Ocean’s Eleven Heists In a Louvre Four World

The Gurus On Mount Tampa

Last month, I got to spend a few days cloning badges in coffee shops, taking photos of security cameras from over a hundred feet away, and bypassing locked doors to plant malware on laptops.

I was attending the Practical Physical Exploitation (opens in new tab) training course put on by Ralph May and Travis Weathers of the Mayweather Group (opens in new tab), and aside from having fun in Florida with some friends while the rest of the United States tried not to freeze to death, my goal was to understand the basics of physical intrusion enough to start slowly building it into my own services.

It wasn’t the first time I had used badge cloners or bypass tools, nor was it the first time I had to socially engineer my way into a restricted area, but I like to round out any knowledge gaps with good training before I try and accept anyone’s money.

Exhausted by the intensity but invigorated by the fun, I spent the plane ride home thinking through how I would communicate the importance of physical security to a potential customer, which reminded me of the story I opened this blog with.

There were two questions I felt I needed answers to:

1. Who do physical penetration tests help anyone defend against?

2. Why is a physical penetration test a worthwhile expenditure?

My time in Tampa helped me with part of the first answer, which was “anyone who could do any part of what we were doing”. Obviously a clone of me who had defective intent (bad bad guy) instead of cooperative intent (good bad guy) would be an obvious threat.

We can also surmise that someone more skilled than I would be a bigger threat, and someone less skilled would be a smaller threat, but skills with a lock pick set don’t matter to a brick if the door is made of glass, and why use my lock picks as anything but paper weights if I have an undisclosed 0-day for your firewalls?

The second question is harder to answer for any organization that hasn’t already dealt with physical threats and, admittedly, this wasn’t the focus of the course.

Much like when a company undergoes its first ever internal network pentest, after which they realize how much - ahem, technical liability - they’ve inherited from Active Directory’s “intended design”, it is quite difficult to just imagine the impact, especially if you’re not sure how anyone would go about making one.

“Why would anyone go after us?” the perennial question goes. Well, have you ever considered what someone looking to make some money could do with documents you leave out in the open?

Clearly, there are some margins of uncertainty to address, here. We can do thought exercises all day, but I’m here to determine if one of the best things you can do is just let someone break in.

But let’s not get ahead of ourselves.

Who Are These People Anyway?

Somewhere in between fleecing the Las Vegas strip with George Clooney and lifting candy from a convenience store are the real threats to businesses, and when it comes to which ones anyone should pay attention to - as with all things in security) - it depends.

In the end, I came up with five threat profiles that I would use for threat modeling an organization, ordered by sophistication level:

1. Petty Thieves: Opportunistic with access to basic, commercially available tooling if not just a bat they can break glass with. They’re most likely looking to make a quick buck.

2. Associated Threats: Not actual employees of an organization but still familiar presences, e.g. delivery drivers, cleaning crews, maintenance staff.

3. Insider Threats: Current and former employees of the actual business with knowledge of day-to-day operations go and what the weaknesses may be.

4. High-Capability Threats: The dark-side version of a physical pentester, with all the tooling and expertise to match. Probably the closest real-world analog to George Clooney.

5. Nation-State Actors: Highly sophisticated and well equipped members of an adversarial government looking to cause damage to or steal information from critical systems and facilities (and probably don’t need to use physical means to accomplish this very often, if at all).

If we factor in the statistics presented by Gartner in 2024 (opens in new tab), insider threats account for around 75% of security breaches, even if just by accident. While exact numbers aren’t easy to find, for the sake of discussion, let’s imagine that the graph is fairly bell-shaped:

         │
         │                    75%
    % of │                    ┌──┐
breaches │                    │  │
  caused │                    │  │
         │                    │  │
         │  ?%       ?%       │  │     ?%       ?%
         │  ┌──┐     ┌──┐     │  │     ┌──┐     ┌──┐
         └──┴──┴─────┴──┴─────┴──┴─────┴──┴─────┴──┴─
           Petty   Assoc.   Insider  Hi-Cap   Nation

Within the bounds of their 2024 report (opens in new tab), leaving out situations in which credentials were compromised by phishing (A) or other means, insider error (B) was slightly more common than insider malice (C), but only just over half as financially damaging.

Physical security issues (D) sit on the low end of breach causes, just above 9%.

As has been the case for a long time, most insider threat-caused breaches (including phishing victims) are rarely due to someone acting maliciously. However, they are certainly the most expensive.

Now, because the raw data is not available from IBM and they admit in their report that their sampling methodology was selective:

Our study drew upon a representative, nonstatistical sample of global entities. Statistical inferences, margins of error and confidence intervals can’t be applied to this data, given that our sampling methods weren’t scientific.

So, we have no idea if they incorporate physical breaches into insider threats, or if all possible insider activity falls under “physical theft or security issue”. Without the data, this could mean anything from a stolen laptop with sensitive data on it (from a company location or even just a parked car) to a badge being cloned Mr. Robot-style.

In writing this, I haven’t been able to find a statistically sound source of data on how many breaches started with an insider threat specifically letting someone piggyback through a door (error) or stealing data from their job (malice). But, for the sake of coming to some kind of useful conclusion, we don’t need impact measurements to discuss who could possibly break into a building.

To actually answer the question about who on earth we are actually protecting against with recommendations from a physical pentest, likelihood and impact aside, we should look at each of the five threat profiles I listed above and understand how we can mesh them with parts of the process.

Once again, we are trying to answer the question of who is actually doing anything like this, not how much it hurts when they do. That is a separate question for people with access to good data.

Let’s establish phases of a physical intrusion and cross-reference them with said threat profiles:

1. Reconnaissance: Learning, either from a distance or in person, what the physical security posture of a target building consists of, a.k.a. “casing the joint”.

2. Initial Access: Gaining unauthorized entry to a facility intended to house and protect assets or information.

3. Post-exploitation: Using the access gained to steal assets or establish persistence mechanisms for future use, e.g. malware on an unlocked workstation or a drop-device plugged into an ethernet port.

4. Profiteering: Making money off of the whole thing by selling stolen assets/information or extorting the organization. This is when the ethical hackers are writing reports.

In the Coverage Lies the Point

Remembering the four stages of a physical intrusion from earlier in this post, it’s time for some cross-referencing. How can we correlate phases and components of a physical intrusion assessment to the five threat profiles?

Much like network security, it helps to start from the inside and work your way out. What do the people who already have access (associated/insider threats) pose, and how can those risks be mitigated?

Post-exploitation has the answers.

Moving outward, how could someone gain access if they do not have it already (petty thieves and high-capability threats)?

Initial access tests will find out.

But what does that actually mean? Some of the more eye-opening potential, I think, lies in the sort of finding each phase can produce. Here are some examples of findings I have put in reports for actual clients:

In Summary

Ultimately, the most I or anyone else can do to effectively convey the risks of a threat actor engaging in any kind of intrusion activity is to tie real-world consequences to everyday ignorance or negligence.

Until the impact has already been made, you might not see the value of a physical security assessment until it’s too late.