Your Daily Routine, Their Daily Recon - George-Octavian Vieru

Hello everyone. So, Oh. So, today I'm going to talk about your daily routine, their daily recon. So, a little bit about me. I'm a security consultant. I like red teaming, social engineering, no sin, and physical security. And most importantly, I like to understand the attacker's mindset because that helps me with all the points I've mentioned. So, the content nobody worries about. How many of you watch TikTok and have seen daily life videos? There we go. So, it's a really common thing. And everyone looks at it as just normal content. However, there's much more to it if you look at it through an adversary's eyes. So, I'm going to show you six little clips. And we're going to look at them through

the everyday person's point of view. So, as you can see here in the first clip, the morning motivation. They wake up, they show their alarm, they show the time, their morning routine. A lot of people see this and relate to it. Oh, it's that Monday morning. Oh, I can't be bothered. It's too early. Relatable. The next clip, it's them heading out. They finished their morning routine. They're on the way out. They're locking the door. It's beginning of the commute. People look at this and go, "Wow, I like I like what they're wearing." They could be inspired by this career. And again, could be relatable. The third clip, now we begin the commute. So, we've gone from finishing

getting ready to leaving the house to now commuting to the place of work. As you can see here, the person is taking the TFL. A lot of people can relate, yet again. The main thing here is people relate to this content. They see this and they're like, "Oh, no, the early morning rush hour. I can't stand this anymore." Or maybe they want to experience it. Maybe they've not taken the TFL before. Now, finally, they've made it to the office. People look at this and yet again, the main thing that's always noticeable is the viewer relates. It's all about relating. They see this, they're like, "Wow, it's the same procedure as my office. You tap, you go in."

And then again, they might see this and feel inspired. "I want this career. I want to work in this office. I want to be able to wear this suit." Now, they've made it inside. They sat down at their desk. They turned on their monitors. They're beginning work. Yet again, like we've discussed, people relate to this. However, in this one it shows more on the life of this individual and his career. So, people might see this and feel inspired. "I want this sort of career. I want to be sitting at this desk. I want this." And finally, they finish work. All done for the day. It's time to go home. They show their journey home. This

part of the day in the life is where they show how they go from their office to their home, to the gym, or anywhere else after work. And from this, the audience look at this and say, "Wow, I would like to work in London. I would like to live there." Yet again, some might relate, some might feel inspired. However, now let's look at all those clips through the eyes of an attacker. The same six clips, nothing's changed, nothing different. The first one. We noticed it being 6:00 a.m., it being early. The viewer was relating to this. However, we look closely, we can see that there's a 9:00 a.m. meeting on floor 12. We can also see there's an

email from an employee or colleague of this individual. These two things here can help us with building a pre-text if we're doing some social engineering or if we're doing a physical assessment. Next one. Then leaving, the second clip. Initially, we saw the good outfit, the house, and people were relating or inspired. However, if we look closely, we can see the number 27 on their door. Now, we know what number they live at. And another thing is the door frame and the actual door is quite distinct. Not a lot of places look like this. This can be used with OSINT to geolocate their exact location and help build a report on this individual with more clips to follow.

Now, the commute. Initially, we saw rush hour, we saw them on the train, nothing more. If we look closely, we can see that they're on the Northern Line. And we can see this very crucial bit of information 8:17. We know uh give or take, they might wake up a bit later, they might wake up a bit earlier, less traffic, but give or take, at 8:17, they will be taking their train. So, this helps us build more and more rapport on this individual. So, the next clip. They've made it to the office. We saw this and we were like, "Wow, I would like a job like this, To tap in a nice office and everything. However,

we look closely at what this individual is holding is a badge. That badge displays their picture, their name, the font, the color, and the positioning, it being horizontal. We can also see, right here, this green little light. This suggests to us that when tapping and it's a valid key card, it lights up green. This can help us with when performing physical assessments. And lastly, the entrance. As we can see, this is another indicator of a place of entry that this building has where a lot of employees go through. So, when conducting a physical assessment, going through this entrance, playing the role of an employee would not look sus- suspicious. And now, back inside the office. Finally made it

in. We can see the software they use, we can see the hardware they use, and most importantly, we can see on the boards at the top the deals and projects they have. This is internal information. Armed with this internal information, we now can bypass a lot of confrontation when doing physical assessments or social engineering because we now hold this information that is not open to the public. When presented on the phone when doing vishing or in person when doing a physical assessment, we already eliminate the fact that we're an outsider because we know said information. And lastly, the final goodbye, we're going home, the view of London. You may look at this initially and say,

"How How can I see this from an attacker's point of view? Just a few buildings, there's nothing sensitive." However, very distinct building, the Gherkin right there, and everything else around it, this helps us locate where the actual office may be. Because sometimes the address of the office is not presented. So, we would have to use OSINT to geolocate this office. So, from all these six clips, if we put them together, we're able to build a a good rapport on this individual and his place of work. So, now I'm going to discuss a case study relating to short con- short form content, how it went from TikTok to badge bunny. So, what was my brief? I was to support

a colleague in a physical assessment with recon only and only from my desk. My starting point was the company's name and nothing else. What was my role? Recon. And I was never to go on site. What did I use? Social media. There was no insider, no site visit, no contact with a single employee. How did I do it? There were three sources. So, the first one was the intern cohort. Several internships, same intake, all posting day in a life videos. And taking all the different videos, overlapping them, can create a very good layout of the internal building or company. As you would have your first video of an internship's individual showing the entrance, showing the

reception. You then look at the third video and you see floor two or floor three. You look at another video, you might see a bathroom, you might see other parts of the building. When put together, that's when the issue arises. But, throughout all these intern videos, there was one thing that was always prominent. The badge, the employee badge. The second source, last day at my job. A leavers farewell video, a sentimental last laugh of the office, showing their colleagues, maybe a leavers party. But yet again, one thing was always on display throughout the video. The badge. And lastly, and lastly, a surprising one. The company's own videos. Corporate recruitment content. Filmed and edited in-house, pushed by

the company. It was styled in the form of day in a life videos shot by interns, but boosted and promoted by the company itself. And you'll never guess what was in every single bit of that clip? The badge. But not only the badge, but how they got in and how they got out with the badge. So, so a badge does not have to work, it just has to look right. What I was able to do was clone the artwork, recreated from the video stills alone, the layout, the font, the picture, the positioning, and the holder, and the lanyard. All it needed to do was pass the human check. Staff from reception needed a familiar card and

that was enough. People don't inspect further, they just pattern match. This then enabled my colleague to proceed with the physical assessment walk through. He was then questioned, all he did was present the badge, it looked as it was supposed to. They pattern matched, they saw the color was right, they saw the picture was right, and he was allowed in. He went in, he did everything that was required of the assessment, and he walked out with no confrontation. So, the second study and the last one, the intern problem. Nobody documents your office more thoroughly than someone proud to be in it. My first point, they have the highest motivation to post. Their first big corporate job, their

first big brand they're working on. It's a milestone. People like to post milestones. Second, lowest security context. Weeks of tenure and compressed induction and no instinct for what shouldn't be online yet. Three, they're given the full tour. They're shown around every part of the office from the server room to the break room. And all throughout this tour, they have a phone in hand. Number four, they're easy to identify and date these videos of the interns. Because interns start on a known date. They tag the employer in the videos. They tag themselves, their friends. And most importantly, they use hashtags with the company's name. Number five, they're amplified by the employer. Recruit Recruitment Marketing wants this

sort of content. It appeals to the younger audience going on TikTok, Instagram Reels. It appeals to the younger crowd. It gets promoted, but it never gets reviewed in a security point of view. And lastly, nobody off-boards the footage. The placement year ends. The video stays up for years. What you do on Monday. Ban filming is not the solution. We can't just stop filming completely. It's unforceable. You can't police every single phone in your office, personal or work. It's commercially unwelcomed. Your own recruitment team are not going to be pleased if you say no more filming. And lastly, it's counterproductive. It pushes people away and into making secret accounts and posting secretly furtively. And it just becomes even harder to find.

Teach people what to point the camera away from. A practical guidance for yourself the individual. Take your badge off or turn it around before you press record or take pictures in the office. If you need to take videos in the office, add cuts. Do not pan around the office. Check screens, whiteboards, reflections, and windows before posting. There's so many instances where something was posted and it looked safe, but in the background, in a reflection, there was sensitive content. Post after the fact, not live. Break the timing link. As we saw earlier in the clip examples, we had timings for all the events. We then built a report based on that timing. So, if possible, post

after the event to not link it to the time. And for the organizations, brief your interns and your new starters in week one, not in month six. Review marketing and recruitment content as an OSINT surface. Assume your badge work is public. Make visual identity insufficient. And lastly, reward challenging strangers, including senior ones. And lastly, four points to leave you with. Your staff are giving guided tours to your office online. Aggregation is the attack. No single clip alone is a breach. A badge that only has to look right isn't access control. And lastly, interns get the badge and the tour, give them the awareness training, too. Thank you very much.