.

Physical Security?

<<

YuckTheFankees

User avatar

Sr. Member
Sr. Member

Posts: 332

Joined: Fri Apr 08, 2011 3:07 pm

Post Fri Oct 14, 2011 11:24 pm

Physical Security?

I've seen this section before but I don't know a lot about it. I mostly hear about people trying to get through a certain application/ system or writing the final report..nothing about physical security. Do any of you try to pick locks or ... (i dont know what else to ask because I'm that much in the dark)?

Have any stories regarding physical security?
OSCP in progress
<<

eth3real

User avatar

Sr. Member
Sr. Member

Posts: 309

Joined: Wed Feb 27, 2008 10:35 am

Location: US

Post Sat Oct 15, 2011 1:44 am

Re: Physical Security?

I love lock-picking, it's a lot of fun. I've never tried any serious like door locks, but it's been quite useful for getting into file cabinets and desks. I've managed to get my company out of having to call a locksmith when keys are lost for different pieces of furniture.
Put that in your pipe and grep it!
<<

millwalll

Post Sat Oct 15, 2011 11:47 am

Re: Physical Security?

I do have lock picking sets but never done it in my job. Most physical seems to be tested with Social engineer these days. 
<<

YuckTheFankees

User avatar

Sr. Member
Sr. Member

Posts: 332

Joined: Fri Apr 08, 2011 3:07 pm

Post Sat Oct 15, 2011 12:47 pm

Re: Physical Security?

eth3real,

Where did you learn to pick locks?

Jamie.R,

I was going to mention if physical security is mixed in with social engineering, thanks for confirming that.
OSCP in progress
<<

WCNA

User avatar

Full Member
Full Member

Posts: 187

Joined: Wed Mar 02, 2011 8:05 am

Location: Florida

Post Sat Oct 15, 2011 3:31 pm

Re: Physical Security?

I pick locks sometimes but not as a pentester. I'm in a situation where maintenance departments keep changing the locks and sometimes they can't find the key.
ISC2 Associate, WCNA, CWNA, OSCP, Network+
<<

YuckTheFankees

User avatar

Sr. Member
Sr. Member

Posts: 332

Joined: Fri Apr 08, 2011 3:07 pm

Post Sat Oct 15, 2011 6:30 pm

Re: Physical Security?

WCNA,

Are you referring to maintenance at work?
OSCP in progress
<<

p0et

User avatar

Full Member
Full Member

Posts: 197

Joined: Thu Nov 02, 2006 4:38 pm

Location: Victoria, Canada

Post Sat Oct 15, 2011 11:25 pm

Re: Physical Security?

There's a pretty good book called "No Tech Hacking" which explains quite a bit about physical security.  Examples would be dumpster diving and social engineering or even just walking right into your target's building (pretending to be an employee or janitor) and stealing any documents or whatever you need.
GCIH, Security+, Network+, A+, MCP, DCSE
<<

YuckTheFankees

User avatar

Sr. Member
Sr. Member

Posts: 332

Joined: Fri Apr 08, 2011 3:07 pm

Post Sat Oct 15, 2011 11:56 pm

Re: Physical Security?

Thanks P0et, I'll definitely look into that. I've seen a couple of books on amazon and safari but I've never read any of them.
OSCP in progress
<<

eth3real

User avatar

Sr. Member
Sr. Member

Posts: 309

Joined: Wed Feb 27, 2008 10:35 am

Location: US

Post Sun Oct 16, 2011 4:07 am

Re: Physical Security?

YuckTheFankees, I got a small lockpicking set at a local flea market, years ago, and I think I found some PDF called the MIT Guide to Lockpicking (or something similar). No idea if it was legit or not, it was just a PDF that someone had passed along to me. It got me where I needed to be, though I haven't practiced nearly enough to say I'm an expert, or even good at it. I just get lucky sometimes. ;D
Put that in your pipe and grep it!
<<

rattis

User avatar

Hero Member
Hero Member

Posts: 1172

Joined: Mon Jul 27, 2009 1:25 pm

Post Sun Oct 16, 2011 12:37 pm

Re: Physical Security?

I did some physical stuff at old jobs. It's not just the locks. Think about the walls. are they real walls (floor to ceiling) or partitions / fake walls (raised floor to drop ceiling). Where are the cameras? Are they working? Can you see if they're working from where you are? Are they really reviewed (have you done questionable things and not had anyone come talk to you)?

I have a decent (over kill set) of lockpicks. I bought them from a website. Brand name set too.

As for learning. Deviant Ollam has a good book out. You can search the web and find videos and training material of different quality. If you have he money hit up the TOOOL.US (if you're in the US) website and you can buy most of what you need there.

You can also look around for a local locksport group. I know there are 5 in Michigan, and a couple in Ohio (Toledo area and Columbus I think). You can find groups on www.lockpicking101.com
OSWP, Sec+
<<

YuckTheFankees

User avatar

Sr. Member
Sr. Member

Posts: 332

Joined: Fri Apr 08, 2011 3:07 pm

Post Sun Oct 16, 2011 3:25 pm

Re: Physical Security?

Nice reply. I was thinking about mostly picking locks but you definitely opened my eye to others things (thinking about the walls was a good one). I think Im going to pick up a book pretty soon, the more people talk about it..the more I want to learn. And I'll definitely check out some groups in my area.
OSCP in progress
<<

WCNA

User avatar

Full Member
Full Member

Posts: 187

Joined: Wed Mar 02, 2011 8:05 am

Location: Florida

Post Sun Oct 16, 2011 7:46 pm

Re: Physical Security?

Are you referring to maintenance at work?


Sort of. Not our company but the sites I'm sent to everyday (their companies maint. dept.).
ISC2 Associate, WCNA, CWNA, OSCP, Network+
<<

WCNA

User avatar

Full Member
Full Member

Posts: 187

Joined: Wed Mar 02, 2011 8:05 am

Location: Florida

Post Sun Oct 16, 2011 7:53 pm

Re: Physical Security?

Do a search here for lockpicking to see the discussion on cutaway locks to learn lockpicking. You don't need a book. Lockpicking is 95% experience/ 5% knowledge.

================

I hesitate to bring this up due to the obvious security considerations but I guess terrorists don't spend much time on ethicalhacker.

www.securitytube.net/video/2199

www.securitytube.net/video/2249
Last edited by WCNA on Sun Oct 16, 2011 7:56 pm, edited 1 time in total.
ISC2 Associate, WCNA, CWNA, OSCP, Network+
<<

millwalll

Post Mon Oct 17, 2011 3:30 am

Re: Physical Security?

No tech hacking is really good book and a scary one when you see what pretty much anyone can do. If you want learn locking picking you can start off buy buying cheap lock and trying pick that. you can also get testing rigs I remember seeing somewhere.
<<

rance

User avatar

Full Member
Full Member

Posts: 212

Joined: Thu Jan 03, 2008 5:24 pm

Location: Earth

Post Mon Oct 17, 2011 10:22 am

Re: Physical Security?

Lock picking?  Love it!@  I used to fiddle with locks years ago, with no knowledge with what I was doing... was pretty successful at it too.  Recently fell back in love with it.  I don't see them as locks, I see them as little puzzles.

While books are always good, I think the best thing to kickstart the skill of lock picking is attending some sort of hands-on seminar.  A lockpick village at a con would be a great place to start.  You can of course start by yourself, and hit one of those later, but just like most anything, you can learn wrong, then you have to unlearn your bad habits and relearn the skill all over again.

"Practical Lock Picking" (here: http://www.amazon.com/Practical-Lock-Pi ... 1597496111) seems to be the go-to book, and I wouldn't disagree.  The author, Deviant Ollam, also gave a great talk at DefCon 13 (here: http://www.youtube.com/watch?v=JupQ3BpKGYg).  It doesn't get deep in to the mechanics of picking, but is a great overview of what it's all about, how to approach it, even talks about the legal aspect of the activity.

Tools and Locks: Get going with an inexpensive starter kit... I'm still using my 8-piece pick set (6 picks, 2 tensioners), might dive in to a bigger kit later.  If you're going to spend a lot of time picking, I really really really recommend a vice.  There's a really swell universal practice lock stand on lockpickersmall.com.  As for locks themselves, I'd start with a nice cut-away lock.  You can get a set with 2-5 (or 6) pins, and work your way up, or get a single 5 or 6 pin.  The sets are nice to learn with, but once you get the hang of it, the 2, 3 and probably 4 pin practice locks will be useless.  The big goal here is to observe the mechanics of the lock, and learn what you feel when something happens in the pin stack, properly setting a pin for example.  This is a "by feel" skill, but being able to correlate seeing the action and feeling it will certainly help!

After that, it's getting your hands on as many locks as possible.  I keep a watch on ebay, search for "practice locks" and you'll see stuff pop up.  I bought a box of used, misc locks a while back.  I think it was like $18, shipped, and once I threw out the useless ones, I came away with 15 or so useable cores to practice on.

You will get frustrated, but practice certainly does make perfect.  I recently went back to a lock that was kicking my butt, and had been for months.  Didn't touch it of a few months, worked on other locks, etc, finally picked up that butt kicker, and popped it in two minutes.

Practice, practice, practice... and have fun!

Image
Last edited by rance on Mon Oct 17, 2011 10:56 am, edited 1 time in total.
Poking at security since 1986.  +++ATH
Next

Return to Physical Security

Who is online

Users browsing this forum: No registered users and 1 guest

cron
.
Powered by phpBB® Forum Software © phpBB Group.
Designed by ST Software