Physical Security?

  • This topic is empty.
Viewing 24 reply threads
  • Author
    Posts
    • #6913
      YuckTheFankees
      Participant

      I’ve seen this section before but I don’t know a lot about it. I mostly hear about people trying to get through a certain application/ system or writing the final report..nothing about physical security. Do any of you try to pick locks or … (i dont know what else to ask because I’m that much in the dark)?

      Have any stories regarding physical security?

    • #42873
      eth3real
      Participant

      I love lock-picking, it’s a lot of fun. I’ve never tried any serious like door locks, but it’s been quite useful for getting into file cabinets and desks. I’ve managed to get my company out of having to call a locksmith when keys are lost for different pieces of furniture.

    • #42874
      Anonymous
      Participant

      I do have lock picking sets but never done it in my job. Most physical seems to be tested with Social engineer these days. 

    • #42875
      YuckTheFankees
      Participant

      eth3real,

      Where did you learn to pick locks?

      Jamie.R,

      I was going to mention if physical security is mixed in with social engineering, thanks for confirming that.

    • #42876
      WCNA
      Participant

      I pick locks sometimes but not as a pentester. I’m in a situation where maintenance departments keep changing the locks and sometimes they can’t find the key.

    • #42877
      YuckTheFankees
      Participant

      WCNA,

      Are you referring to maintenance at work?

    • #42878
      p0et
      Participant

      There’s a pretty good book called “No Tech Hacking” which explains quite a bit about physical security.  Examples would be dumpster diving and social engineering or even just walking right into your target’s building (pretending to be an employee or janitor) and stealing any documents or whatever you need.

    • #42879
      YuckTheFankees
      Participant

      Thanks P0et, I’ll definitely look into that. I’ve seen a couple of books on amazon and safari but I’ve never read any of them.

    • #42880
      eth3real
      Participant

      YuckTheFankees, I got a small lockpicking set at a local flea market, years ago, and I think I found some PDF called the MIT Guide to Lockpicking (or something similar). No idea if it was legit or not, it was just a PDF that someone had passed along to me. It got me where I needed to be, though I haven’t practiced nearly enough to say I’m an expert, or even good at it. I just get lucky sometimes. ;D

    • #42881
      rattis
      Participant

      I did some physical stuff at old jobs. It’s not just the locks. Think about the walls. are they real walls (floor to ceiling) or partitions / fake walls (raised floor to drop ceiling). Where are the cameras? Are they working? Can you see if they’re working from where you are? Are they really reviewed (have you done questionable things and not had anyone come talk to you)?

      I have a decent (over kill set) of lockpicks. I bought them from a website. Brand name set too.

      As for learning. Deviant Ollam has a good book out. You can search the web and find videos and training material of different quality. If you have he money hit up the TOOOL.US (if you’re in the US) website and you can buy most of what you need there.

      You can also look around for a local locksport group. I know there are 5 in Michigan, and a couple in Ohio (Toledo area and Columbus I think). You can find groups on http://www.lockpicking101.com

    • #42882
      YuckTheFankees
      Participant

      Nice reply. I was thinking about mostly picking locks but you definitely opened my eye to others things (thinking about the walls was a good one). I think Im going to pick up a book pretty soon, the more people talk about it..the more I want to learn. And I’ll definitely check out some groups in my area.

    • #42883
      WCNA
      Participant

      Are you referring to maintenance at work?

      Sort of. Not our company but the sites I’m sent to everyday (their companies maint. dept.).

    • #42884
      WCNA
      Participant

      Do a search here for lockpicking to see the discussion on cutaway locks to learn lockpicking. You don’t need a book. Lockpicking is 95% experience/ 5% knowledge.

      ================

      I hesitate to bring this up due to the obvious security considerations but I guess terrorists don’t spend much time on ethicalhacker.

      http://www.securitytube.net/video/2199

      http://www.securitytube.net/video/2249

    • #42885
      Anonymous
      Participant

      No tech hacking is really good book and a scary one when you see what pretty much anyone can do. If you want learn locking picking you can start off buy buying cheap lock and trying pick that. you can also get testing rigs I remember seeing somewhere.

    • #42886
      rance
      Participant

      Lock picking?  Love it!@  I used to fiddle with locks years ago, with no knowledge with what I was doing… was pretty successful at it too.  Recently fell back in love with it.  I don’t see them as locks, I see them as little puzzles.

      While books are always good, I think the best thing to kickstart the skill of lock picking is attending some sort of hands-on seminar.  A lockpick village at a con would be a great place to start.  You can of course start by yourself, and hit one of those later, but just like most anything, you can learn wrong, then you have to unlearn your bad habits and relearn the skill all over again.

      “Practical Lock Picking” (here: http://www.amazon.com/Practical-Lock-Picking-Physical-Penetration/dp/1597496111) seems to be the go-to book, and I wouldn’t disagree.  The author, Deviant Ollam, also gave a great talk at DefCon 13 (here: http://www.youtube.com/watch?v=JupQ3BpKGYg).  It doesn’t get deep in to the mechanics of picking, but is a great overview of what it’s all about, how to approach it, even talks about the legal aspect of the activity.

      Tools and Locks: Get going with an inexpensive starter kit… I’m still using my 8-piece pick set (6 picks, 2 tensioners), might dive in to a bigger kit later.  If you’re going to spend a lot of time picking, I really really really recommend a vice.  There’s a really swell universal practice lock stand on lockpickersmall.com.  As for locks themselves, I’d start with a nice cut-away lock.  You can get a set with 2-5 (or 6) pins, and work your way up, or get a single 5 or 6 pin.  The sets are nice to learn with, but once you get the hang of it, the 2, 3 and probably 4 pin practice locks will be useless.  The big goal here is to observe the mechanics of the lock, and learn what you feel when something happens in the pin stack, properly setting a pin for example.  This is a “by feel” skill, but being able to correlate seeing the action and feeling it will certainly help!

      After that, it’s getting your hands on as many locks as possible.  I keep a watch on ebay, search for “practice locks” and you’ll see stuff pop up.  I bought a box of used, misc locks a while back.  I think it was like $18, shipped, and once I threw out the useless ones, I came away with 15 or so useable cores to practice on.

      You will get frustrated, but practice certainly does make perfect.  I recently went back to a lock that was kicking my butt, and had been for months.  Didn’t touch it of a few months, worked on other locks, etc, finally picked up that butt kicker, and popped it in two minutes.

      Practice, practice, practice… and have fun!

    • #42887
      rattis
      Participant

      @Jamie.R wrote:

      No tech hacking is really good book and a scary one when you see what pretty much anyone can do. If you want learn locking picking you can start off buy buying cheap lock and trying pick that. you can also get testing rigs I remember seeing somewhere.

      the toool website had testing rigs, I usually build my own for about half the cost. get a Kwickset mortise deadbolt (double packs are great), and re-pin it yourself not that hard. I’ve done it for presentations and Bsides Detroit’s Lockpick village.

      I’ve gotten into “secure” areas in old jobs by either going over the wall in the drop down celling (running cable to locked offices), or under the floor (data center cages when I forgot the key).

    • #42888
      rattis
      Participant

      I know several people have said cut-a-ways. Personally I don’t like those. They teach a bad habit from the start. Same with clear locks. It gets you too used to watching what is going on, and you don’t learn to feel properly. So you’ll rock the cut-a-ways, but a non-cutaway will give you all kinds of trouble.

      I also agree with Rance on the vice, or better yet, make a mount, like a door. I can rock a lock I hold in my hand, but mounted properly gives me trouble. Even if it is a lock i know I can pick if in my hand.

    • #42889
      YuckTheFankees
      Participant

      Would I just get a “lock picking” kit? or is there a special name for it?

    • #42890
      YuckTheFankees
      Participant

      rance,

      nice post! and damn those are a lot of locks haha 

    • #42891
      rance
      Participant

      @YuckTheFankees wrote:

      Would I just get a “lock picking” kit? or is there a special name for it?

      There are a lot of tools, the most common being the lock pick, of which there are many and the tension rod, also several to choose from.  The next most common and recent is the bump key and hammer, then there’s jigglers and shims and tubular picks.

      Something good to start with would be this: http://www.lockpicks.com/brockhage-lock-pick-set-b230.aspx

      (i’d also get one of these for starters: http://www.lockpicks.com/longtwistwrench.aspx)

      I’ve got this kit: http://toool.us/equipment.html The only benefit of that over the other one above is that is has a mix of thick and thin picks, and it has the twist tension rod.  But I don’t know if that justifies the cost difference.  That site has a lot of cool stuff, look around.  That vice I mentioned earlier is here: http://www.lockpickersmall.com/universal-practice-lock-stand.html

      Now, I’d be remiss if I didn’t share the lockpicking rules.

      1. Do not pick locks which you do not own.

      2. Do not pick locks which you rely on.

      That’s it.  And I can personally attest to rule number two.  ;D

    • #42892
      YuckTheFankees
      Participant

      Thanks for the link and Ill definitely keep those 2 rules in mind lol

    • #42893
      Anonymous
      Participant

      I think my kit cost me about £40 and it has all sorts in I don’t do much lock picking but I used to practice on a lock I purchased for about £7 really interesting when you take it apart too.

    • #42894
      lorddicranius
      Participant

      In case anybody who’s interested in lockpicking has missed it, Schuyler Towne put together a great series of videos to get people started:

      http://www.youtube.com/watch?v=VVSL0liiWoc

      That’s a link to the first vid in the 24-part series.  chrisj mentioned earlier that it’s not very hard to re-pin a lock.  I was nervous about it for awhile thinking I’d screw the lock, but Schuyler added two vids in this series about it: one vid on taking a lock apart, another putting it back together.  Very easy to follow and you probably have most everything you need to do it just laying around the house.

      The videos are short and to the point…no long, drawn-out boring videos there.  I highly recommend this series to anybody who’s just getting started and hasn’t gotten around to buying Deviant Ollam’s book yet 🙂

    • #42895
      SEO_Eulie123
      Participant

      Also there’s a product that helps in Security its called Tribulus Terrestris Extract 1000mg just take it and increase your strength. So you have nothing to worry about security.

      Tribulus Terrestris Extract 1000mg – 95% Steroidal Saponins, 80% Protodioscin. Premium Testosterone Booster Supplement Capsules for Optimum Performance. Now with Full 90 Day Supply.

        Promotes natural testosterone production for faster muscle growth and repair*
        Increase sex drive and libido*
        Higher energy and stamina throughout the day*
        Highest Potency Tribulus Terrestris Extract on Amazon – 95% potency compared to 45% potency per capsule of the other brands
        Premium Quality Supplements Manufactured and Tested in the USA in FDA inspected, GMP-certified Facilities and includes our 100% Money Back Guarantee. BUY 2 OR MORE AND GET FREE SHIPPING.

      Visit Now: http://www.amazon.com/Tribulus-Terrestris-Extract-1000mg-Protodioscin/dp/B00EULVH2K

    • #42896
      rattis
      Participant

      I know I’m bringing new life to an old topic. I came across this over the weekend.

      How to Own and Protect Your Office Space – Dr. Tran – CarolinaCon 7“. The audio got a little weird when I watched it, in spots. But the information was still there and pretty good.

Viewing 24 reply threads
  • You must be logged in to reply to this topic.

Copyright ©2021 Caendra, Inc.

Contact Us

Thoughts, suggestions, issues? Send us an email, and we'll get back to you.

Sending

Sign in with Caendra

Forgot password?Sign up

Forgot your details?