Visual Badge Forgery

like to introduce Jason Kohler Jason is a native of the DFW community and he has graciously agreed to give this presentation for us today since we had a talk pull out Jason has had some engaging topics including speaking engagements previously at besides wdfw last year twice was there two two submissions right so two years in a row Jason Jason needs not much more introduction he'll give his own introduction let's give a hand for Jason Kohler [Applause] hello all right well today yes I'm Jason this is me we're gonna be talking about uh badge visual forgery today um some of you may seen this talk I've given it at uh Dallas hackers Association and a few other places

anyway here we go so who am I uh I'm Jason I went to University in north Texas along with a lot of people in here a lot of people have classes with me I'm so sorry uh let's see my research project for senior design was uh DHCP for space networks uh that was a lot of fun I've done sand security 401 504 560 and 660. so for those of you not familiar with that that's kind of intro to cyber uh basic incident handling intro to pen testing and advanced pen testing and I competed in Sans net worth Tournament of Champions uh you know what that is because I see what you're wearing uh did did you do the master's program

okay that's that's my goal is to start that next year we'll see if that actually happens um currently I work for Trinity Industries we're the badge sponsor this year I hope you enjoy the badges I thought they were different that's kind of cool there's stories behind it if you know people that were in the design process so go hunt them down and ask them questions previously I've worked at pricewaterhousecooper and Goldman Sachs uh you can find me on Twitter I mean assuming Twitter's still there tomorrow I don't know what's going on but you know whatever I'm pretty easy to find hopefully all right so what are we going to talk about today why why do you want to visually

Forge a badge what purpose does it serve you and then we're going to go into how you get a design because you know you need something to replicate if you're going to do replication and then how I do my digital mock-ups in preparation for creating the physical copy and a couple of stories of how I've done this and oh we are not doing a live demo I apologize that I did not come prepared for this I got the call about an hour ago saying hey Jason you want to fill a slot and here I am so I don't have all my toys these are slides from like I said a previous previous time I've given this talk and then we'll talk

about some more advanced stuff that I didn't do in those stories but we've got some access to some new stuff that uh makes this all way more convincing all right so let's get right into it why why would you want to um do badge forgery in short if you're doing a physical pen test a physical assessment of the security posture of an organization being able to give a visual cue an indication of hey I belong here people ask less questions when they already believe you there and the more things they can see that fit in the the fewer questions I ask so if I was to walk into a bank in shorts and a t-shirt

and flip-flops and say hey I'm actually one of your biggest clients I need to go talk to the general manager and check on your servers to make sure they're up to Snuff for this business I'm starting not a lot of people are going to buy that unless maybe I live in Silicon Valley or whatever right then I could maybe pull that off to the turtleneck thing but you got to know your targets right so in addition to addressing for your physical engagements it also helps to be able to show that you belong and so that's going to be determined by what your cover story is and how you're going in and in some cases you can actually become an

internal Authority from that organization and we'll talk about a few times where I've done that okay so how do you find a design for a badge to replicate if you're going to make a thing you got to know what you're making otherwise it's just arts and crafts which is perfectly cool but not really applicable for what we're trying to do here so a couple of ways that have worked for me on how you get a design to replicate you can just straight up ask for it you can ask the uh your your target for a copy of the batch to replicate it saves a lot of time we're going to know how to do that there's open source

intelligence for those who don't know what that is it's basically Fancy Google ways to find things online to go replicate and then you can show up on site and maybe catch someone with a with a picture of their badge so let's go into some examples of that asking for it obviously the easiest way to get a copy of a badge to replicate um hit and miss on the success rate but like if you can get it makes it so much easier the um the the best times to be doing that is during your scoping call for the engagement or during a statement of work negotiations basically you can sell this to your client that you're doing the

Target that you that you're doing the physical assessment for is hey I could spend a week and get anything I could get so many great pictures hanging out I could probably you know buy a copy online you know all this stuff right but that's going to take time for me and time for me means dollars for you so I can save you how many thousands of dollars if we just do this up front let's just assume that I'm gonna get what I'm after because it's pretty simple right there's other ways for me to do this it's gonna happen if I really want to but how much time do you want to pay me to go do the thing I've

had really good success with with selling it like that about any order of 80 to 90 the success rate with that generally whoever I'm working with building the contract writing out the statement work they're usually just straight up say yeah sure we'll send you a picture with like redacted information and whatnot that kind of thing I've not had any problems there so give it a try saves you some time saves some effort and it can lead to a better quality starting image for your badge the other options are open source intelligent commonly referred to as ozent lots of ways you can do this do searches for First Day badge ID that kind of thing a lot of

people still don't understand how sensitive those those badges can be and they get excited and they post pictures of their badge on their first day part of that goes into Education and Training your users part of that goes into the risk tolerance of the organization so some organizations that I've been at they've got full i-class RFID batteries that you have to badge into the building and badge out of the building and it's single individuals there's no way you can tailgate through that and they have physical security guards watching you do this so there's there's really no way to um to sneak through that way so sometimes that's the risk acceptance a company will take other times not so much

there's other companies where it's literally you're just wearing your visual indication and there's no physical blocking to get into the into the structure place to look Twitter well previously we'll see how that goes Instagram and definitely Google I found Google's actually worked really well for me if I don't find something on Twitter or Instagram I found a couple instances where a blog or a new site will have a picture of somebody with their badge hanging out and I can get a pretty good replica from that all right let's talk a little bit more about ocent so 2020 recently happened and that means the the the every decade census and uh the U.S census put out this

lovely YouTube video about how to identify a census agent to know that you can trust them yes really and these are the three examples if they said what to look for we've got a bag that says U.S census we got a laptop with a fancy sticker on it and here's what our ID cards look like well as a resident of yeah as a resident of whatever address that said census agent is coming to validate probably doesn't have an RFID reader with a connection back to the U.S census or Census Bureau to validate any RFID and all you've got is Visual and you've just shown the whole world what this looks like and let's be real

that is not a complicated design to to replicate that's that's pretty straightforward we've got a couple of uh seals from the organization which are probably a Google or two away to get those images um we've got an individual's face shot there I can slap mine on there pretty easy uh effective dates maybe I run off three or four copies with different dates just depending on what I'm doing right so this would be pretty trivial to replicate right you can you can see all this there's nothing crazy there's no holographs going on here there's no tamper evident tamper resistant features here this is pretty straightforward right uh a little more detail right so if I want to go look the part in addition to

having the ID badge I can whip up a bag that screams U.S census I have not done the research to determine what type of laptop that is but if I had to guess that's a Dell just just looking at it quickly probably not hard to go find one of those somewhere eBay wherever obviously you know the time has passed and being with Census Bureau employee is probably not going to get me anywhere but you know hey maybe they do the same thing in 2030 right there's a couple instance other instances where I've seen high profile organizations that are sending people out to people's homes and businesses publish this kind of information of how to tell it's actually us and the how to

tell it's actually us is pretty easy to spoof then there's the other option of you know instead of doing your own oscent you go you look at other experts like here's one a slide from deviant ulm's talk I'll let myself in the second version and he's got this lovely slide with a bunch of different badges that he makes for himself on how to get in in this case they're vendor badges right so you show up any structure that's probably more than three stories has an elevator probably so that Otis Elevator technician will probably get you into most of those everyone's got internet right so we've got Comcast Time Warner Cable and any of those you just find out who

the who the service providers are in that area it's pretty easy to get in there and then there's other options here uh he's got some Media stuff you know just go play have fun right um printer servicing could be interesting if you're the guy from HP here to service the printers that has potential but all sorts of options you can depending on what your cover is from where you're going in all right for photography I've never had to try this I know people who have done this but I've never been in a situation where I couldn't get my design other ways but from those I've talked to there's lots of ways to do this basically you get yourself a nice camera

I had one person pose as a member of the student newspaper for whatever University he was trying to get into and interview people specifically that were their badges up high and asked to get their pitcher for the uh for the school newspaper and in the process of taking some nice you know headshots get a nice zoom in on the badge right super easy to do that pick your target get your cover story easy enough right other places to look public spaces in the buildings where your target is so especially in a lot of multi-tenant Office Buildings where you have a bunch of different businesses nothing stopping you from hanging out in the library depending on how the access

control is there's nothing stopping you from riding the elevator up and down um elevators of public space right because it goes to multiple companies then there's no way to tell who's who and where yeah tram system going to and from buses yeah lots of options right um coffee shops nearby across the street is there a favorite spot these people hang out where do all the teams from that company go for happy hour afterwards probably somewhere nearby yeah

yes

exactly exactly and then then there's the thing like right there after your friends you bring your badge and you try and badge in ah my badge isn't working dude can you hold can you get me in yeah or I left it at my desk yeah right I'm new that's why you don't know me so lots of options there for uh where you can go to get that photography for that sample image once you have your sample image I do a digital mock-up because you know it's easier than the old school of literally cutting and pasting things right we live in 2022. let's you know let's use these fancy newfangled machines we hit call computers my tool of choice is Microsoft Publisher

so what I will do is um these are the dimensions of your standard card size so you create a new page in the template system for these dimensions and that should fit any regular card size I have yet to come across an organization that uses a non-standard card size I'm sure they're out there just hasn't happened to me yet from there you import the picture of your badge and then I like to set it as transparent so I can see the image behind um or the the page template behind the image what yes right and so then I can align the corners of my badge with the corners of the page uh from there I'll kind of crop

it down whatever reset the transparency back to full because I want the image to be as opaque as regular is and then I start dragging in the elements for my badge on top of it I'll set those to be like a half transparency so I can see where the overlap is and drop things in here I am the type that will try every font that looks remotely close just to get the closest one there is I'm just super determined like that not always necessary you can go with good enough I'm just you know persistent like that um not Advanced definitely persistent maybe a threat depends on how much you pay me um let's see from there oh yeah come on

image okay so logos super easy to find right every company has a fantastic marketing division a PR department who publishes high-res logos with transparent backgrounds and PNG super easy to get logos the the places where I've had the most challenges are extra graphical elements so if you look at uh I don't know default credit cards from Banks uh a lot of badges have like extra swirly bits and there's like some artistic flourishes in there and me with my background and computer stuff uh specifically the you know the engineering side I don't know what all those things are called so I don't know what term to Google for uh whatever flourish or whatever graphical element that I'm looking for so what I've done

is I got some friends who are graphic designers and graphic artists and I will go to them and I say hey here's a cropped version of the thing I'm looking for what would I call this how do I go find one of these and they'll say oh try looking for this thing and I'll find something that looks just about perfect that's worked really well um I should also specify I do that so that I'm not making a copy of a copy it looks a little more crisp that way but you could probably get away with using your photo of the badge for a lot of that some of these badges have face shots just take note of what backgrounds

they're using is it just some random face shot at some random wall or do they have those fancy blue screen background things and just try and replicate that as best you can drop it in there when it comes to trying to turn this digital mock-up into a physical replica what you're going to do is take it and go print it out take note of where you're printing the self-services make it easier but I've had situations where especially in the smaller towns sometimes it depends on what's around right I've been sometimes we're in the middle of nowhere and it's hard to get that to take it a step further in those small towns where I'm in the middle of

nowhere I've had things say hey I notice you're printing whatever logo do you know whoever whoever because we need to get permission from some of them like that's pretty cool that they took that extra step to speak with the people at the printing places to to know that the logos run there's ways around that right bring your own printer whatever go to the next town over all sorts of options uh we had a question

they're what clone the carts places

Lowe's like a hardware store

rfids yeah fobs I never thought about that you're right so I know they do like for car keys and stuff that makes sense I had never considered okay I know what I'm doing this week that's really cool like I've always you know absolutely copy your house key whatever mag strip could be cool but like a lot of the fobs do the RFID thing right and so if they're cloning fobs that's what that is but we'll talk about that we'll talk about fobs I'll touch in the advanced section and uh does anyone know what this this little guy is these new flipper zeros who's who's is stuck in uh shipping and Customs still yeah it's the worst sorry

guys I know um where were we cloning cloning anyway okay yeah so I have to try the fob thing and see if it works because some some of our I'm currently studying how to clone RFID Badges and some of them have certain encryption bits behind them and it's not as simple as just popping it you're gonna do some do some stuff uh Rector is that is that in agreement or or

yeah yeah there's some extra steps for that depending on what card system you're using but that is something I'm in the middle of learning and not an authority on so we're not going to talk about that right now okay so physicals um I start with gift cards I like gift cards that kind of have a white uh as much white to them as possible so Starbucks has worked well for me um trying to think where else you can just straight up buy these on Amazon too just buy blank yeah yeah and to take a separate like if you know what RFID style they're using you can just go buy a bunch of those or blanks they're not that expensive and

they'll come out perfectly white uh so I'll print out the thing like on a physical printer like an old school you know HP brother whatever um and then I usually use double-sided sticky tape to stick it on there and what I've found is after I made a couple of these the fewer connections you have between the tape the better it tends to look so running the tape lengthwise across the card since teams seems to work better and so I'll just slap the card on the table and I'll like overlay it and then I'll go in with like an X-Acto Knife and trim the excess and that seems to work really well and then slap on your

printed dealio trim off the extra paper works pretty well and then I'll usually take an adhesive laminate of some kind and slap it on the front so it looks kind of glossy looks as if it was printed and I've gotten to a lot of places doing just that on the sticky tape it's better to have gaps between your tape than it is to have overlap it just looks better that way I don't have a good answer for why let's just yeah okay so how I've used this story time right um where are we in time oh we got plenty of time we might even be early let's see uh three main places that I've used this uh had an educational uh

facility that I was asked to go do an assessment on so I wrote up a set of malware on a USB stick and kind of titled it to make it look like a Microsoft update kind of titled it KB number and picked a random article something that no one else would know but if anyone's the least bit technical they'd be like oh yeah that's a that's a KB article we're good um basically all it really did was capture the IP address the MAC address who is logged in what their permissions were that kind of thing I went to this educational place um with my little badge on a lanyard that said I was Jason from it oh that's

another thing um whenever I'm doing these I found it's best if you only tell two lies and that is who I actually work for and what I'm actually doing and everything else you get the real Jason just because it's it's way easier to uh it's hard to remember lies and I'm just not good at it at all so that just makes it easier for me um yeah actually once I got in uh I actually spent like half hour just chatting with one someone in their office about my life story and it was it was it was it was hilarious I had a good time I kind of feel bad about it but oh well um so anyway yeah so I walk in and the

first person you see when you walk into one of those things right is the the admin person who's there you know the gatekeeper right because how do you get through to Authority you go through the admin person and I basically just spent 30 minutes chatting with this this admin person saying hey I'm Jason I'm the new IT guy um you know just started you know first day they said I gotta go do this thing uh made friends with this person enough that they walked me around the the whole building office to office saying hey this is Jason from it he's got an update for your computer and it worked really well um yeah definitely make friends with the

admin people because they are always the source of all true power in any organization those of you who've worked in organizations of any size know exactly what I'm talking about if you want to get anything done you make friends with that person um so yeah that worked really well had a good time uh uh basically got everyone because now I no longer need to poses The Authority I have the authority introducing me to everyone and then I look legit because I got my badge too um so that worked really well until I got to HR and my issue with HR was not that they didn't buy my story at all well not entirely there was a whole thing of like oh wow

we never saw your application come through when did you start how did this happen did you bring your voided check do you have your W-2 no I didn't think that far ahead um so me being the new employee and I've done any of your traditional new employee stuff was you know obviously surprising to HR I managed to string them along for about an hour before they tried to look me up in their system and then when we looked at me up in their backup system and that was when it all fell apart but I I was very proud of how far I got with that so short answer is just leave HR Alone um that worked that went pretty well

um at that point that's when the admin lady figured out oh this is not legit and she went back to her desk and did her thing and I just kept going um you know you pull up the letter from the the CSO saying hey this is Jason he's doing a thing you know if you catch him call me to verify but leave him alone let him do his stuff um yeah so it kept going basically got the rest of the building um until I got to Legal and then head of legal head of legal looks at me and says aha who do you work for again and I gave him the name of like the person I found on

LinkedIn right and uh he's like okay let me call him real quick and he gets out of his phone and starts dialing numbers and like no that's okay I got his number right here for you let me let me just you know because he obviously knew the right number the number I had was for my manager back home wherever that was and he was supposed to pose as the manager for me um and he the the head of legal looked at me is like oh okay all right let's try this and he dials a number just to see what happens he I was already made it was too late I was the point I was

just how far could I String it along uh dials the manager manager forgot that I was doing that that day so answered with his actual name my manager actually answered with his actual name um uh lawyer played along and said oh hello the name he was expecting right and it was it was it was pretty funny I had a good time eventually we pulled out the letter he called the actual guy validated whatever all that stuff turns out he was good friends with the actual CSO and so you know knew that voice sounded nothing like his friend uh we had a good time turns out his spouse does the same thing so he knew exactly

what to look for when I walked in gotta watch out for that so sometimes it happens yeah

oh the ones that knew the ones that found me like the two HR people and the one legal out of 500-ish people no no um none of that uh Carey how are we on time do Mega deal 5 30 or when do I stop 520. okay good to know fantastic thank you where were we yes um yeah no just those two people and then once they actually talked to the CSO from the letter that I had my get out of jail free card they were basically like oh okay go do your thing have fun uh actually fun story uh because the next step of this engagement was a Wi-Fi assessment that I was just not getting any traffic on because you

got to capture traffic so you can crack that and get that get get the password and all that stuff uh to the Wi-Fi I was not getting any traffic and I tried like five or six places on campus and I could not get anyone connected to that Wi-Fi to capture the traffic and so as I was kind of wandering around stop by and talked with my HR people who were my friends now because I make friends everywhere and they're like oh yeah that's been broken for months no one uses that Wi-Fi so there's nothing to test because like there's no traffic to encrypt and that was a mess it was a mess um anyway so that was that I eventually

got to the the pro host and the dean and their admins and got all their stuff Dean actually put in her password for me it was it was a good time so that was a municipal uh the the educational facility I did a municipal was a little more fun it was a police station and so um yeah I was going into a building where most of them most of the employees were armed and you know that so I kind of made sure like look here's the deal I will do this but police chief gets a letter saying this is Jason here's his picture this is who he actually works for this is what he's actually doing this is the cover

store he's coming with and these are his targets and you know all that goodness so he knows exactly what's going and this goes to the Chiefs number two and I get a letter signed by the chief and his number two saying this is what I'm doing so if I almost if I get something pointed at me I can say and check my back pocket please I'm not moving um wasn't necessary walked in made friends with the admin person they were cool not cool enough to walk me around and you know introduce me to everyone but still cool um got a bunch of the officers and hey Jason from municipality they sent me down to run this update uh police don't

know Municipal I.T how are they going to know if it's my first day or not I was just Jason from it ran my stuff um everybody was a local admin that was cool so the things I could have done anyway so made a bunch of friends gave people my phone number you know did my thing went to lunch I'm at lunch in my car Sweating Bullets like oh I didn't get shot yet thank goodness oh I was I was terrified um couldn't eat I was too scared uh get a text saying hey Jason this is uh so and so uh new new shift came on and they all need your update I'm like fantastic let's go

so now I had other officers introducing me to the next shift and doing things um eventually got into the command center with all the cameras and the the feed and everything that was a fun selfie um can't share that obviously because it's all their cameras uh I helped a bunch of people figure out the new time card system because I'm the IT guy and I'm supposed to know how that works I'd never seen it before in my life got all that fixed for them don't know how that happened but you know whatever got a radio got the keys to the squad cars ran out of time and couldn't steal a squad car unfortunately it was like I

had 30 minutes I um I had a pretty broad scope I was told to do whatever I could yes

uh there were none of those at this particular facility uh but that's a really good question I did not even anticipate that yeah yeah dfr dfir well actually actual forensics would definitely be yeah that makes a lot of sense nope did not run across any of them at this location but uh I'll keep that in mind for next time uh yeah so I had only a few minutes left by the time I got the squad car keys and I kind of had like higher impact like that would have been fun to like drive away with sirens and lights going that's that would be obviously high impact but like not actual not of actual value value does that make

sense um as cool as that would be so at that point I had like just barely enough time so I walked into the chief's office because I got nothing better to do I already got everyone else and clean desk except for this one paper on it and you know what that paper was there was a letter saying here's Jason he's coming that I insisted he have um so I walk up and I'm like oh let's see what happens like hey I'm Jason from it I got an update for your computer so your internet keeps working when Microsoft changes the duty yeah next week and you know changes the network protocol and TCP and DHCP and yada yada

and he says he looks at me and says aha and I'm sitting here with my nice little badge on my lanyard saying you know whatever municipal City I was working for he says can I see your ID please I'm like hey here you go and he's like no no your actual ID and I'm like oh okay the driver's license here you go and that goes back to two lies only two lies ever who I actually work for and what I'm actually doing so my employee badge had my actual name and so it matched my ID um he was still a little skeptical but he said okay can I see can I see your update not give him the stick and he

plugs it in and he runs it himself and bingo bango I'm like thank you sir have a nice day you should be good to go if you have any questions give us a call we'll be back out and take care of you and I walk out the door leave his office Sweating Bullets again uh walk down the hall out the front door and he pops out of his office with his little little paper with my name on it and he says hey hey is this you and I'm like yes sir thank you very much have a nice day and I was gone as fast as I possibly could uh how are we in time oh yeah we got

time for last time okay energy um this one was this one was a fun one they were really well locked down so um I had uh heard through the grapevine that they had just recently put in a bunch of cubicles and run electrical for that recently so I went to Home Depot and bought myself a high Vis vest and a hard hat and some electrical testy tools and said hi I'm Jason I'm here from whatever I think I said I think I said it was from the city again here to to do the inspection to validate your electrical to make sure it doesn't burn the building down and uh this one this facility was really

interesting because the elevators come up and they go to what's essentially public hallways and then their office was split between the two sides and so you had to you had authenticating through the doors to get both sides they had this really cool way to access the doors and it wasn't the RFID badge they had these scramble pads and so they're basically the the number pad where you punch in the numbers right what you do is you punch the number to turn it on and the LED lights for the badge show the lights and so because they have that they can now put them in different positions every time and so you can't watch from the side to see

which angle they're pushing and get their number because they have the um privacy screen right so you can only see it if you're in front of it you just see them pushing buttons and if they do the same code five seconds later it's going to be a different pattern I thought that was the coolest thing I've never yeah right yes I've I've never seen that anywhere else just that one place I thought it was the coolest thing um yes exactly right so the UV powder right where you sprinkle it on there and you look for the finger useless but uh I I digress so I thought it was really cool um anyway so I get into admin they

actually badge you they they camera and you have to call in to get in from the lobby to the admins there's not even anyone out there weirdest thing never seen that before either and I said hey Jason I'm here to check your wiring make sure you don't burn the place down and you know get you signed off and uh admin looked at me and said uh okay let me let me call someone for you so I'm like okay I have no idea it's coming now so we'll see um they told me that they had actually already had that done so that didn't work so it turns out at that point the USB sticks I had dropped in the in the

public bathrooms and the parking lots had already freaked everyone out and they were already on high alert which is why they were doing the call someone thing so didn't work they caught me um even funnier like I hadn't even pulled out my employee I bet I had made my plan was once I get in then I changed into my professional clothes you know do the whole take off the hive is and like now I'm in a button-down and stuff uh and then I've got an employee badge turns out that would have spoiled it anyway because their badge reader had broken years ago so even though I found a copy online if I'd been walking around

with a with a new employee badge they'd be like where did you get that it wasn't even the old logo it was their badge reader just their badge printer didn't work for the longest time since they weren't making new batteries so mostly employees didn't even have badges I think that's a fantastic question I never even got that far I don't know what they're using for employee ID okay anyway so that's that we got 10 minutes let's uh hit some more stuff Advanced Techniques okay so you can actually just straight up go buy badge printers and not do the the paper print adhesive what you just go buy one of those and print they're a little more

expensive but if you're doing any kind of volume of this it may be worth it you're probably gonna going to get a higher quality print on the badge because it's built for that there's a DPI limit on the on the traditional printers can have issues we talked a little bit about what I've been studying with RFID and hid Badges and how those work we've got these new ponagachi things where you can clone cards I've already got my Makerspace card cloned in here obviously I can show you but you know come see me later I'll show you how to do it it's pretty neat and then there's that cool proxmark tool which will let you do the reading

the decrypting the analysis and then writing and emulating badges really cool stuff I'm just absolutely fascinated by that and I wish I had more time to play with it but I intend to incorporate that in my next physical assessment um given that we're recording I'm not going to talk about that at all because uh yes oh right now I'm using the three I think didn't the four just just come out or is it about to come out or am I making stuff up huh been released okay cool I may have to see if I get my hands on that uh let's see what we got next oh okay questions and this is me if you want to

get in touch yes yes oh um depends so sometimes it's just a um the thing that looks like a Microsoft update and then writes to a log file based on the data it grabs sometimes as a phone home you can do that in Metasploit it's fairly straightforward where you can set up a server to phone home to and then a nice little you drop it in a macro and call it you know salaries or something resumes whatever there's lots of options for that but typically I just write something that writes to a log file on the USB stick just kind of to prove I was there type thing but uh and it also depends on the

scope of your engagement right so if the scope allows for it you can put the phone home whatever it is on there and and have it you're right yeah so it calls home downloads malware and now you have access from remote and if you've got kind of a blended operation now you can have a pen tester sitting on the back who didn't come on the on the thing and they can actually start breaking into stuff and now you can demonstrate the uh the chain of like hey we went from this guy got in the door to now we're in your Mainframe we didn't even you know get to your your server what's up

yeah yes I haven't it's more of a can I get to the place type thing can I run a thing on this computer um I have not done a whole lot of looking for paper things uh it's just kind of a more of a proof of concept can I do this I'll be honest physicals are not common most places are going to want a network pen test or a web app pen test something like that it's uncommon for an organization to budget the money for a physical assessment so I've only done a handful of them and that's just kind of they don't come come around very often so hit and miss yes

um

oh no I've never done anything quite that advanced um it's usually pretty sufficient to show them the log file saying hey I got 523 people today you know this is what we could have done with that because they're all local admins you know but uh I I've not actually gotten that far and it goes back to the limit of scope for the physicals I'll be honest I'm very lucky if I get eight hours on site a lot of these are like four hours on site with some prep work so there's not a lot of time to go do a lot of play all right any other questions anything from the Discord or are we on Discord I don't even know

okay well cool if there's no more questions I guess that's it for me [Applause]