Physical Attacks
The social engineering tactics lesson dealt with adversaries who manipulate people. This lesson names five common physical attacks and shows where social engineering carries one. It also shows what separates tailgating from piggybacking.
All five come from one example. A video game studio occupies the fourth floor of a downtown office building. The studio's front door opens only for a studio badge, so everything behind it is a restricted area. The studio hired a tester for an authorized physical penetration test, to get inside as an adversary would. The table below is the tester's report, one row per step.
| Row | When | What the tester did | What it got |
|---|---|---|---|
| 1 | Monday, 7:10 a.m. | Searched the paper-recycling toters in the building's alley. | A staff email: fire drill next Wednesday at 10:30 a.m., staff to wait across the street until the alarm stops. |
| 2 | Monday, 8:45 a.m. | In the coffee shop downstairs, watched a developer type the build server password on a laptop. | The build server password. |
| 3 | Monday, 12:20 p.m. | In the shared gym on the ground floor, read the studio badge in a jacket left on a bench with a small reader. Wrote its data to a blank card that evening. | A copy of the badge. At 7:00 p.m. it opened the studio entrance and the server room, but not the finance office. |
| 4 | Next Wednesday, 10:30 a.m. | During the fire drill, waited across the street with the staff, then walked back in a step behind employees badging through. | Got inside the studio. No employee noticed. |
| 5 | Next Friday, 9:05 a.m. | Posed as a job candidate early for a 9:30 interview. Told an employee at the studio door that reception was empty and asked to be let in. | The employee badged the tester in. |
Information from outside
The first step took place in the alley, among paper the studio had already thrown out. One sheet named the morning when every employee would leave the building and come back through its doors together.
That's dumpster diving, even though the toters were for recycling: recycling is still the studio's trash. The email paid off nine days later, when the tester came back on the date and at the time it gave.
The coffee shop was outside the studio too. The tester sat behind the developer with a view of the keyboard and spoke to no one.
The tester did it by eye, without a camera, and kept the password for a later step, as with the drill email. It's shoulder surfing all the same.
A copied badge
In the gym the badge never left the jacket. The reader picked up its data through the fabric, and the owner kept the original.
The copy carries the owner's authorization, so it got through every reader the owner's badge gets through. The finance office is closed to the owner, and it stayed closed to the copy. The build server runs in the server room, so the copied badge and the password from the coffee shop together gave the tester the room and the machine in it.
Tailgating and piggybacking
The last two steps got inside without the copied card. After the fire drill the employees badged through for themselves, and the tester walked in a step behind them without any of them noticing.
Two days later the tester told an employee a false story about an interview and an empty reception desk, and asked to be let in. The employee chose to badge the tester in.
So the two differ in what the employee knew. After the drill no employee knew the tester was there, so that's tailgating. At the interview the employee knew and chose to open the door, so that's piggybacking. A job interview isn't one of the common tactics in the box, but those are only the common ones; any story that gets an employee to open the door will do.
Where social engineering enters
The interview story is the only time the tester spoke to anyone. The other four steps needed no one's cooperation: the tester read trash, watched a keyboard, copied a card, and walked in with a crowd.
The false story is the whole of that last attack. Without it, the employee would've had no reason to badge a stranger in.