The Office of Danger: A Choose Your Own Adventure Story

hi everyone thanks for hanging around till the end of the day uh my name is Phil and this is the office of danger and choose your own adventure story um so just to sort of preface this this is a social engineering engagement social engineering if no one has done it is super stressful um so to put that into a little bit of perspective I am relatively nervous stood up here talking to you my heart rate is around 95. uh this graph shows over the two days anything that is orange means that I was above about a hundred or no above about 75. so two days of pure stress so when you're making your decisions in your head try

to be like [ __ ] if I do this wrong I might go to jail or [ __ ] if I do this wrong I might you know fail my job so like please have that inbuilt stress if you can that would be great uh yeah my Peak over the two days was 150 I mean I'm a runner my running Peaks at about 160 so I was genuine heart in my chest stuff for two whole dates so the rules this is what we're doing this is an audience based decision making game each of you should have a blue and yellow card does everybody have one this has gone well um so for each decision there'll be two

options and you choose the color that you want hold them up um and for this engage for this job that we're doing it was a two-day engagement so you've got two chances of completing the aims um and because I sort of wrote this ages ago thinking it might go to America where they do crazy stuff in the middle of the night this must be completed during office hours so that's why we're not lock picking breaking Windows climbing in at 3am uh also on your person you have a get out of jail free card so the target where are we going so it's a multi-use office in central London the client rents out half of the seventh

floor and the entirety of the eighth floor we did some ocean before we went and we found out that there are security guards on the ground floor security guards on the first floor in the reception area security gates to get to the lifts security doors to gain access to the offices and there are other users in the building including like a wework regia style shared office and we also found out the head of it and the ansemit staff names within Target organization so the scope this is what you've got to achieve over the two days is access to the seventh floor access to the eighth floor a scan of the internal Network and identify any low-hanging fruit on the

internal Network right day one before we start I'm going to call Rob up to the front please rob I need your help yeah okay so so that this is a no way biased and I don't take you down a path that I want to take you down Rob is going to be my independent adjudicator so for each question uh when you hold up your cards Rob if you can tell me which one is the majority okay and we'll go with that all right don't don't [ __ ] it up okay okay cool thank you um right the setup day one so Ocean discovered a shared office space within the building do you decide to use this is it in or

out of scope insco [Music] so you've decided that that third party office is in scope do you try and book a legitimate viewing through their head office yes or no yeah you don't need me for this one you're absolutely booking a viewing perfect you ring up head office while on the train down because you're really not that organized and they tell you that someone in the office will be in touch they do not ring back so you get down to London you made your phone call no one rang you back but you have to press on anyway so it's time to go you bypass the security on the ground floor they were super friendly and just

said receptions up there so you go up there when you get to reception they ask how can I help so do you pretend to have a booking with the third party to view the shared offices hey yes yes yep so reception Rings the reception of the third party they do not know who you are because no one has confirmed your visit you explain the whole Saga you elaborate it takes quite a few minutes and then after that they present you with a security pass and tell you to head to the fourth floor via the elevators it works you get past the first security gates this is super exciting where do you go do you go to the third party or do you

go straight up to your client

my client deceiving me client all right which of the client's flaws do you want to visit the seventh floor or the eighth floor okay 45 minutes right yeah we could go out again about eight please hey okay right we head up to the eighth floor so you exit and out of the elevators there is an access controlled door you try the door and your key card does not work so no one enters or exits during the 10 minutes you stand there looking like a right bell end do you leave or wait a bit longer I think they're leaving we're leaving yeah we're leaving you gave up you head down and you decide to go to

the pub really you have to work on this because that was not great um so this is what I did differently somewhat more successfully no so I uh similar to you I decided that the third party was definitely in scope uh I did actually ring up the head office while on the train and they did not ring me back so I had to Black it at Main reception which took more convincing than you would have thought they had quite a strict policy but I got the pass and I went up to the fourth floor and I did a tour now I did a 40-minute tour with a shared office that I had absolutely no interest

in uh it was quite useful they told me some super good stuff like there were cycling racks on the ground floor and where some of the security guards were but I tried to leave there to go to the stairs so I could then work my way up and they did not let me do that I had to go back to the lifts so I went up to the lifts and I thought I'll go to the seventh floor you know first one on my target list why not didn't really think about that didn't really think that they would have Aid their own reception I was hoping to just get to an access control door but there was reception so I walked out

they buzzed me through and we're like hi who are you I was like well [ __ ] um had a chat with them and what we might do is play the rest of this game we might do some of this again from further Buck because there's quite a cool bit around reception which lets you do decisions we've got time for this you can make this up right bear with me two seconds uh right we wrote yeah we do have another day so that's fine right this time no yeah fine true yeah yeah okay so that so last time I went to the eighth floor which was a great idea and actually should have worked but for some

reason didn't um but this time if we go to the seventh floor so you exit the elevator and it Buzz through the door by client reception looking around there's no way to avoid direct interaction with receptionists you walk as slowly as possible and try to think of a plan so you decide to be a pro you pretend to be as new starter during covid working from home and this is your first time in the office what name do you provide provides a reception a fake name or your real name

deciding folks in Europe fake name fake name the receptionist does a really good job and looks you up on teams they notice that you're in a call uh you act confused and you know it must it must be someone else maybe someone's ringing me I don't know what it is and they continued to stand there while you continue looking like a plum uh after a little while the receptionists starts to not really believe what you're saying and asks your line manager's name now you found out the head of it so this is a global insurance firm with the when I say head of it I'm in the global head of I.T do you change the conversation or give

them the name nice so you give them the name and they sort of have a look and they're still trying to find you and the receptionist asks you have you received your mug yet now out of all the questions in the world I was expecting this was not one of them uh so you kind of look at them like what are you talking about uh and then you say no they pass you a branded mug do you take it 100 free free stuff right right free stuff really to take time yeah uh yeah um so the receptionist continues to look at you quite strangely they're still looking up your boss uh while you look at your really beautiful branded mug

glass little blue band to hold it it was brilliant uh they ask you how you got to the floor and if you had a key card do you tell them someone let you up or do you show them your key card from the fourth floor

so the receptionist takes your card and states that this is not one of their cards you go well I don't flip a no it's your building um it's just what I got given but they they're really not starting to believe you at this point you remember I said 150 beats per minute heart rate this was then interacting with reception um so they start to see through your story they can't get through to the manager and ask for any other contact details do you provide the name of your contact or show you'll get out of jail free card the name of contact nice so the receptionist rings a client who appears behind you on reception they

escort you to a meeting room and you have like a nice little initial debrief heart rate goes down slightly you tell them what's happened so far and you make a plan do you suggest that you call it a day or ask for them to take you past reception past reception so your contact agrees to confidently walk you past reception see if reception says anything do you request to be left on the 7th or the eighth floor you're currently on the seventh just for memory eight so your client halfway up the stairs decides that it's not really fair to give you access to the eighth floor so they leave you halfway up the stairs so there you are you follow them up and

it's an access control door you go back down and it's an access control door but luckily for you the toilets are on the unsecured side so after five minutes someone goes through to go for a wee so you grab the door and let yourself in you're on the eighth floor you sit at a spare desk without being challenged partly thanks to your nice shiny mug that you took earlier after an hour people start leaving for the day do you stay and scan do some work or do you decide to leave with them and map away you do some you do some actual real work for the day then once you're done you head back down to the

left skater reception now again what you weren't expecting were the security gates on the way out to ask for your past and your fourth floor pass has been disabled because reception knew you weren't meant to be there so you're stuck between elevators under a speed gate do you wait for help or athletically jump the gate oh I want to see Dan Carter John Brigade you start to climb over the gate you've got your laptop you've got your coat your adrenaline's buggered uh you do not do this elegantly and security guard sees you and comes over so you have to explain the whole story your past didn't work and they escort you to the meeting room

they're really sketchy and you decide that before anything goes worse you give them your Jail letter and they escort you out the building end of day one take two um should go for another pint so um thank you for letting me do that but that's kind of the route that I took so I went up to the seventh floor spoke to reception and they gave me this mug which I've got at home which is brilliant well excited when I gave the head of it's name I thought they are never gonna ring the global head of I.T about some guy in reception she did he was on holiday oh I was so lucky so she then still didn't see through my my

whole Gambit so we ended up calling the client now she rang the client and I hear a mobile phone go off about where that door is behind me my client had been stood in reception watching the entire thing I was horrendous um but yeah we had a little chat and we thought let's walk past reception see what happens and um he actually genuinely left me on the stairs as well which what a dick did not did not like that guy so yeah we but managed to tailgate onto the eighths below you set a desk I stayed did some scams and I genuinely got stuck between the lifts unlike Diane I didn't decide to try and Vault them I

waited and a very nice lady came down and was on her way out and I was like oh my card doesn't work and she beat me through so I then legged it chucking my card sort of near the door and just legged out of the building and had a really good point ah so you then slept super badly because you're still really nervous so day two you go back in after having a chat with the client you realize that actually you've got a wework style Renton office so there's no point trying to bypass reception again because as an attacker I will just rent the office for a month get a genuine pass and be allowed in

every day so we decide that we'll get a pass from reception so that I can at least do a little bit more um however when I ring the client to kind of sort this out turns out his child was Ill so he was at home so the one person in this high security office building in central London he knew I was there wasn't there so I I then have to try and explain this to reception now reception are like who the hell are you like what what are you talking about um we end up having to call the client it goes on I think it was about an hour and a quarter of me just trying to get

past reception in a legitimate way it would have been easier to have blood dip for a second day in a row um but after I said 20 minutes here it was definitely longer but where do you head do you head you've been given a past you go towards the stairs or the elevators

gonna go up the elevator all right so your past Works you're fine you get to the elevator waiting area which floor would you go to the seventh floor or the eighth floor Heights so you sort of hover around I mean an elevator waiting area is quite a good place to loiter uh and it had a little nice little screen where people push buttons before they got to the lifts so it came up above the lift Which floor it was going to which was really handy so I stood there you sorry you're all doing this you stood there until someone pressed the eighth floor so you follow him follow them into the lift and then as the polite person you are when you

get there you let them out so that they can go and beat their card and go in however they walk out the left and then they stop and they go and they cannot find their pass they don't know where it is do you get back in the lift or do you also wait with them

[Music] so you wait you have to act along as well where's your pass you take off your backpack you kneel down you pull out your laptop you pull out your your whatever try not to show if you're a hacker no stickers allowed um and eventually they find their past and open the door you quickly bundle everything back in your bag and grab grab the door and you follow them in brilliant we're in the eighth floor back in the eighth floor should I say after doing so well on day one so where'd you go do you take a seat or do you do a lap to kind of get the layer around you do a lot

you do a laugh at your office no in the view out the window genuine view if you can't see that right at the back that is Saint Paul's and other London landmarks you crack on okay cool awkward this is being recorded no it's fine um so you you do an entire lap you stop you take a picture of the view no nobody really cares that you're there um what'd you do next you head down to the seventh floor or do you take a seat on this floor

so you find an empty seat you connect to the network uh and no one literally no one notices you after about 10 minutes you're over here A Team sat next to you discussing a person who got a pass at Main reception that didn't arrive at the office reception you you quite quickly realized that this can only be you uh and you hear that the security guards are doing a floor by four floor sweep of the building for someone do you stay where you are or do you find a meeting room to hide him hi Bill so you you kind of do another lap of the floor you really know your way around and you find an empty meeting room uh

you sit there you unplug the VoIP phone brilliant new network you can start scanning and you'll see actually in the picture the little cup that meant that I was meant to be there um this meeting room actually isn't a meeting room this is an executive's office they returned from a meeting and go who are you and I'd love to tell you the exact conversation because he said who who are you and so I looked and went hey who are you and with the door open he genuinely pointed to the name on the door and said this is me I was like right okay so you then you kind of politely make conversation and while you're doing that

do you do you try and plug the VoIP phone back in or do you just awkwardly pack up and leave

yeah so while you're leaving the office you sort of built up a bit of a report and he informs you that if you're looking for a nice meeting room to hang out in there are loads on the seventh floor that are empty so you decide this is probably the best place to go now so you exit the eighth floor and you head down to the seventh now there are two Access Control doors to access this floor because they only own half the floor so you after about 15 minutes no one has gone in or out of the first door so just to paint the picture it's a door then it's a corridor with another set of

doors so you're trying to just get through the part the first one so did you head back to the first floor knowing that you've completed your tasks up there or do you wait right for it after about 10 minutes and in these 10 minutes you sort of awkwardly walk up and down the stairs because you know there's CCTV so you're like if they glance that someone not just weirdly standing there be on your phone for a while um someone enters the seventh floor you managed to grab the door and you tailgate them in but as you follow them in they sort of slow down turn around and give you that look that you all know of

I'm about to ask you a question so do you continue to follow them or do you go the other way to the other office door

so you turn your head towards the other office door the person as it turns out was going to the office you wanted to go to so they go in but you can't you can't catch the door they didn't open it enough they were being pretty security conscious so now you're stood in a tiny vestibule you've got three doors two are locked and one takes you back to the stairs so you stand there you again make a phone call you wait against them or whatever people do in vestibules but you wait until a member of the catering staff comes through and heads towards the client door you managed to grab the door and you let yourself in the executive was

right there are multiple empty offices you sit in one and for the rest of the day you do all your scanning and literally no one notices you're there so you're done you've hit all your targets you've done your scanning you've hit both floors you've let yourself in everywhere uh you ring the client you provide a debrief over your findings throughout the two days uh the client then asks if you can debrief both receptions and just kind of make sure that everybody is aware and knows what went on this was really interesting because the person who I dealt with on the reception on day one had gone on lunch break so I said oh can I speak to so-and-so

and they were like yeah they're on their break they'll be back in like half an hour I was like right I kind of really need to speak to them so ended up sitting in their reception again for half an hour waiting for this person to kind of to come back but you debrief them and there's no issue and you're done success uh you exit the building after you've debriefed every single person and you head to the pub for what was one of the best points you've had in your life um so my day two was actually very similar to yours uh so I managed to get the pass from reception after a lot of touring and throwing with reception and

the client on the phone um I actually asked to go to the stairs so that I could then sort of tailgate my way in and they told me that you would need to be escorted by a security guard and I realized that would probably be really bad news so I ended up being like no no it's fine my my fear of lifts which is the excuse I gave I wanted to take the stairs magically fixed itself and I managed to get to the lifts um again went up to the eighth floor and the person did genuinely struggle to find their cards so I got my bag down got everything out it was it was really

awkward um yeah sat down next to the Commercial Services team and heard them discussing me as it turned out in the end they ended up ringing my client because main reception remembered that they spoke to them and he was like yeah please don't send security so I was never gonna get rumbled but for a good portion of the day I did think security were really doing a sweep of the building um so instead of sitting there next to them I did go and get a coffee and have breakfast in their breakout room um so I went into the meeting room as you did unplug the phone the executive I spoke about was the global head of Finance turns out he was

really important um he had literally nothing in his office you know like a circular table four chairs a bit like that and a phone that was it I was like how do you live like this but fine um I did not plug the phone back in I think I didn't tell anyone I completely forgot so I hope for days he actually got some work done so he didn't get interrupted um again 20 minutes waiting to tailgate someone into the seventh floor and the same the actual thing happened if the guy looked at me and I I like darted to the other door pretending to go in there and it felt forever stood in this vestibule until it was a catering

lady with a trolley so I could be super helpful holding the door for her but yeah that was really bad um but once I was in there like nobody cared at all um managed to debrief the client on both reception teams which went really well and actually the receptionist was quite receptive pun actually quite intended um about it all because they were super confused by the interaction I had with them on the first day they were like I don't understand who you were so this actually and then they just kept asking they got really fixated and if they passed or failed so for the rest of the conversation they're like but did we pass I was like I I don't really

I don't pass or fail you it's like but did we passed and in the end I was like yes why not make him feel better um so that was fine uh but what's really interesting and I don't know if people do social engineering here but I like to think of social engineering there's three zones there's like a a green zone of of outside the building which is anybody public like you're never going to be questioned for stood out for standing outside a building because anyone can stand there there's then sort of there should be the other way around actually but there should be like the yellow zone of you're at reception you kind of should be there but is the

place you're most likely to get caught then once you're past reception you're you're in people expect you to be there they trust naturally that you should you've got past the barrier so you're there people holding doors leaving lanyards leaving their computer as unlocked all because everybody there should be trusted so the further in you get actually the easier it is which is almost the opposite of of what you might think so in summary we've done all our questions thank you very much for playing um social engineering is is terrifying for anyone who does it you do have heart in your hands you are every decision you go and then you sort of question them for quite a lot of days later

um one of the other big things with it is I kind of try and I don't want to ruin anyone's day so although I'll try and trick people to let me do things I like to do it in a nice way so they feel better for meeting me because I think if you start manipulating people so that they are detrimental once you trick them or you trick them in such a way it affects their day you've it's just kind of you have that lingering and you have that feeling with you afterwards but if you're bored of anything if you do you know I sit at a computer all day I just want to go and do something see if you

can sign up for social engineering it's great fun you will I think you you'll enjoy it or you'll hate it but either way you get a day out uh sometimes it works out really well such as this one that again that was my breakfast in their breakout area nice coffee croissant and uh pull a view of St Paul's sometimes it's less nice this is an abandoned Laser Quest outside of Paris France in a shopping center that they asked me to to social engineer my way into the shopping center so like vacant shops into the management floors so I ended up trying every door and this door led to many more doors and then we ended up in a in an abandoned

Laser Quest which I I think was maybe the most terrifying thing I was either that or when they caught me and escorted me to the control room and my client wasn't there yet and I didn't speak French and they didn't speak English so I was trying to explain who I was over Google translate and they very almost rang the police that was really bad but yeah sometimes it's great sometimes maybe not yeah thank you all very much for playing I hope you enjoyed it I hope you kind of got an Insight of what type of decisions you get to make when you do social engineering and hopefully someone will give it a go off the back of this

awesome Phil thank you very much that's great um we've got some time for a couple of questions [Applause] um if anyone has any questions I'll run around with the mic if not you can either you can give your yellow cards your blue cards to Vanessa on your way out or just leave them on your chair and I will just think bad thoughts about you that's yep uh great talk again um did you have a you get out of jail free letter on you so that you've you know if if it did all go pear-shaped at least you were going to get arrested and Cat enough to upholstery or whatever yeah so I actually had two so I had one that was

inside my suit jacket and one that was in my trouser Pockets solely for if I took off my suit jacket to hang it up somewhere because you get nervous you get sweaty you get sometimes you're just like I just you've you've still got another one on you um a good friend of mine Chris Pritchard who does a lot of social engineering told me that the worst place to have it especially if you're doing an airport is in your jacket pocket because when you've got police with guns and you go in to get your letter it's really bad so yeah I have at least one I had definitely at least one in your pocket sorry uh I much prefer being able to give an

actual letter and they can then take it away whereas I don't really want them to go away with my phone so yeah hey thanks for the talk uh in a world where sort of fishing and you know Network exploits and that sort of thing result in the most ransomwares and sort of data theft what sort of place would you say um a kindly Englishman breaking into the finance managers officer fits in a company's threat model it's it's a really good question um and it very much depends on who your attacker is so if you're if you're someone who your attacker is a nation state doing this sort of thing probably isn't that beneficial because if your nation

state with time money you're just going to get someone employed and then they get a laptop and they get access um so it's much more for sort of maybe smaller people who have sensitive physical documents so maybe like an engineering firm that have printouts of designs or or that type of or maybe like you know a bank with money um that type of places where there is physical assets as opposed to getting everything digitally well hi a great talk really enjoyed it uh have you ever apart from the the lovely mug have you ever taken anything or stolen anything on one of your engagements so I no I've please admit to Crime now uh I'm trying to think like I think I

got a pen from the French uh shopping center but that was solely because I needed it and then put it in my bag just naturally I'm not I'm not really one I've someone that I did work with he made sure he does a lot of this and he liked a trophy after everyone he would ask can I please take this home whereas I got so much [ __ ] to my house I know so no I've got the mug and that's that's independent but it's not a thing that I'm bothered about um what recommendation did you give to the this client of the seventh and eight so ah so yeah really good question um so one of the big things that they

haven't thought about in their threat model was the fact that their office was in a shared unit with a like a shared office that anybody could hire um so that was sort of something they just hadn't thought about the fact that the card for that didn't work in their office they were really happy about um they were really happy that reception stopped me and did their job very diligently they were excellent um but then a lot of the things they they couldn't really do anything about so the toilets being on the unsecured side of the door they can't redesign the office that's just how it is so it was much sort of smaller things of uh

attitude towards it so is the person wearing a pass shut the door behind you make sure no one follows you through um if there's someone who looks a bit weird make sure you ask them are you meant to be here so all those sorts of things which might help might not but the fundamental issues that got me in were kind of unfixable so yeah so it was quite an interesting one um I think we then just sold them some awareness training because that's what we do is upsell um and I'm sure they were happy with that how did how did you record um what you were doing did you have like um your phone recording audio in your pocket or

camera or do you just remember it write it down later so um I phone I took quite quite a lot of photos so where I saw things like a door that was propped open that should have been shot with an access card like I'll snap a photo of that and then whenever I sat at a desk or had a little bit of downtime I'd sort of just memory drop down in a in a like a notepad um all of all of the things that I'd done and I tried to do it almost this presentation was created through the notes that I had because it was that sort of Step by Step so that I could

tell them and then sort of flagging issues I don't know what the legal side of recording all the time would be um I also wouldn't want that recording because in case not in case I do something wrong but I would I'd feel like I should watch it back and then it would be really cringy um so just not having that would be his best but yeah just little and often regular note-taking whenever you and even it um quite often in Social Engineering if you watch any of the talks they will all mention going to the toilet a lot because of getting your heart rate down trying to calm yourself down so you sit on the toilet you get

your laptop out you write down the last few things that you did uh so it was that kind of note taking one last question and then we can go to the pub yeah what kind of research do you do to try and sit in like there were targets backpacks and have HP laptops to try to get that kind of so it's a really yeah that is a really good question so um we try and do quite a lot of basin so um of the building itself so again this um shared office really helped because that had kind of a floor plan and it had it listed the security features that they were speed Gates so that was really

handy um we then um do are you sitting on like LinkedIn for the company to get names and pictures and and kind of try to get an idea of dress code from there ideally on the very first day of this engagement I spent about two hours sat over the road watching people going in and out to see because what I didn't know I knew there was Security on the ground floor but I didn't know what they did so realizing people walked in and just walked past them meant if I could confidently do that it would be fine so it's it's all those things I mean you then also think of the type of company so is it a tech

company where people are going to be wearing jeans and t-shirts or is it this was a insurance company so I knew there'd be a bit smarter now luckily I'm a very generic white looking male so I kind of fit in quite well if I put on a suit I fit in with London types um and that helps quite a lot I'm quite forgettable so people will will meet me and then 10 minutes later I'll be like who are you which is great weirdly um but yeah so it's trying to find out as much as you can and it's very rare that because I don't live in London I I didn't really want to spend a day going

down to watch the building to go back again but I know some other people won't do it without having done that um so yeah it's you try and get as a bit like any any kind of pen test or anything you try and get as much information as you can if before the day uh generic white male whose name I've forgotten thank you again for your presentation that's been awesome thank you