Helpdesk: "Sure!"
Hacker: "Thanks! What mail server should I use again? And what's the VPN IP? I need to RDP to fix some kind of outage."
Helpdesk: "[redacted]"
Hacker: "Thanks so much! Have a nice day!"
So many good stories. RIP.
None of us were brave enough to try it.
You want invisible? Be female, 40+, short but otherwise average build, any skin colour but white, black hair, generic cleaning staff outfit, and one of those carts with mops and buckets. Now you're invisible (racist, classist, and misogynistic biases exist, might as well use them).
(As a 2m tall person I can't blend in anywhere.)
I didn't ask whether they actually worked for that company, or the outfit was part of their pen-testing toolkit.
They spooled up a truckload of copper, gathered their cones, and drove off. They were seen by hundreds of witnesses in the middle of the day, but nobody suspected anything.
At least over the population we test, your chances of getting in jail are big enough that you shouldn't try it. But you certainly can collect anecdotal evidence that it works.
I have to admit that I actually used that on occasion.
9/11 changed that fact.
In theory, basically all of these required an exhibitor pass to get in to. Sometimes I’d have one, sometimes it would be with someone already at the show who I was supposed to call to come out and let me in, etc.
I used to make a game out of getting in without using or having a pass.
One of the easiest strategies was just to have a slightly large or unwieldy looking box and find a well enough travelled side door. In the context of a trade show or something, somebody hauling stuff in through a side door was 100% expected. Nobody would blink an eye at holding the door for you. Often there’d be a security person inside but if you just walked confidently and like you knew where you were going they wouldn’t chase you down just to ask you to put down all your stuff and dig your pass out.
Same strategy has worked to drive right past vehicle barriers. They’ll tell you can’t drive in there. Tell them you’re there for <namedsponsor> and you’re not carrying all these boxes in the back seat from a mile away. Quick radio call and “drive slow through the crowd please, be really careful”. Wasn’t even there to deliver anything, that area just has shit all for parking.
After showing up in a group of ten people carrying <namedsponsor> swag and gear, wearing <namedsponsor> clothing, in a <namedsponsor> wrapped vehicle and having every staff member have to present a pass and submit to a glance through of everything they were bringing in… one of my main contacts was always shocked every time I’d do this.
Make way more money now doing way more interesting work, but that role definitely had some fun parts.
I Broke Into The International Security Convention https://www.youtube.com/watch?v=qM3imMiERdU
I Broke Into The U.S. Security Convention https://www.youtube.com/watch?v=NmgLwxK8TvA
The best time was just as camera phones were being adopted. I had a paying friend already on site, and got him to send me a picture of the wristband. Sky blue, yellow toggle.
I head to a haberdashers, grab some ribbon and a few appropriately sized beads and laugh my way in through the front gate.
No way that'd work these days, but my favourite hack to date.
Good times.
Its amazing where you can get with some "proper dress" and confidence. Lots of cases of using a hivis vest and lanyard to get into free concerts, gaining rooftop access, etc.
He called the branch manager saying he was from NationsBank IT and was going to do a pre-merger inspection. He showed up, asked for the root passwords of the boxes in the branch, logged in, left a MOTD message, then left.
Needless to say they beefed up the training on that once the merger closed.