The Office Of Danger: A Choose Your Own Adventure Story!

welcome to the office of danger a Choose Your Own Adventure story uh my name's Phil I also go as Yaki and hopefully we're going to have half an hour of quite a lot of fun so thank you all for coming um what we're gonna do in this is it's an audience-based decision making social engineering Adventure game so each of you have got a card with two sides uh there will be options on the screen and you'll hold up the side that you think and we'll go with the majority majority rules um a little about the engagement that we're going to do it's a two-day engagement so we've got kind of two days to get through so you get quite a lot of

options um and it was a job that we did during office hours so if you come up to me afterwards and say why didn't you just go in at 2AM this is the answer right here and also as a social engineer the other thing that you have is a get out of jail free card on your person and that will come up as an option every now and again so what that effectively is is a letter from your client contact saying don't ring the police um so before we kind of get into it I I like to paint a picture how many people have done social engineering but yeah put your card up if you have

so a few of you so as you guys will will know and others may have seen is social engineering is super stressful you're kind of on all the time you have to make a lot of decisions off the cuff so I got a fancy Garmin watch which tracks my stress these were the two days of the engagement so stood up here pretty nervous with all of you here I'm on about 95 beats per minute so my average for two days was a hundred so the same level as this with peaks of up to 150 of very close to pooing myself so when you're when you're thinking about what the options are try and bear in mind that sat here in a conference

center is relatively calmer compared to doing it yeah so where are we going we are going to the big city of London uh it's a multi-use office and the client that we have has half of the seventh floor and the entire of the eighth floor now because we're really good at our job we did some ocean uh before the job started and so we were able to find out that there were security guards on the ground floor then you went up to a main building reception uh on the first floor which again had security guards there were then security gates to get get to the lift which would need a pass for security doors to gain access to the

offices uh in the shared building one of the other uses was a wework kind of register shared office on the fourth floor and we also went to our favorite professional website of LinkedIn and found the head of it and some I.T staff members within the organization so the scope that we got given by our client was to access the seventh floor access the eighth floor then once we're in plug into their internal Network and find any low hanging fruit anything that was really critical kind of within their Network so we're ready who's ready four of you excellent this is great okay so during the setup when we're doing our racing what we found was that there was

this shared uh office space within the building do you decide that this is in or out of scope hold up the cards and we'll do majority rules uh that is blue which is in scope so you've now got some decisions you've decided they're in scope do you try and book a legitimate viewing through their head office or do you just not book a viewing again blue majority so you try and book a viewing what a good idea so you're you're on the train you got an hour to kill you ring them up and uh they're not overly helpful they tell you that someone from that specific office will be in touch with you they aren't they do not ring you back

so you get to site you can't wait any longer for a for a phone call back you just kind of have to go for it so you bypass security on the ground floor they're super helpful you speak to them and they say reception's up there you go up to the main reception when you get there they ask kind of what you're here for so do you pretend that you have a booking with the third party to view that shared office yes or no you do overwhelmingly so reception rings the reception of the third party and they say that they have not got you down on their visitor book for the day uh you explain about head office not bringing

you back and after a few minutes of sort of almost pulling yourself but not you can't you get presented with a security pass and told to head to the fourth floor via the elevators great news your past works the speed Gates you've tapped you're through you're now at the elevators where do you go do you go to the third party or do you go up to your client's floor okay I think we are going up to the client's floor so the client has got two floors as we found out in our scope do you go to the 7th or the eighth floor the table sorry uh seventh floor they own a half the seventh and the full of the eighth does

that change anyone's mind oh this is quite tight this one I think we're going to the seventh floor so you exit the elevator and you are buzzed through by the client's receptionist you didn't know that was a receptionist you look around thinking of a way that you could maybe try and avoid this interaction uh but you can't they've purged you through a door it's literally right in front of you so you walk as slowly as possible sort of really Meandering to try and think what you're gonna do so you decide to pretend to be a new starter during covid and you say you work from home you've been here three months or however long and it's your first time heading in uh

what name do you provide to the receptionist do you provide a fake name of an existing employee that you researched earlier or do you provide your real name we're going with the fake name so you provide a staff member's name the receptionist does their due diligence and looks you up on the system and notices that you are in a call you act confused may maybe it's not me maybe it's a different exact same name as me person uh they continue to investigate while you stand there sort of not sure what to do um so the receptionist sort of starts to look at you and they're not overly convinced about the fact that you're here and not on a call

um and they ask for your line manager's name now as part of eurocent you've located the head of I.T now when I say head of I.T we're talking global company billion pound company global company the global head of I.T the top guy so do you provide his name or do you try and change the conversation something else you provide his name you're brave so while all this is going on uh the receptionist asks you if you've received your mug yeah now you literally nervous as anything you have no idea what she's what they're talking about so you stare at them for a while and then you'd know uh and then they they partially were branded mug do you take that mug

you do brilliant so you're there looking at your lovely new mug so it's already a win what a great day out you've got a mug um but the receptionist still isn't quite sure about you so they ask you how you got to the floor and if you had a key card do you say that someone let you up or do you show them the key card that you got for the fourth floor oh that's quite tight uh I think yellow wins that so you show them your fourth floor key card the receptionist takes the key card and states that it's not one of theirs something that you didn't know is that the different floors have different

looking key cards you get the impression that they are really starting to see through your story um they can't get in touch with the managers and they ask for other contact details so do you provide the name of your contact or do you show them you get out of jail free letter provide the name of your contact nice so the receptionist brings your client contact who appears right behind you in reception uh quite quickly uh they escort you to a meeting room and you have an initial debrief uh they're pretty impressed you're here because you shouldn't have been able to get here but they're not overly impressed because you're not there in the office but that's fine uh so you

make a plan do you either say this is how far we've got and call it a day and we'll try again on day two or do you ask to be taken past reception so that you get over that little hurdle and carry on foreign

so your clock your contact degree is happy with that get more out of the money that they paid for you for the day uh you walk past reception into the main into the office area do you ask to be left on the 7th or the eighth floor the scope says you have to do both so uh that is yellow so up to the eighth floor the client decides that it's unfair to give you full access to the eighth floor so they walk you through and they leave you on the stairs between the seventh and the eighth floor both of the doors to get back into the offices are access controlled uh and your past does not work but

luckily for you the toilets are on the unsecured side of the door and after about five minutes someone goes through the door you grab it after they've nipped into the loot and you let yourself in you're on the eighth floor so you saw how a quick look around and you see a spare desk and you sit down without being challenged a lot of this I think is due to your mug really um after about an hour people start leaving for the day do you stay and scan the network or do you go with them you stay you are all really hard workers this is great um so you stay in the office and you scan the network for a few hours once

you've kind of found your stuff you're happy you're done for the day you head back to the lifts and you go down to reception what you didn't notice is it's different lifts and there is a security gate to let you pass these lifts in all the confusion your past that you had no longer works so you can't get past what do you do do you wait for help or do you show off your athletic ability and jump the gate it's about half and a half uh oh no oh [ __ ] how super [ __ ] right sorry oh my God [Music] here's a mug we can go back to this point there's quite a lot because it's

trees so it's not just going back a slide sadly uh right we took a mug we showed them the card we provided them with contacts we got taken there we went to the eighth floor we stayed right here we were sorry can we do that again because I didn't actually so I think that's blue so I think we wait for help so after about 15 minutes of standing there thinking do I live here now uh the elevator opens you explain your situation to a lady who's been working late and show them the card and you show that it's not working they're very sympathetic in reality they just want to go home so they let you through the gate

you get through and you notice there's a a very handy Dropbox for your card so you just drop your no longer card in the box and you like it you like it out of the building over the road to the pub because you are done for the day and you've done really well so that was amazing you got in you used the third party you found weaknesses you managed to scan the network you've had a great day uh it's not dissimilar to what happened on my day when I did this so we'll just quickly go through because some of this might then be useful for day two so what I did was I decided that

the third party was in scope I rang them up on the train and they did not ring back which threw me slightly uh a main reception I pretended that I had an appointment and managed to get that pass unlike you I decided to take that that tour so and see what I could learn about the building about the security if there were other ways in or anything else I did a 25 minute tour of this shared office that I did not want to hire uh in that time I sort of asked about secure parking cycle parking anything else that might have been useful and then I asked if I could go to the stairs so that they'd let me out at the

stairs rather than going back to the lifts but that was not allowed so I then went back to the lifts went up to the seventh floor spoke to reception and I provided my real name for reasons that are dubious to this day and I really don't know why I did it but that was the 150 beats per minute heart rate was talking to that receptionist so that was sheer panic uh I then provided the name of the head of it and thinking he's the global head of I.T this receptionist in London will never ring him he is far too important but they did he was on holiday I couldn't believe my luck so he didn't answer it was

ridiculous uh during all of that this happened which is still my most exciting thing is I got a mug um which is great really enjoyed that uh and yeah I ended up having a call uh getting them to call the client when I said the client turned up very quickly he was sat in reception watching the entire thing uh yeah that was no idea um but we had a meeting and it was fine he was relatively impressed I was pretty smug um and then we decided to carry on for the day and he did genuinely leave me on the stairs citing it wouldn't be fair to give me access to the to both floors uh

so managed to tailgate to the eighth floor did some scans and I did actually get stuck between the elevator and the and the exit at the end of the day when I thought right we're done nothing else can go wrong chill out in the elevator from the eighth floor never mind uh but a very very nice person did help me out which was very good so who wants to carry on day two so because there's this shared office building you have persistent access past main reception if you're in a you're a threat actor you will just hire an office for a month for two months however long you need and you will get access so we decided that there's no

point trying to bypass reception again because we can do that um my client wasn't very well the only person in the building who knew I who knew that you'd be there was a at home working from home uh you explained the situation to main reception it takes quite a long time to work out they're looking at you a bit dodgy but after about 20 minutes you get provided with a pass where'd you head to the stairs or the elevator yeah I think that's blue we're going towards the stairs as you head to the stairs the receptionist informs you that you need to be escorted by a security guard a security guard comes over to escort you

up saying that they will take you to the client's reception on the seventh floor do you continue to the stairs or head to the elevators alone I think that is yellow so we head to the elevators so you your path that they gave you works again so you're in where'd you go floor seven or four eight okay floor eight you all remember that you got caught on floor seven yesterday so it would make no sense brilliant uh so you wait there what is brilliant about this Bank of lifts is there's a panel when you walk in then six lifts and each above each of them it tells you which floor it's going to so you wait

until one of them says eight and then you follow the person in to the left you go up and you let them exit first as you exit the lift they're struggling to find their path to get through the access control door so you're both stood outside the lift between the lift and a door do you get back in the lift or do you wait yellow you wait so you you join in you take your backpack off and you pretend to look through it to find your non-existent pass eventually the staff member finds their pass and opens the door grabbing the door you follow them in now you're in the eighth floor where'd you go do you take a seat or do

you do a lot that is yellow you do a lap so you do a lap at the office noting the view out of the window uh no one pays any attention to you where this is a genuine photo by the way uh where do you go next do you head to the seventh floor or do you take a seat you take a seat so you find an empty seat and connect it and Connect into the network you start your scans and look around the network no one's noticing what you're doing after about 10 minutes you overhear a team discussing a person who didn't arrive at reception security have started a search of the entire building

you realize quite quickly they're looking for you do you stay where you are or do you find a meeting room to hide in that is blue I think you stay where you are so you stay where you are your scans are finished and after some more enumeration you decide that you've done all you can on the eighth floor do you do a debrief to the client or do you head to the seventh floor seventh floor you know there's more targets brilliant so you exit the eighth floor and onto the stairs you head downwards there are two Access Control doors to access this floor as another company owns half of the floor so after about 15 minutes no one has

gone in in or out of the first door on the seventh floor it's quite hard to say do you head back to the eighth floor or do you wait you wait after another 10 minutes someone finally enters the seventh floor you manage to grab the door and tailgate them in as you follow them in they slow down to look back at you and give you that look do you continue to follow them or go to the other office door yellow you go to the other office door you turn and head towards the other door the person lets themselves into the client's office but you can't catch the door before it closes you wait for about

five minutes until a member of building staff comes through and heads towards the client's door you be helpful you manage to grab the door and you let yourself in there are multiple empty officers and you sit on one for the rest of the day finishing all your tests no one notices that you're there you're done you've got to the seventh floor you've got to the eighth floor you scanned your networks you've done brilliantly you ring the client and you provide a debrief of your findings the client asks you to debrief both the client reception and Main Building reception and you do that and it's all great you're done what'd you do you go over the road to the same Pub

um so day two for me so you all everyone I think actually give yourselves a round of applause because you all nailed that good job so in day two uh I got provided a pass my client was actually off sick so having no one in the building know what you were doing is relatively off-putting uh but after a very long time I managed to get a pass um the whole thing with the stairs happened they were like here's a security guard I was like absolutely not we can't be doing that so he went went to the lifts and went up to the eighth floor someone did actually struggle to find their pass when we got off at the eighth

floor so I did take my backpack off put it down started pulling out my laptop started pulling out my coat everything else just to buy time um luckily they'd managed to find their card and they let us down I sat next to the Commercial Services team and overheard them discussing because I'd logged in registered at reception on the ground floor that hadn't in all of the confusion they had wrong reception on the seventh floor which I didn't know about so they they then rang my client and gave me a pass but what that meant was seventh floor were expecting me so after about 20 minutes when I just hadn't shown up they had rung the main floor

reception and gone this person I don't we don't know where this is and they genuinely got all of the security guards in the building to do a floor by floor sweep to look for me uh luckily my someone ended up bringing my client about something else and mentioned it was going on and he managed to speak to the right people to call it off before we wasted like an entire day of their lives um but managed to get coffee sit in their breakout area had a lovely time uh one thing I did do when they when I overheard them discussing me was I went and hid because I got really scared I was a bit like

this they know I'm here this is this is it so I sat in a meeting room um unplugged the VoIP phone to get to another Network and it turned out it wasn't a meeting room it was the global head of finances office and he walked in and he said looked really confused and said who are you I panicked look at him and said who are you uh to which he replied as he pointed to his name plaque on the door that I'd missed he said his name and I was just like oh so we had a really nice chat very quick chat as I left his phone unplugged so I think he had the quietest

day he's ever had in his life after that but he told me there are loads of empty meeting rooms on the seventh floor so to go down there would be a great idea like thanks uh the problem with the seventh floor was the fact there were these two doors and the we're on the eighth floor the toilets are on the unsecured side of the singular door on the seventh they were on the unsecured side of the first singular door not the second which led to the stairs so I had to wait for someone to come out to go to the stairs for reasons of just traversing floors or taking a phone call which took forever

um and when it happened the guy turned looked at me and I was like if I don't go the other way he is going to catch me so I was then stood in this vestibule area for about 10 minutes with Access Control door access control door or the door back to the stairs where I just spent 20 minutes trying to hide from CCTV uh that was not a good position to be in um but luckily a catering lady came along after not too long and and I was like oh I'll get the door for you hold the door and they then kind of let me in seventh floor was great all the access control doors were

open with Bits of Paper wedged underneath which was really nice so managed to go around there had a great time and I had a really nice beer after all of it um now a lot of people a lot of people will go the issues that I found are there's a third-party company in the building we we can't fix that the toilets are on the unsecured side of the door we can't fix that so what actually can you recommend in this scenario because the two biggest failings were design of the building um so I'm going to tell you the same thing I told them which they groaned up I imagine you were all grown up first one is

have policy on social engineering nobody groaned that's good and the second is is do that training do that security awareness training make sure people know look for Lanyards don't hold doors all of that normal stuff but literally the main two things were like you cannot fix these um so in summary anyone so other than the five of you that have done social engineering if you haven't done it and you get the chance to do it give it a go it is so much fun uh terrifying fun um and if you're sat at your computer and you go I'm really bored I'm really bored of everything nothing brings me joy I want that wind in my hair moment

um go and try not to pee yourself while breaking into a building legally uh sometimes like this one it works out really well that was me with with my mug uh and a croissant that I got out of there break room looking over St Paul's other occasions you end up in abandoned Laser Quest on the outskirts of Paris uh sorry it was social engineering my way around a shopping center which they didn't tell me had an abandoned Laser Quest area and um so yeah that's my talk thank you all very much for joining in um I hope you had fun