a viable vector. Is there, has that been what’s causing lead increase in physical pen desk? Is just the viability of that? Or are there other factors you’re seeing for kind of the uptick, and really, this being effective, and there being a lot more of them.

I’d say a big part, they’ve definitely slowed down to us when everyone was at home during covid. Even though we’re just coming six years out of all that, we’re finally starting to see, everyone’s coming back to the office, which has its own challenges. You have a generation that never spent time in the office. That kind of culture isn’t established, which has kind of led to challenges or risks that we haven’t seen in the past. Just employees not knowing how to handle this, not being confrontational when they see something suspicious. Then also too, I think as the external layers get more secure, phishing is very difficult. Of course, that’s something we do too, and something that we emulate and try to do, but it’s getting the protections against that are getting very advanced. When you’re talking about AI, starting to screen these emails, not just kind of more other automated systems, when you’re actually trying, when you’re actually improving these systems, it’s getting harder to get access internally. You can’t necessarily just send a Word document with a macro anymore and get that call back and get that initial access that way, as well as just external perimeters being more secure. Companies are spending millions of dollars focusing on these two areas. It’s becoming very difficult, and now it kind of feeling like the path of least resistance is that physical component, that physical break in and in testing out those controls. Because you’re still targeting that human element that fishing will target or, you’re targeting the simplest thing to target, or the weakest link. That’s going after the employees. It’s the same thing with phishing when it comes to things like tailgating, when it comes to things like in person, social engineering, it boils down to people not wanting to be confrontational, wanting to be helpful, and just not wanting to disrupt someone even if they don’t recognize them, even if they don’t know who they are, what they’re doing. Also, in the worst-case scenario too, it doesn’t just lead to internal network access. It’s not uncommon for us to end up in data centers, and what can we do there? Or server rooms, data centers, stealing servers. If there’s something valuable on there, we can take it and deal with it later. Or a threat actor can take it and deal with it later. I think part of it is the detections on the external side of things strengthen and become more difficult to get through. It’s becoming a path of least resistance, and it’s something that I don’t think you can ignore, and depending on how seriously you take, it depends on what your actual risk are, what your actual concerns are. I still think it’s something that should least be looked at and tested if you’re spending all this time and resources securing those external perimeters. Can someone just walk in through the front door unnoticed, plug in a Raspberry Pi, walk out and have like a foothold in the network? How much resources people want to spend securing their physicals will vary, but at the very least, it shouldn’t be very easy, where in a day, we can just walk in, do whatever we want and leave. I think there’s the concern is coming from kind of realizing that gap as people are coming back in the office.

It’s interesting timing too, because, I think as we all know, some of the AI tooling has been really enabling and getting up to a level of maturity in the past few years where, I think we’re going to be in a world of hurt from traditional vulnerabilities. We’re just the pace of vulnerability reports. And even that issue of a lot of quote, unquote, AI slop reports clogging up the system is almost moved beyond that into just, we have tons of real reports, and the physical being such a different focus and different area. I’m curious how that plays into things, both from the perspective of, do you think people are going to be just so hung up with trying to deal with a lot of this wave of vulnerability reports and patching that it seems like we’re going to have in the age of agents that physical a distraction or a blind spot. I’m quite curious on, we’ve been having huge enablement in social engineering, template development, in spoofing, access and all these things. Some of this tooling, something you’re seeing in use on physicals, and maybe falling short. It’s April Fool’s, so it’d be great to give a presentation on how we’re sending robots into the building to break in. I don’t know if we’re there yet, but we could do a whole webinar. We probably should on some enablement, the things we’re doing in AI around more traditional vulnerabilities. I’m really curious to hear what your thoughts are and how that’s affecting the physicals currently, or even some ideas of how we might use that, or the context of the industry going forward, where physical slot in in that world?

Speaking from the physical standpoint, as you mentioned, there’s a lot of AI usage on, the network level. When we do network penetration tests, you mentioned AI slop. There’s a lot more AI tooling built around those network type of tests. From a physical standpoint ourselves, we haven’t really tooled around with it too much, but it is something that comes to mind. There are a couple ideas, both from the penetration standpoint, the offensive side and the defensive standpoint, where we believe AI might be beneficial. Starting out from the defensive standpoint, AI is being really good, obviously, ideally, the defensive team can implement some type of facial recognition with AI. Maybe back then you’d run into a lot of false positives, and you’d have defensive team looking at all these alerts and being like, that’s a legitimate employee. Are we getting delivered on this? Over the past few years, it’s grown a lot, immensely, and I believe the accuracy of that might increase and really allow for less false positive alerts and very sporadic alerts, and be like, we should actually investigate this and take a look at it. I think that’s some case where the defensive side might be able to implement AI to a good degree and be able to benefit from that. And from the offensive side, I think there’s a pretty good idea of when you are creating a fake badge, for example, and you’re contemplating whether or not you want to use your own name, a fake name, or identify an employee name by doing open-source intelligence gathering and identifying someone on LinkedIn who looks vaguely similar to you. I think there’s a pretty cool attack vector with AI where you can generate a morphed image of the legitimate employee and yourself, so that you don’t really need to identify someone who looks like the most accurate to yourself, you have a couple of options. You have a bunch of ranges, a bunch of names you can use when you print that fake badge, obviously using a real employee name, if you get escalated and you need to actually interact with an employee, that might get you further. If you’re using an AI generated picture, as compared to if you pull something from LinkedIn, and if your security team is very verbose and the procedure and be like, oh no, this employee has like a mole on your on their face here, but you don’t have that. Those could be tells that will get you burned. I believe, from the offensive side, that would be a really great use of AI to be able to kind of subvert that. That poses a challenge as well from the security or the defensive security standpoint. How can we tell that this image is AI generated, how can we really verify the validity of this person? Those are the key points that come to mind. I think there’s going to be still a lot more things that you can do with AI. But again, I just wanted to reiterate that, it’s been growing. It’s been really good from the network perspective, and we want to implement that into physicals. I think there’s still a lot more to grow here. 

I think the point on the like having kind of AI monitor cameras, I’m not aware of a solution that really does this, but I think in the future, it makes total sense. I mean, because a lot of the companies that we’re working for and doing physicals with, it would be great. If they could have four security guards monitoring all the cameras at once, right? Not just checking the feeds when an incident happens, but actually always watching. It would be very clear very soon that we’re just loitering around trying to look for every entry point being generally very suspicious. That’s not something we can recommend to most people, it doesn’t make sense. We’re not going to just say, you need to do this, if it doesn’t make sense for the industry. Being able to not even offload that, but actually have that ability, that capability, to have those detections without having a team of security guards watching monitoring cameras, because that’s just not the reality for most organizations. It doesn’t make sense. So adding that functionality, or that ability to do things like that that would make our lives or someone trying to physically get in would be huge, if that could be not just limited to massive organizations with full on security teams, but give that ability to companies that couldn’t do it previously. I mean, like all the conversations about AI, no one’s fully sure where this is going. No one’s fully is aware of its capabilities. And we’re kind of all just adapting as things go. It is interesting about physicals for now, there’s no risk of it going away, as people are in the office, even if AI is monitoring your external even if AI is conducting your pen test, right physical, at least for now, is here to stay. I’s definitely an interesting vector.

You’re saying it’s job security. The robots take over, and there’s embodiments. I know you mentioned some of the tooling you guys have been doing, even outside of AI enabled things have been pretty cool. Jonathan, you were talking about, you can buy those robot dogs from Teemu, and those are actually potentially somewhat useful in reconnaissance. I don’t know if that’s something you seriously considered, but I’d also love to hear about some of the things that you guys do use in your toolkit, like some of the badge readers I know Jonathan you talked or Andrew you mentioned about printing out fake badges. Even if those don’t actually scan, curious to see, what tooling you guys have in your toolkit and what tends to be successful?

I think the our most useful tool in our toolkit is not anything crazy, not anything like hackery, not anything like robbery. It’s very simple, and it really exploits the human element that we’re focusing on here. It’s just a badge printer. A $500 badgy that lets you clone ID badges. It doesn’t obviously do the badge authorization, like the reading, but the RFID cards, things like that. It all is a simple clone. We go online, we look for any kind of reference point, any kind of images posted by employees, posted by the company, of ID badges. If we find one, and if they’re in use, it really gives us a free pass. It doesn’t have to be perfect. It’s not like we need a high definition copy of the badge, but just passing the glance test is enough to get to build trust with someone, even just doing, even seeing you do something suspicious. It opens a lot of doors for tailgating. We run in that tool. We run into that a lot. Andrew can even speak a little bit to this about kind of the effect that it has when tailgating and when just wandering around the office. Andrew, if you want to kind of speak to your experience with that.

The fake badge with a badge printer. It doesn’t necessarily need to be perfect. All it needs to really do is pass that initial eye test. Having a lanyard with the company name printed on it in their company colors is already a really good thing, because you can kind of tuck that into your blazer or keep the actual badge kind of hidden, so no one’s really going to zero on it. On that topic of the conversation, regular employees aren’t going to be really excruciating looking at everybody’s badges and being like, oh, no, that’s a fake one. I’m going to call that out. No, you’re generally just going to see that badge and be like, that looks like our employee badge. There’s no need to escalate it. All you really need to do, pass that initial eye test, the worst case is, you get confronted. You actually have to interact with someone, then the accuracy of your badge could be a little bit under scrutiny. But for tailgating purposes, you just need to look like you belong there. Just having a fake badge that looks like it is real is already kind of good enough for that first step, for tailgating, and let’s even ourselves establish a little bit more confidence to be like we have a badge, we’re not going to get questioned. On the topic of badges, pretty interesting. We’re seeing two types of badges in play. We’re seeing low frequency badges and high frequency badges, and without going too much into the weeds on those, just know that low frequency badges are inherently going to be more insecure and companies should be going doing it with those as much as you can. Essentially a low frequency badge, first of all, it emits long wavelengths, and that allows people to capture those from a further distance, so you don’t need to get as close to the employee to get a read on their badge. And second of all, a lot of that communication with low frequency badge readers is unencrypted. There’s no encryption. There’s no kind of secret key required. All it does is broadcast. This is my essentially two different kinds of things to verify that your badge is legit, and it just broadcasts those to the reader. And then what that allows an attacker to do is, get close enough, basically emit, like a fake read signal, pick up that response from the badge and be able to, replay, not cryptographically, because it’s not encrypted, obviously. You just take those that data that you got, and you can be able to hold it up to the badge reader. You can get in that way. On the flip side, with high frequency badge readers, I talked about wavelengths, little high frequency, the wavelengths are a lot shorter, and therefore the range is a lot shorter, so you really need to get really close to the employee, which is kind of already very suspicious if you’re trying to do that to employ the game and be like, why are you getting so close to me? We run into experiences where we’re trying to get really close to them, and they will back up. They’ll move to the side. They’ll intentionally try to avoid you, which makes it a lot more difficult. And then to add that cryptographic element to it.

These cards are these cards are just inherently more secure. Even if you are able to get close enough to get a read on them, you don’t have the actual secret. You can’t derive the encrypted communication. Even if you do get a read, you can’t replay it. Now that’s not to say high frequency is inherently secure completely. There are still misconfigurations you can apply to the reader. You could configure it in a way where it just reads the card number instead of going through those encrypted communications. Now that’s a lot more rare, but that’s still something to keep in mind as well. Also on the topic of badges, I think badge placement is extremely important. The most secure design of how to use your badges is obviously, use a lanyard and have it cross your chest. This is because it’s a lot more difficult for an attacker to get up close to there and get a read. We see a lot of times, badges are put on their hip with an extended lanyard thing, where you can you loop it on your belt or something, and then you just pull it and access the reader that way. That’s going to be less secure, because it’s along the hip line. Someone walking by, it doesn’t really need to make any suspicious movements to get a read on that. I also think architectural design of office spaces is important too. Everyone likes a nice office you have, it’s 2026, it’s a lot of clear looking office spaces to make the office space look good for their employees, make them feel like they want to go into the office. There’s kind of a flaw here, where any outsider can kind of look into the office and see where they put their badges. The most secure way is you tuck your badge away in your bag, in your pocket, before you even leave the premises, so an attacker doesn’t know exactly where to look for and they kind of have to do a guess if you put in your left pocket, but they walk by the person’s right pocket. Well, you’re not going to get a read that way. That’s already inherently the most secure design. But if you have a clear office space where anyone can kind of see into the lobby, well, they can already see where you’re putting that badge. That removes that element of guessing and allows an attacker to be like, I know where it is. I know exactly where to target. The safest practice is just tuck it away. If you’re not in a clear office space, even better, because when an employee’s walking out, their badge isn’t visible at all. I think those are some pretty interesting tidbits with badges. I also have a gadget with me here. This is a flipper. It’s really nice. It’s kind of pocket sized. You could put it in your pocket. What’s really nice about this is you can mirror that with your phone. We’ve also run into situations where a company is using a low privilege or a low frequency badge reader, and you can actually privilege escalate with the flipper, and there’s a couple ways to kind of obfuscate it, instead of holding it up to the reader and looking very suspicious while you’re trying to brute force those plain text values that I mentioned previously. Some ideas you can do are put it in your back pocket and just lean against the reader and take a look at the flipper on your phone. Once you get a valid code, you can pause it on that on your phone, and you know exactly what combination is needed to access the database or the data server for the server rooms, as Jonathan mentioned, another option, maybe put it in your backpack, lean forward, or lean back against the badge reader. Those can pass the eye test of like, this guy’s not doing anything suspicious. He’s probably taking a call outside the server room or something like that. The flippers are really nice tool as well that we have in our toolkit that we bring along on physicals, that can kind of play around with badged access, and allow us to do attack vectors, aside from just tailgating,

I know I’ve seen you guys with the flipper, which is quite handy. I remember quite nice compared to, 10 years ago with SSHing into an Android phone or something, had someone a laptop, or even the Proxmark, or Proximus Proxmark. I’ve also seen that kind of backpack sized reader looks like you guys ripped off a parking garage or something. I assume it gives you a larger, longer range. Is that something that’s kind of built for certain situations where the flipper might be more apt for another?

Yeah, for sure. We recently put together both a high frequency reader and a low frequency one version of it, exactly like you said, it’s a garage. Its intended use is to be mounted for a parking garage or something, basically just extending the range a little bit so that people can kind of swipe their badge from the car right now we made it so it’s standalone. It has like a battery pack inside and then a little reader that lets us connect our phone to it and see any credentials that we caught. That’s usually how we start engagements, depending on what we see in use. Typically, we’ll assess visually, what does it look like the badges they’re using? There’s generic ones that can be high or low frequency, but we always want to start by getting those clones right from outside the premise. A lot of times we’ll spend the first part of the engagement doing reconnaissance outside, but also trying to find people to bump into or swipe by. That range, long range in RFID world, is like a foot is really good, which, it sounds like FAR first cloning badges, but when you actually have to get that close to someone, it feels a lot closer. So that’s typically how we start engagements, because if we can get that right off the bat, we have our fake employee badge, and then we’re able to get a read on those cards and create our own either using the flipper or using the Proxmark, like you said, then that’s. From there we have a legitimate badge access. Regardless of how many physical barriers there are or physical controls to enter, whether it be like a lot of times, what we’re seeing for secure places is an anti-tail gaining barrier, then elevate the elevator requires badge access and then one more step to actually get into the office spaces. If we don’t have a valid badge, that’s three counts of tailgating in a row, which can be difficult depending on the employee awareness of that. You have to bet three times. Also, it doesn’t give persistent access. We can’t just come back later. We have to do the tailgating all over again without that. But if we have the badge, and we’re using those tools to clone them, and we finally get a hit from just one person. Now we can make as many copies as we want. We can give it to all the testers on the engagement, and we can freely exit and enter the building and not have to worry about maintaining access. Or a lot of times, we’ll come after hours too. We’ll come back now that we have a valid read. Let’s go bit in after hours, and now we can actually start checking, looking through people’s desks, making sure clean desk policy is being followed. There are no passwords on sticky notes right under the keyboard, no sensitive documents laying around things of that nature, which can be difficult, as Andrew mentioned, with kind of the more open space design these days, it causes some problems. You can’t just rifle through desks, because everyone can see you. That a lot where I’m walking through an office and the whole office can see me as I’m walking through. It helps to have that kind of persistent access. As Andrew mentioned, it can also be used to escalate your batch privileges and get full access right to even the more secured areas. It’s definitely something we like to push and make sure, do that full badge system assessment. As Andrew mentioned, using high frequency cards doesn’t mean that you’re good to go. There’s still some misconfiguration some default misconfigurations. And if that’s never been actually looked at, it’s really important to at least assess it from some to some degree. It’s not something you have to keep doing, right if it’s fine, but it’s definitely if it’s never been checked out or no one knows what the actual situation is, then it’s definitely worth it. I’ve been harping on the law, the issues with low frequency badges for a while. I’m really trying to push it. I usually know right away when we’re going to be running into them. It’s usually when it’s a big building with multiple tenants. For whatever reason, they default to low frequency. I think it’s just because it’s easier to manage. But they’re really bad. They’re really easy to clone that range and they’re really easy to manipulate, recreate all that stuff. Like I said, once you have that, once you have an employee badge, you’re walking around freely. People are seeing you swipe in immediately. No one cares what you’re doing. They see you have an employee badge. You badge in, like, what? Why would anyone want you at that point. That’s a huge that’s a huge win, if we can get that. It’s definitely where we put a lot of emphasis, and then move on to other tactics, like tailgating or looking for physical access, physical bypasses, whether that be doors installed incorrectly, using some of the random tools there to get access. I’d say the two biggest tools are not super complicated. It’s our badge cloner and then that badge printer, just because, that’s really all you need in a lot of cases, whether you’re exploiting, tailgating and exploiting the trust of other people or the employees, or you’re just getting full access without having to do too much work. The flippers are super nice. They make things really easy on site, which is really nice, but they are a little burned. I know they went viral on TikTok, and that made things people know what it is when they look at it now, or a lot of people do. Then they got banned in Canada, which also raises some flags. It’s unfortunate, it’s a little burned. You can’t have it as freely. It doesn’t look as much that you’re playing with a Tamagotchi as it used to. It’s pretty distinct visually, but it makes things really quick, where we can go from no access right to cloning a badge, checking that badge information on my phone, configure or setting up a new card from the flipper, so not doing this whole track chain without ever having to pull out like a computer or a laptop or a Proxmark. It really simplifies things, which is really nice for fast paced kind of physicals, where it’s very dynamic and things are changing very quickly.

You guys talked a lot about badges. Definitely good understanding of the importance there. Anything people can do to defend against that. I’ve heard we’ve stolen badges people now putting out alerts and seeing people badging in with that stolen badge and responding. But imagine if a clone badges would be a lot more difficult. I don’t know if you’ve ever seen any kind of defenses where they’re like, someone just swiped in on this side of the building and then a millisecond later, somewhere else, and that’s impossible. Or have you seen any resistance to that, or any kind of detections or defenses against it, other than just rip and replacing just rip and replacing the whole badge system?

I have actually, and it’s more for the for people that are taking it very seriously, physical security. That doesn’t necessarily make sense for everyone, but for people that had specific concerns. Yes, I have definitely seen that. There’s a couple ways to do that. There is, there is a kind of detection of, they badged in and they batched again on the other side. I don’t think it’s as common. But a big one is, if you only have one entry point. You have the receptionist, sometimes what we see is, when someone’s badged in, it’s linked to their picture, right? If I stole a random person’s card and cloned it that looks nothing like me, and I try to use it, and that reception is just quickly, like they hear the beep, they look at their computer, and they see someone that doesn’t look anything like me. That’s a really effective. section or way to kind of prevent this, even if you are using low frequency cards right now. Again, this doesn’t necessarily prevent after hours things or stuff like that, but if they are locked down after hours, like standard employees can’t use their badge if the receptionist is gone, then that’s a really effective method. You can kind of still start social engineering there. It still isn’t game over for us. You can get creative with how you want to deal with that, but it’s a really simple and effective just tying those card IDs with an employee picture and addressing it that way, without, you’re still not addressing necessarily the core issues, but it’s better than nothing. There are a lot of interesting ways to deal with. I would push for secure badge system set up, but I know, again, it’s not even necessarily possible for everyone, and so you might have to get creative when it comes to actually securing that physical access. Then also pins too can be helpful. That’s pretty simple one as well but can be ignoring you start to get into that area of making your employees lives too difficult by making them do a pin every time they try to get into act or try to access somewhere. Swiping a card, putting in a P A pin key, can also be kind of like an effective way to mitigate some of the risks.

I know the badges are our main tool in the toolkit, and it’s given you a lot of ways to get into buildings, both with cloning and the exploiting the human side of having a printed out badge that looks like you. But I’m curious take a step back again. How does this compare to the other vectors available to an attacker? For example, on the red teams, we do is physical tend to be one of the softer targets, or do you find that you can get in through email or phone fishing or other methods just as easily? How does that compare? And where does that fit in, in kind of the threat model for organizations?

I’d say it’s definitely the softer target, just from my own experience of doing both of those types of engagements, it really depends on what the actual vectors available are, and what the posture is and the maturity. I’d say least resistance is still physical. Maybe you have network access control, and no one can’t. You can’t just plug into any random port and get like a foreign device calling home. We’ve developed kind of tools to bypass that, and that’s not really hard to do. Whereas, the reality is, phishing has been the kind of go to for threat actors for a really long time. It’s still going on. There’s no doubt about that. Because it’s such a huge risk and such a viable attack path, there’s so much money and resources being dumped into solving this problem, it’s drastically changed, even from five years ago. What you actually have to do to not just like get execution, not just get credentials, but to actually get your email, even in an inbox, has become increasingly difficult, and also you’re this, the phishing stuff can fall apart immediately from like 100 different ways, whether that’s just google chrome realizing that this threat the site is malicious and just blocking it outright, whether it’s the domain registration that doesn’t like what you’re doing, there’s a lot of way that the social, the phishing engagements can go wrong and kind of burn things to the ground and you have to start over. I think from the physical side, there are a lot of vectors, not even just getting in the wireless, the Wi Fi side of things. Can someone sit in your parking lot and get internal access that way? And just either plant device or just sit there. I have seen and heard of ransomwares being kicked off that way. Literally pulled up in a parking lot, got cracked Wi Fi, whatever they did to get that on the actual wireless network and then launched a ransomware from the parking lot. The way they conducted it is they actually got that initial access months ago. It was like kind of impossible to figure out when or who did that, because it’s very different. There’s no when it comes to that physical side of things, there’s no, here’s the IP where the attacks are coming from. The attacks are coming from an internal IP, or they started, at least, from an internal IP of a device we didn’t, weren’t paying attention to, or didn’t notice. It definitely adds to this unique layer. I do think for mature organizations that have really dumped a lot of resources into securing their external perimeter, training their employees on social engineering and phishing attacks, and doing regular tests and kind of building that protection. It’s becoming increasingly difficult on our side of things to actually get through. When we do engagements where we’re doing all of that, including the physicals are usually a pretty quick win, which because it’s just largely been ignored or not been paying attention to. Maybe we have a security guard at the front, but it doesn’t really go much further than that. So really, again, you don’t have to dump as much resource into securing as into securing physical as your external layers and your inbox, your employee inboxes and stuff like that. At the very least, not making it super easy would go a long way. I think, for mitigating risk makes sense. And something you touched on that was kind of interesting was the whole delay factor, because, as you were talking about this in general, but also just that specific example of someone fly find the parking lot. My first thought was, another kind of surveillance footage that guy, right? That’s going to be great for law enforcement to go after and what a risk to them to go on site and do this versus if you’re living remotely and obviously, just logistically more feasible here in Russia, for example, or somewhere, not to call it a single country. If you’re outside of the US, obviously becomes a lot more difficult. You have to liaison with a contact over here, or obviously be physically present. It sounds like that may balance out depending on what your goals are. There are ways around the risk with the post hoc surveillance and review, if you just wait for that time for the tapes to roll over. Is that something you’re kind of commonly saying, I know, for us, obviously, we don’t have that risk of after the engagement, they’re not coming down to arrest us as a kind of a similar engagement for a real attacker, I’m sure that probably can put a damper on this being as viable of an attack vector. I’m curious to see, is that the main SOP of you just wait until the surveillance is kind of rolled over.

Usually what a lot of these ransomware gangs at the very least, or even threat Act, or nation state actors are doing is buying that initial access, whether that be bribing a current employee, or having an insider threat. It is also a way to test that vector right of someone, they got $100,000 wired to them to drop this weird device in a specific spot. Or just having an insider threat connecting starting at the internal network. I think in or just selling that initial access, however they got it, and that whole process of established initial access. It makes sense to be, I’m going to wait a month now. I’m going to try to sell it to someone, see if someone’s interested. Then the people who bought the access then wait. There could be that huge delay of when you act, when actually activity starts happening. One of the devices that we use, the dropbox that we have, actually does callbacks, not through the internal network. It will establish that connection internally or sit in between two legitimate devices and then being called home over LTE., it’s just doing an SSH callback over a cellular network. That way, that actual outbound traffic is not detected. It’s there’s nothing you can do about it. You don’t know a rogue device is calling back to a weird, random IP. It’s just sitting there and calling back, so you don’t actually see those external connections. So even if you’re like, well, there’s no outbound or we would detect weird SSH traversing back to a random external IP, we would catch that. We have detections in place for that. There are ways around that, and that can sit for a long time behind a desk without anyone noticing if you don’t have those defenses against rogue devices sitting on your network, or getting those alerts about when an unrecognized device is plugged in. Even the thing that we’re using is like, sitting in between an actual authenticated device and a legitimate device, and piggybacking off that connection and spoofing that it’s used that device. So even though it becomes very difficult to detect when you’re talking about tucking it behind, hiding it away, behind a desk or something that’s not really accessible without moving the desk, it can become pretty difficult to pick up, and can sit there for a really long time.

Going back to the parking lot scenario, I think attackers can get really creative with it. You can scope out blind spots. If it’s a parking structure, I’m sure there’s going to be some blind spots. You can drive multiple cars. You have a lot of tools at your disposal to not really be caught. What’s stopping you from just dropping a device that could be powered on a low power source for weeks to a month, with a public internet connection. And then, that attacker just waits a week to a month, and then SSH is in, or rvps into that box that they dropped, and then trying to hit the Wi Fi from there at that point, it’s like, how can we even track when this thing was dropped? How could it be up. It’s been a month. Maybe the security tapes aren’t even there anymore. And then again, with the blind spots, you might not even catch that. If they’re driving, as I mentioned, multiple cars. How are you detecting that’s going to be suspicious activity? So those are also some things to keep in mind as well, on the physical side,

There’s some Q&A’s in the chat, and I think starting with one that’s kind of relevant to this discussion, on defense, how do you see people defending against kind of threats in between the physical pen test assessment?

Obviously, you have this point in time of what we’re able to do, a good snapshot of what the network look like, what the premises look like, and what the badge system looks like. All these things are their things people can be doing internally, either outside of these kind of full blown physical pen tests, or even as an interim kind of exercise to both gage security and also kind of tests on their defenses. Are you seeing anything that people are successful with that’s really helping mitigate some of these risks?

I think tailgating awareness, similar to like phish testing your employees on phishing and just educating employees on tailgating, which it usually comes in with those standard trainings. It’s mentioned, one of the things that we do, outside of just a full blown physical, is just tailgating exercises. That’s going to be similar to phishing engagements, where you’re not actually trying to get any kind of initial access or the goal really, you’re not trying to get credentials to go further with it. It’s just an engagement to test user awareness. We’ll do those two where our only goal is to tailgate. We’ll sit outside the main entrance and just tailgate, get in, go back down, or go back to the front, do it again. Then we’re just testing that. I think a really big part of doing engagements like that, similar to fishing engagements, is it’s not just like a random thing that they have to read or learn about once a year. If your employees know you’re actively testing for these kind of things, they’re going to, even if they just think it’s a test, they’re going to be a lot more aware and more a lot more careful. We see this a lot with phishing or in phishing engagements or even our phone phishing engagements. Where, if we do it a lot, like we do it quarterly, or we do it annually, and target the same people, we end up getting on the phone. They’re like, is this a phishing engagement? So even the fact that they know that the company is doing, that they’re aware of it can help a lot with that mitigation. Then a big one too, is scrubbing, going through social media posts and scrubbing any kind of either badge information or pictures of badges or just general, something that attacker could use on the physical side, just making sure that sanitized. That’s really important. You’re not going to stop random employees from being, I got a new job today, I’m posting a picture of their employee badge, or I’m leaving. We see that a lot seven years done at x company and they take a picture of their badge. You’re not going to fully clean that up, but the very least, making sure that the marketing team isn’t posting pictures of your employee badges is definitely also a place to start.

It makes sense. We have another question here, talking about what entry points to test first. How you triage that, I know you mentioned a lot of that is clone the badge. Get the badge printed out. Are there any other overlooked things, or things that are maybe a little bit less looked at, that you encounter regularly, that people aren’t really keeping top of mind, that you exploit? Just curious if any of those are common to answer that question.

It’s really depends on what we’re seeing when we’re doing these engagements, how many points of entry there are. That’s the first thing we’ll do, is assess, what are our actual points of entries? There’s obviously always going to be the main entrance, but then there’s stuff like deliver, delivery entrances, or just different various like side entrances, or sometimes it will just be elevator access versus stair access, if it’s on a different floor, things like that. I think one of the more interesting ways. Usually, we’ll start with the main entrance. Unless there’s something stopping us from doing that, we’ll look for Prop doors on the side of the building, something of that nature. Testing the stairs is a really big one too, because sometimes the whole front entrance is really locked down, all these like security controls there, and then you can just go through this stairwell and pop the door open. It’s also a really interesting place to do tailgating, because you can pretend like you’re on the phone and then pop in when someone does leave through the stairs. I also say another interesting vector from that kind of thing is the elevator access. A lot of times we run into issues where or run into access where the initial access, or actual, you’re making progress is getting into that, getting into or the elevator. The elevator is the end goal. A lot of times when that’s the case, you have to badge to actually get to your floor or get to where you’re going. Really simple, not smart or anything, really simple technique for that is sitting in the elevator and waiting for it to get called up. There’s only so much you can do about that. You usually have to have another layer in front of that, but we do that a lot where we’re waiting in the elevator, there’s a risk of someone like being like, what are you doing waiting in the elevator if they’re paying attention. Or I’ve also had times where people come into the elevator and I’ve just been in there for 10 minutes, and then they badge, and then I can press the button that I want to go to the floor, I want to go to after they swipe their badge. That can be a little awkward, but usually it’s not challenged, it’s a really interesting vector, just waiting in the elevator and waiting for someone on the floor that you’re looking to access calls it up, because the elevator just starts to go, and then you don’t get a choice on where you’re going. But you can keep doing that until you land on the floor that you want to be. Then also, we’re looking at, those kind of side entrances. We’re looking for doors installed incorrectly. Again, this all depends on what the actual building looks like or what the actual area that we’re looking at. How it’s structured? We’re looking for doors that are installed incorrectly that you can do the credit card trick. We run into that pretty frequently, because, again, that’s not something that’s really paid attention to. Is the door installed properly? Or it doesn’t need those shields that prevent that attack vector, or is it one of those motion heat sensors that open the door that you can just spray an air duster and it just pops open. We’re really assessing all possible entry points and then choosing the easiest and then working our way down.

To add to that, something that I’ve seen too is doing full reconnaissance how you would normally do, like a network penetration test, for example, before you even try anything. Something that I saw was the main entrance required a batch to get in, and then there’s also security reception there that you might need to interact with. That might not be that first place an attacker wants to go to, but what happens if you walk around the back and, it’s a big building, four or five floors, and they have a parking garage that’s unmonitored. There’s no security guard there. Typically, when you drive your car and there’s no one that’s going to stop you and check your license plate or make sure you should be there. What’s stopping you from walking down the ramp, walking straight to the parking garage, and then, as Jonathan said, you have access to the garage and the stairs, or the elevators and the stairs, and you can already bypass the need to even have a badge to get into the main lobby, and even interact with security already, so performing a thorough enumeration. I think that’s a pretty big point. As Jonathan mentioned, it depends on what the building looks like. If you’re in a big office space and all the parking is outside, obviously you don’t have to worry about that. If you have a part, like a designated parking garage for your specific building, that’s something that you might want to get visibility into. Then if you’re sharing an office space, you might not necessarily be responsible for the security guards in the main lobby. Then that’s open to whole other kind of worms, where, we know this is an issue, but like, how are we at the company who’s a tenant on the fourth floor only going to enforce this? That is just something to keep in mind as well. In terms of potential entry points.

I see a question the chat asking about speaking of entry points, biometric industry systems, is that something you guys have come up against? Is that an effective control or what would you, I’m actually sorry to add some more commentary this, but the thing you mentioned, where the low frequency badges are so bad to my thought, it’s like just getting a higher frequency badge system that’s configured correctly is probably a huge upgrade before you even get to biometrics. I imagine biometrics would be quite a difficult control to bypass. Is that something you guys have seen, or something you would recommend being the entry and ingress points.

I have seen it like once before, I’d say for now, it’s probably like a little overkill, because if I ran into it, it would just be like I’m tailgating. I don’t know, with facial recognition getting pretty good, you could implement it. I think it’s still kind of a little clunky, regardless of if it’s fingerprint or facial recognition. The only one I’ve actually seen in use, and you might have seen this at, I think Amazon was doing it for a little bit, but the palm reading, or it’s not really a palm reading, it’s kind of your hands, like how it sits, kind of naturally. It’s a weird one. I don’t know even exactly how it works. I’ve seen that once before, but I think the reason it’s that is because you have to imagine too again, this is there are all kinds of ways that you could really secure, lock down your internal network, but it makes work not possible, or makes work really difficult for your employees. It’s finding that balance. I think when you’re dealing with biometric stuff, it can get kind of crazy when everyone’s coming in at 9am and everyone’s trying to use their thumb reader or they’re trying to do the facial scan. It’s really about finding that balance. I have run into it once; it didn’t really make a difference at the end of the day. I think it’s just like, too complicated of a solution to make sense. I think it’s a lot. I guess technically, what I was talking about earlier with the low frequency badges associating with a picture, that’s kind of a form of biometric. It’s just more person, more human biometric test or prevention. I think for now, it doesn’t make sense unless it’s like, a very specific secured area that only a few people are accessing.

You might run into employee pushback, too, where they’re like, why would I want to give my biometric data to the company? You can trust in your security team as much as possible, but, obviously you don’t want this to happen, but if your company gets good, if your company gets breached and all your biometric data gets released, that’s also something to consider, that you’re going to get employee pushback for that. I think in specific circumstances, like Jonathan mentioned secure facility, maybe, designated people have special access to something that’s like, confidential, for example, that might be more necessary on top of adding to AI. I think adding the PIN codes that Jonathan mentioned is already a really good thing. I think we can kind of combine the things that we’ve mentioned on this call. Getting rid of low frequency badges for high frequency badges, enforcing to FA, you get pushback on that, but that is a conversation on how secure do we want to be, versus, how do we want to treat our employees. Do we want to make it difficult for them, and then just adding that reception level to of a picture being tied to that badge number, all these things combined can really make it a lot more difficult for someone to even break in. I even go as far to say multiple bad doors that require badge entry. I know Jonathan kind of alluded to this. When you’re going up the elevator, you have three back to back tailgating points. That’s something that could be beneficial to you have to badge in to get to get to the reception area, but then to get to the actual office space, you have to badge again. I think a combination of all these is probably better than just implementing like one biometric pest at that level. The difficulty, obviously, is adding all these layers. Might cost more might not be as efficient, but that’s just the conversation for how we want to balance it out.

I guess it should be stated too, we’re maybe talking about the median case where there’s definitely going to be those cases where you do want biometrics, you want pin in. No getting out of a skiff, if aerospace defense contractors, right there can have controls way above and beyond this. I think depends on your use case a little bit. That’s definitely interesting to hear. In the wild the palm reader, I’ve seen some of those as well. Haven’t seen fingerprint, but maybe going back to what you mentioned, too, on the mass surveillance, or at least the building level surveillance, with automated facial recognition and detection could be an interesting time as well, without adding a lot of friction to employees. Other than that, the fact you’re just surveilling them, which maybe is not a fun thing for people to enjoy, but very interesting defensive control for sure. I know we’re at time here, in fact, a little bit over so thank you for the folks that are hanging on with us. I don’t know if there’s any other questions we can add. I know we have a few minutes before we have to hop off. We’re happy to hang around and answer anything. Jonathan and Andrew, anything we didn’t get to that you really wanted to chat about, or any cool stories or anything like that.

I do have a little bit of a story that I thought was pretty interesting on a physical that I did. I don’t know if I never confirm whether or not this is intentional or not, but it appeared, an operational control led to increased security. So, there’s this company that we we’re doing a physical pen test for, and they actually had a desk reservation system for literally everything. Their offices, even the common areas, those open desk areas, always part of reservation, like there’s a little tablet that you had to put in your network ID into there. From us, an unauthorized perspective, we don’t have access to those network ID or the schema for that. It’s difficult for us to actually reserve something on the tablet. And it’s very blatantly obvious, the thing will turn red if you reserve it, and it’ll be green if it’s open. If you just sat down at a desk and couldn’t reserve it, that would look very suspicious. In this particular instance, one of the employees at the company actually told us, make sure you reserve the room next time. That kind of set off an alarm bell for us. Maybe being in this office space isn’t the move for us, but what’s the alternative? You can hang out in the common area, but it’s like, why are you in the common area for one to two hours at a time, when people walk by you, when they’re on their 10 minute break, or they’re trying to get coffee or something, they see you there constantly. iI just raises an alarm bell. That was very interesting to me, that it seemingly was an operational control to increase efficiency, to kind of not let people be confused, and them to be able to reserve a desk ahead of time. How that contributed to security. I think there’s a lot of areas to explore in terms of how we can better manage, assume compromise. Someone gets in, how can we identify that they don’t actually belong there, even if they’re walking on with a fake badge and pretending that they’re there? I think there’s a lot of things to explore there.

It makes sense. Interesting, how a non-security control could end up leading to increased security. Also, being a part of how they’re working so not getting in the way of things definitely sounds like a win. I don’t think there’s anything else to chat about here. Thank you, Andrew and Jonathan, for sharing some of your experience and expertise. What I’ve taken away from this is that badging makes a big difference from both being able to just the human element of printing out a badge. The technical element of low frequency sounds, if anyone has low frequency in their network, maybe easier said than done, but ripping replacing that now just going to be a huge win for physical security. Personally, I’m still very interested where this next year takes us, as far as tooling around traditional vulnerabilities, how physical continues to fit in. But it does sound like that tends to be still a soft enough target versus, the pure external or the pure phishing social engineering with no on premise. Look, you may be having a little bit of a blind spot there. So interesting to see. Thank you for everyone for joining in. Hopefully that was informative. Always great hearing from our operators here. Andrew, Jonathan, thank you guys for your time and sharing your information.