[57] The Power of Pretext
HTML-код
- Опубликовано: 8 дек 2020
- In this video we discuss pretext and I'll share with you a story which analyzes how the brain makes conclusions based on information provided to it.
CGI Snake by Chris Zabriskie is licensed under a Creative Commons Attribution 4.0 license. creativecommons.org/licenses/...
Source: chriszabriskie.com/divider/
Artist: chriszabriskie.com/
![[59] The Most Important Lesson for Physical Red Teams](http://i.ytimg.com/vi/RwsGtZbPlEg/mqdefault.jpg)
![[59] The Most Important Lesson for Physical Red Teams](/img/tr.png)
![[60] I was Hired to Legally Break into a Company](http://i.ytimg.com/vi/4pD3AYYKbZg/mqdefault.jpg)
![[64] Goal-Based Social Engineering Pretexts](http://i.ytimg.com/vi/dBXT41p21ZA/mqdefault.jpg)
![[58] The Red Team Tactics of Among Us](/img/1.gif)
here for the Morse Rickroll. :-)
Here for your comment
The #1 most successful penetration tester, shows up everywhere: Rick Astley.
where is it in the video?
@@PoojaryPawan 1:24
One of the most underrated channels ever. But most gems are hidden on RUclips.
Recently, I had to go to court as a defendant (minor infraction) so I wore a suite and tie. Most people were wearing casual clothing. I noticed that the court officers at the front door were letting people in suites through the checkpoint without having to pull everything out of their pockets or setting down their briefcases. I figured they worked there, maybe the DA or a prosecutor. When I got to the front they just waved me through. I had never been to this court and did not know anyone there, but they treated me different since I was dressed nice and looked like a lawyer. These are trained Sheriffs. Also, the charges were dropped.
Had that happen to me as well
If the working culture is like that - "we don't want to, or expected to bother the 'important suits' to much, so we will just let them walk through" - faults are easily made.
Only a [mentally] strong employee who follows the standard operating procedures instead or following the others like a sheep, will be honest enough to questioning himself and the people who wants access.
At least that's my personal experience having worked in similar 'high(er) security' facilities.
I just came off a social engineering engagement for a bank. I dressed up as their security services vendor (alarms, door access control systems, etc). I printed a fake ID badge, carried a badge cloner, and held a metal clipboard with random papers on top. Walked right in, headed towards the front desk, and told the guy sitting there I was doing a routine diagnostics check on exterior badge readers for our clients and for some reason my test badge wasn't working. Guy signed me in, using only my fake badge as ID, and then handed me a badge intended for auditors. I took the badge, went back outside, cloned it, and gave it back to him. Now I have full access to the bank.
Pose as a disabled customer.
Pair of well used crutches, maybe with some scuffed up handlebar tape or racket grip tape to increase the used daily look. Pay attention to the rubber feet on the crutches. Scuff them up a bit to make them look worn in. The crutches should look well used not tatty. Then normal smart casual clothing. Put a small stone in the shoe of your 'bad' leg so you don't forget which one is disabled. Unless you can manage to fake a disability with both legs.
Don't use a cast or brace, this may hamper your movement should you need to move hastily or dump the disguise quickly. Also a disabled person will hardly notice they are wearing a brace. You will stand out as you'll subconsciously touch it as it's new and uncomfortable.
Now enter the bank. If they employ metal detectors, your crutches can contain plenty of tools. If you are trying to enter a facility that doesn't normally accept members of the public. Tell the guard you are having a job interview later in the week or next, but have come to check out the place to see if the building is accessible and see if you need to allow extra time to get to the interview office. Whilst chatting, mention that you have an embarrassing problem and need to use a bathroom, quite urgently. From my own experience a lot of people get flustered when a disabled person is having difficulty and will bend rules to accommodate them. The secret is not to demand or appear entitled, but be as apologetic and thankful as possible. Apologise for making a fuss or taking up their time. Tell the person you get to help you that you really appreciate their help.
One last thing when employing a disabled person disguise, less is more. Don't ham it up and don't give your disguise an elaborate affliction. It's more for you to forget or get wrong. Also as a disabled person myself, we can spot a fake because they mostly try too hard.
Yep. Most disabled people try to act *less* disabled than a person who doesn't deal with common issues. For example, someone who was born (or has chronic) feet issues that require them to use crutches, a cane or something similar is more likely to try to open a door themselves than ask for help compared to someone who had a recent accident and has a temporary but similar issue that requires they use crutches. Now, the person who isn't permanently disabled might try to get a door and fail and then ask for help, the disabled person is likely to have a strategy they will employ *before* they get to the door.
As such, if you want to play this disguise, practice doing simple things like opening doors *before* you run into anyone. You should be able to at least at some degree, move like you are disabled.
Wrong. Crutches are aluminum and slip past metal detectors. Know tbis first hand, as someone who "consitantly" has leg injuries.
As a disabled person, I would also advise that if you use the pebble-in-the-shoe trick, don't choose one that will actually slow you down if you have to run--and don't give too many details while chatting. Many of us share fewer details because we know that too many will make most people uncomfortable.
Sounds like the usual suspects!!
Ted Bundy’s MO
Ok, one guy that seems to show up everywhere is an exterminator. Older clothes, ball cap, maybe a logo work shirt, gloves, carry a sprayer, a flashlight. You should be able to poke into electrical/wiring closets, workspaces, storage areas, etc without anyone paying too much attention. Those darn roaches and spiders can be anywhere, you know? Not every building has an elevator, but they all have bugs. When computer or network repair folks show up at our building, the IT department gets called to come escort them. Elevator repair, electricians, plumbers get to meet our facilities manager. I don't think anyone gets a call when the exterminator comes in. He sprays, does whatever else, and then heads on to the next job. But he can be pretty much anywhere without raising suspicion.
Great cover story! I think I could keep it up right up until I see a spider, then my cover is blown 😂
@@amihirata Oh yeah! They would know that I was a fake when I screamed and ran!
The legendary Geoffrey Pyke (creator of Pykerete and the 'ice boat' - see mythbusters on how not to do it.) wasn't just an engineering genius on par with James Bond's 'Q', he was also a keen observer of human behaviour. When challenged a British army officer (who'd questioned the point of their department) that he and his fellow boffins could infiltrate a facility guarded by the officers commandoes. Pyke and his boffins engineered a light compressed gas mortar gun that could silently fire smoke bombs into the facility, arrived at the gate of the facility in a 'borrowed' fire engine with all the bells ringing. When challenged they said they were there to respond to a call out. When the gate sentry said 'What fucking fire?' they pointed over his shoulder and said "probably the one making that smoke" and got waved through.
Pyke also got the German Luftwaffe to avoid bombing a strategically important building by painting "Bomb me!" on the roof. Luftwaffe pilots who'd been shot down on raids in the area had seen the sign and thought "Nah.... too obvious. Nice try Tommy!" and deliberately avoided the building as strategically unimportant.
also thank you for the cameo! 🪒
Just as I read this your smiling face pops up in the top right corner of the screen.
A simple local data service badge on a lanyard around my neck. Maybe even the vest but tucked in a back pocket, hanging out. I spent 2 yrs as a fiber engineer (think less servers and more building a multimile long cable network) we often went into locations with little pretense and the only explanation we gave was pricing a bandwidth upgrade. I was never asked twice
everyone needs the internet. It is kind of like you are here to repair water but that you are pricing, that is hard to verify, other than ‘feel free to look around’ (that a security guard will dismiss you as fast as you explained that one simple title).
I've never done anything like this, but if I had to plan something like slipping into a bank, I'd probably do it under the pretext of an HVAC guy. The disguise isn't hard and at the start of a call is usually clean. You don't even need a hi-vis, just a vague jacket or shirt with company logo, maybe a windbreaker so that you're easy to clean off at the end of a dusty job. Plain baseball hat with company logo, a proper N95 or better mask, a good pair of boots and some work gloves, and a convenient toolbox with which to carry and stuff you might need, even if it's a tad bulky/clumsy. As a bonus, you might even be able to hide some longer tools in plain sight, since you'll be expected to have something to slide ceiling panels back into place with. Furthermore, being an HVAC guy means that you don't really have to know a whole lot, just fake poking around wherever you see an air vent near where you want to go.
As someone who was just working as construction inspection the helmet colors threw me for a bit of a loop - on my project/area white helmets are supervisors while orange helmets are labors. But everything else is very true and similar to what I have observed (well with the exception of the RE on my job who had a stained and torn up vest).
For me I had a carbon fibre helmet, same with my buddy, and the Foreman's would have any colour helmet but most importantly red vests. Everybody else had orange or yellow vests.
I think an internet networking technician would work well for the bank. If you connect to the guest wifi and run a speed test you can see who their internet provider is. Can easily deauthenticate the wifi without even loging onto it by flooding the router with packets. Show up posing as a network technician and bam.
5:07 Heard that this man has an degree in every field.
Go in a suit and tie as a Insurance adjuster to get a Tour and told all security features.
I cant tell if you are a genius or this is too memorable. That the person giving you the tour will want too much information about you. Verifying you are scheduled and your name matches some database.
I always had this kind of observation with movies when the wardrobe people messed up so to speak!
It bugged me a lot when things just did fit, like that guy in with a dirty vest while being all dressed up.
Uber eats bag, portable strip reader. Dressed like I just got kicked out by my wife.
HVAC tech. Jeans, work shirt, work belt with various tools, "ID" badge with my picture in a pocket holder. Gotta check out those air handlers, you know. Got a complaint about black mold and lemme tella ya, you don't what that stuff floatin' around the office, nosiree, so if you could just show me to the air closet I'll get right to work, sir/ma'am. Won't even know I'm here.
That's pure gold, definitely got me. Well played w the Mores roll
Got me too even though I had to look it up!!
Dress the part ,act like you belong & you can go almost anywhere.
Clipboard, polo shirt, Badge that says AT&T or CISCO or similar. I am here to check your systems there have been some issues reported.
A good response, in combination with this I'd do some recon of their linked in employees so I could answer questions like:
"Great, I'll get you checked in, what was your appointment number and point of contact?"
Mine would be perform recon of bank until I know who services the AC.. During night, snip an AC line to degas the system. Morning comes and they find AC not working. They call for AC service. I pose as AC tech (I've serviced refrigeration stuff, I know the lingo and the fix).
yes but know who the ISP is; if you want to show up at an organisation who doesnt have an AT&T, someone likely will question why AT&T is so deep in their building.
Like no one remembers who is their normal HVAC or elevator tech but a more senior member or tech geek will know the ISP.
This video brought me back to my time in the infantry and training on reconnaissance. Why things are seen.
It reminded me of some of the trainings I've done about 'spotting', 'early threat recognition' and similar anti-terrorism courses. It was quite interesting but for the most part it was all about using your brain, senses and logics.
When something or someone stands out a bit, it was worth a quick examination or conversation; "asking for attention is getting attention".
Took the time to memorize Morse during the lockdown (because what else am I gonna do?)... and then you do this to me. 😂
For the bank job ;) I'd be the janitor. Simple. Clean. Covert :D
I love the pun you have there
90% of the time these camera guys are just getting b roll. You’re fist assumption was most likely correct but your personal experience caused you to have a different belief so conceptually it’s still the same
broll ?
@@xl000 b roll - B-roll, B roll, B-reel or B reel is supplemental or alternative footage intercut with the main shot.
exactly. I was thinking it was the tripod and size of camera that would place who is using what. Are they likely to drive around and move short distances from their van to place the hefty tripod? Or are they an artist that needs the lightest and most portable tripod.
Usually you can tell by knowing the rough price, wear and mass, who the tripod belongs to.
@@dragade101 Exactly! Just by knowing a little bit of the most commonly used gear will let you determine what you're possibly dealing with.
Years ago a television news show tried to get a certain reaction by placing a fake bomb at my place of work. As soon as I saw the potentially explosive (suit)case, I 'knew' it wasn't a real treat. It was a Peli-case with a few media and camera related stickers on it with a well used look.
"Why would someone with bad intentions use such a super strong case, predominately used by professionals?", it just didn't make any sense.
Even before I could further examine the case, and what was in it, a reporter came to us and explained his intentions.
Apparently we were really quick on scene and to do complete a first threat assessment, he even complimented us. Not to surprisingly, we didn't appreciate his action, and even after checking his credentials we almost had him arrested or fined.
@@dr.oetqer I assume this was years ago but surely this would not be looked down favourably by a judge / jury today.
is it cheating to say id just walk in walk straight behind the teller line sit down at the desk and begin fucking with the cables behind the computer
i feel like its cheating because anouther well known pen tester did that
That depends do you have Jaysons demeanor and ability? 😉
New idea: scout for an on-location movie or TV shoot. Learn the jargon (it's all over the place on the web) and you can wear what you like--and people will fall all over themselves to show you stuff. I know that because I was in "the industry" practically forever.
Clean and refill their AC. Every one wants their AC clean and working.
Oh. You got me with that morse code (CW)... 🤦🏼♂️
I was wondering how many people would look that up 😂
@@amihirata Look it up? I’m a HAM, baby! :p
What if the first example was a first amendment auditor with a really good camera?
HVAC tech, yellow vest, set of gauges and a tool bag.
One advantage of HVAC is that you have a good reason to ask for roof access on big buildings (since many buildings have HVAC units up there).
Johnny Sins.... nice.
The last one walking with abag
Suited and booted, and here for a job interview.
Because u don't live in a city where there are lots of students, studying media???
If you want to be camera man, dress like a tech but have a partner in a suit (male or female) holding a large mic. Cameraman and interviewer looks more like news crew even without any ID or logos than lone camera man. If alone, "RUclips" or "Instagram" may be the only words you need for the avg. person on the street.
HVAC. Always HVAC. 1st= if you're not an HVAC technician- then you will be the only one privy to the knowledge base of one, id est= no one is going to ask you any questions. Also, allows for easy access to mechanical areas of the building. If someone says something= you get to plead ignorance. You are Visiting here- you don't work there and wouldn't be an object for suspicion when you might try to access an area you're not supposed to be in. Metal clipboard, lol, of course, and fake company insignia which is cheap to manufacture. Also smart to set up a fake website for the company you are representing and a person available to answer questions to anyone that calls if someone prods you into giving them your credentials. Lastly= Bottle of Ether and a Rag. Should you get pinched, douse rag and place over identifiers mouth and press firmly until loss of consciousness occurs. Then you get your shit and RUN. Hahahaha
Seems like you like to live life enjoyably
Firstly when I read what you just sayd I thought that this was a quote from a movie or something. If this is real, then damn..
I read this comment whilst comfy & toasty in a vacant apt unit I have absolutely *zero* business being in other than the fact I can (& also strongly prefer not to be outside when it's 20 F, brr!), so right on & hell fucking yes to your outlook & approach to life.