 all right we're going to get this next speaker underway so if we can start to uh quiet down and give our attention to chris pritchard he's been conducting ever more security tests and audits of the ICS and the rail air maritime and utility sectors as well as CNI work at nuclear sites his skills also include social engineering and he successfully gained access into CNI airports and casinos which are regarded as some of the most secure facilities in the industry we're going to give our attention now to chris the basics of social engineering a.k.a how I break into casinos airports and CNI wow hello defcon how awesome is this so uh as I mentioned my name is chris and uh for the various of you who think I'm Australian I'm not I'm British I know I don't know the queen which is a very common question I get asked as soon as I tell people I'm British so I'm going to talk about the basics of social engineering this is for people who want to get into social engineering but think that they must know everything about body language facial expressions you don't so here are some things that I have learned through my experience and these tips have got me into some places that you really not should not be in so casinos airports should not be breaking into airports I can and you can do it too with permission so just quickly some terminology just in case you're unaware of some of these phrases AC obviously we wouldn't be here if we didn't know that one but I'm going to put it out there just in case CNI stands for critical national infrastructure that is airports but also nuclear power plants water treatment works things along that level things that the government tends to protect quite to quite crucially oh since open source intelligence that's see as we know using things like Google Street View etc to find information normally about our target pretext now this is the Wikipedia definition but basically this is the lie this is the story you're going to tell somebody about why you were there and the last one NDA non-disclosure agreements if we get to the point because my timing is a bit tight but if we get to the point where some questions if I say no comment it's because I'm under a non-disclosure agreement and I can't talk about that specific thing so step one reconnaissance doing your homework so the first thing I always do is perform open source intelligence I look at Google I look at Street View I look at their website I look at social media anything that is going to help me understand what this company looks like how they dress what their sort of ethos culture is that's really really useful it really really helps you the next thing I suggest you doing is actually go there go to the place go to that target that thing that you want to get into and walk around it walk around and look for weaknesses and there are going to be weaknesses I guarantee it so common weaknesses that I tend to look out for back entrances most security is built around people coming in the front entrance it's not built around people coming in the back entrance so that's a great place to go smoking shed now I gave up smoking for 20 odd years ago but I bought a vape machine just so I can go and stand in a smoking shed and build a rapport with people and talk to people and it's so easy when you're in that position to then walk back into the into the building with them because you're part of them you're a smoker so that's a good one to go to shared offices are interesting so in bigger cities if you get a higher eyes building what often happens is the the place that you are trying to get into is probably on one very specific floor now it's very very careful and very very important that you don't go to the wrong one because you'll get out of jail free letter if you have one probably doesn't cover the other offices so take a note of which office you're actually trying to get into and what floor they're on again really really important and the great thing about these big sort of offices is they often have this sort of communal reception area that is great go and sit in there for a good couple of hours take a laptop or something but end your working and just sit there and observe what's going on look around and some really really important things to note from that when you're in there is what are the staff wearing now if you're going to try and sort of tailgate in and appear like you should be there and a one of them you need to match that so take a note of that what are they wearing are they wearing really smart office wear are they wearing smart casual just like a shirt with no tie for example or are they wearing jeans and t-shirt if you're doing that thing and you want to get in there looking like that you need to take a note of that so the other thing that I think is really interesting when are the busy times one of the busy entry and exit times if you want to tailgate in you want to tell gay in when it's busy there's no point tailgating in when it's quiet but conversely if you've seen a weakness somewhere in a back door back entrance somewhere and you think you can do some kind of door bypass the best time to go and do that is when it's quiet because you're less likely to get caught so take a note of that sort of stuff really useful the other thing what else do you notice how are they wearing their ID badges for example are they portrait landscape what color are they what color are the the lanyards themselves do they have metal pins on the lanyard anything that's similar that you can make look the same do it what I found is eventually that you end up with a collection and I can tell you that this blue lanyard with as you can see a blank ID badge but with some metal jangly bits on that's what got me into an airport because that's what they were wearing yeah the other fun thing is you often end up with a bit of a collection of lanyards like this after a time don't wear them all at once that's a bit obvious so before you do the entry and after you've done this reconnaissance construct this pretext construct this lie that you're going to use as your story but crucially fit it around what you know now I come from an IT support background so I often pretend I'm an IT network engineer because I know that stuff and if people challenge me about it I know how to talk IT network stuff I don't know how to talk I alarm information so I don't pretend I'm a alarm engineer so fit that pretext around your knowledge because what you want is if you're challenged you want that information to come from your conscious you don't want to have to think about it from your subconscious because you will end up going I'm here to fix the alarm that's not what you want hey I'm here to fix the IT I believe you got some internet issues is going slow oh yeah just let me plug in here let me log on to your browser let me go to this website you know that stuff so fit that pretext around your knowledge it will help you it'll make you feel better about it because they say if you shroud a story in part truth it becomes believable not believable just to you but there's a person that you're telling it to as well so the other thing get your outfit if you are going to pretend to be an alarm engineer dress like an alarm engineer if you're going to pretend to be a construction worker dressed like a construction worker obviously that's all pretext dependent but yeah you want to match it and again that's where the ocean and we're sitting in that reception comes in really really handy you've noticed all that stuff down go out buy the things match it you want to look like them you want to look like the person or the building that you're trying to get into match it also if you are going to be a alarm engineer you need some alarm engineer stuff I don't know what alarm engineer people carry but I'm guessing they carry some kind of box with some tools in it if I'm going to be an IT system network engineer I'm going to bring a laptop who turns up to fix an IT problem without a laptop maybe a cat5 cable so think about what you're going to do there and what this pretext is going to be and bring some props because again props help you reinforce that idea of you should be there so gates gates are interesting we often see gates day to day and when we try to do SEO trying to gain access to a building they're often seen as a barrier but it can also be a weakness as well so here's a gate that I saw and this is not a very clear picture I appreciate that but the white window that you can see there is the security office and the security office that is their side window and they were looking at the front they were not looking at the side now that barrier is well frankly pathetic and most people can either step over it or underneath it but what was worse about it and I've got another example here there was a massive gap at the end as the gap between the wall and the end of the barrier that you could actually just sort of walk around it like that okay so that's a weakness the next one so we we call this the long man technique you have to excuse the quality of the pictures this was actually taken from a video but I couldn't redact company names easily enough from the video so I had to take and take stills from that so here's my colleague James he's swiping in he's bent down he's swiping into this gate and then you see me coming in I'm not bent down and I'm not swiping into that gate and then what I only noticed the other day it's not amazingly clear on this picture there's a cleaner in the far corner and she stood there like this he noticed this the other day when I looked at this picture anyway so anybody notice anything odd about how I've walked in there bearing in mind this is called the long man technique shout it out tailgating I am tailgating yeah but I'm tricking the gate system I've put a laptop bag directly behind James and I've tricked the system into thinking there is someone still there IE a long man and that is an easy easy easy way to get in the number of times I've done that and been successful is unbelievable so don't see gates as a hard and fast barrier there are ways around them they are a weakness in some cases so you got in what are you gonna do now so my first tip is actually keep calm because you are gonna have this massive massive adrenaline buzz go oh my god I'm in and if you have that adrenaline buzz you're gonna give yourself away because somebody is gonna go it looks really funny so keep calm now you did some most in you walked around the building late those locations to where you are and think about it and bear in mind I've caught out that being caught out with us before those those maps you see aren't always accurate so just think about it as a skeleton if you like the next thing I'd say once you're in there is be observant we as human beings are terrible at noting things and especially if we're buzzing on adrenaline from having just successfully gained entry into somewhere we definitely shouldn't be so I look out for things like this exit signs and I look for toilet signs and I suggest you do the same because hiding in a toilet is brilliant a colleague of mine has actually printed out a laminated sign with sticky tape on the back of it that says out of order and he goes and hides in the toilet for a good 20 to 30 minutes and that is a brilliant thing to do because all that adrenaline comes out of you you have a little bit of an adrenaline crash maybe but you then become calm and you are not acting on adrenaline which is going to mess things up if you do have to interact with people so go and hide in those toilets think about what those exits are and also think about how those exits work are they push button exits are you can I just escape if I need to or they swipe card controlled and if that case I might really have to probably either have to find some swipe cards on people's desks get one for myself or to get somebody out again again really really important information some more things to think about when you're in there what's the target what have you been told by your client to do now nine times out of ten it's plug into the network hacks it up walk out cool sometimes it's not sometimes it's I want you to go and get a red folder from the finance department that is our company results get out with those that's it job done think about that target and how you're going to get from where you are now hopefully in the toilets hiding see where that thing potentially is this has been mentioned already don't be afraid to ask for help now I can tell you about a casino that I I broke into in the UK and I saw somebody go again it wasn't a swipe so it was a swipe controlled door but you couldn't easy to outgate because you needed to swipe and a pin number so I saw this person approaching the door and I said hi I'm from the other office and I'm Leon from the IT network team my badge doesn't work on this particular door would you mind helping me in oh yeah yeah find no problem I'm in now in this particular case the target was to appear at the client's desk so I walked in and I went hi man I'm here and he said okay how'd you get in I said I asked somebody for some help and they let me in my expensive social engineering training program that he's paid for is working out great yeah it sure is and he said to me okay we need to go and have a little walk around and I need to point out who let you in I'm a bit uncomfortable doing that I don't like the name and blame game but okay we'll do it because it's obviously either that person's not looking at your training program or some things gone wrong so we walked around with some coffee cups we got back to his desk and they said right so who was it who was the person that let you in I said oh is that lady over there in the blue sporty dress so what what's the matter that's our HR director okay good so that's working well for you then the other thing I suggest is if you get to a desk and you're sat there and you're on the network or you go into a tea and coffee area engage in polite conversation now I've put Blake Lilly in there don't make them your best friend you don't need to make it to that level of conversation but engaging polite conversation you were supposed to work there so you're supposed to talk to your normal work colleagues as an everyday thing so talk to people talk about you know if someone's talking about their holidays or vacations or whatever engage in that conversation because it's really really helpful and I'll explain it so this is a Chris Hagnaggy saying if you've read his book you'll see this in there somewhere always leave people better feeling better for having met you and that's really really useful because and again I'll give you a little story one airport I went into I got into the office and I saw at the far end there was a lady sat there who was obviously a lady of power she was somebody serious big rig in this company and I were I sort of purposely walked around a bit sort of lost like this and I'd already noticed that each of the desks had individual numbers on I got to this lady and I said I'm really sorry I'm looking for desks 149 can you help me oh yeah yeah hold on a minute and she got up and she's running around like this guy desks 149 here you go here it is brilliant thanks very much plugged in network stuff great started talking to her games in play like conversation but what that meant was that everybody around thought that I should be there because I was talking to this lady of power and it turned out she was a PA to someone really really high within this organization and from that you can come back to that person because they're like a focal point and you can come back to them and go hi lady in power I really need some help with something else and you can return back to that new friend of yours but also if you are talking to somebody in power like that it builds acceptance that you should be there and you shouldn't be there but he's talking to someone like that makes a thing that you should be there I'm gonna talk about one piece of cycle psychology related advice and I wanted to stay away from this but I think this is really really important so there's something in psychology called don't negate the frame some of you have heard about this so if I say to this entire room hey nobody think about pink elephants all right don't do it don't think about pink elephants everyone starts thinking about pink elephants why is that relevant if I went to this lady of power and said hi it's Leon from the IT network team I just need to plug into this network and sort your internet out don't worry I'm not here to hack the network what's the first thing that person is going to be thinking yeah exactly so don't talk about things in a negative way like that think about it in positive hi it's Leon from the IT network team here I'm just gonna sort out your internet it's going a bit slow I'm gonna make it faster for you it's a positive thing she's gonna help me if I say I'm not gonna have network she's gonna think that so think about it and talk about it and spin it in a positive way so you've got in what else do you need to know so I call this the fear all of us have this inner voice and it will say things like oh guess you're gonna go to Defconn you go and talk on the SE village and you're gonna be like really nervous and it's your inner brain your inner voice is going and building all these bad negative things in there don't listen to it when I when I did the first airport I thought really really carefully about where I should position my get-out-of-jail-free letter I was wearing a suit and tie and originally I thought I know if I put my get-out-of-jail-free letter just here in my inner sort of suit jacket pocket that'll be a good place because it's easy to reach and then I thought hold on a minute what kind of people protect airports oh people with guns right probably can't expanse a body armor of any description bulletproof vest of any description and if I get stopped by police with guns and I have a letter that's in here and I go to reach for it when people with guns pointing at me has probably not a good place to put it but it was just this inner voice it was just this fear building up in your inner brain guy this is a bad thing this is a bad thing it's not ignore that inner voice override it and just say it's fine I'm going to be okay I'm here to do a job it's going to be fine the other thing I'd say once you first start doing this and in fact even to this day I still get this nerves and natural don't don't worry about it you are going to be nervous go and hide in that toilet calm down it's absolutely fine and I appreciate I'm probably speaking to a massive room full of hackers but I don't know when I first started doing se I had real ethics problems because my mom and my my dad had always told me not to break into buildings if you do have those ethnic problems you might not just tell yourself you're acting and it makes it okay ish yeah and the other thing that I don't think it's talked about enough is is exhausting if you are on an se job for an entire day the adrenaline ups and downs and the crashes pretending to be somebody else trying to have a network for an entire day or whatever it is you're doing is absolutely exhausting you will be so tired at the end of it one of the jobs I did the I did it for a day the drive home as the end of the day was a four hour drive now in the UK four hours is quite a long way appreciate it's not quite so long in the in the US and people like going long distances but for me that was exhausting I should not have stayed there and done a four hour drive and at some point what I did is I pulled over into services and I slept like a baby for two hours so it's exhausting think about that when you're building that into your scoping or your jobs timings think about how tired you're going to be at the end of that day some other things just some stuff to help you improve a little bit read some books Chris Foss is a FBI negotiator and he's written a book called nebs but difference and that is about negotiating that's a good skill to have when you're doing this Olivia Fox Cobain charisma bit really really useful if you are an introvert as well this is a great book for helping you do se you man another UK se guy very very useful book to read can't come really here without mentioning this book otherwise I'll get short and then when you start getting into the point where you want to interest you're interested in body language I'd start here this is a really good book as well and the other thing I'd say is practice get your company to get you involved in these kind of tests you're gonna fail at some point don't worry treat it as practice and that's it I want to say thank you very much for the community and I believe it's it's the thing that you have to have a cat selfie picture so I put a cat selfie picture but this is me on Twitter if you want to hit me up for some more questions or ask more information please do thank you very much