Posts RSS
Subscribe via Email
The Guerilla’s Guide to Piggybacking
Posted July 18th, 2007 by rybolov
As much effort as we put into badge readers, smart cards, and access controls systems, it’s a dirty little secret that they are easy to overcome if you know what you are doing, and the only way to keep you from cheating is to put a “meatgrinder” in your way.
Techniques for getting past card reader systems:
- The Big Box: Hold a box that’s big enough and bulky enough that you need two hands to hold it. Ask a cleared employee to hold the door open for you.
- The Mad Dash: Hide just out of reach of the door. Wait for a cleared person to go inside, then make a “mad dash” to grab the door right before it closes. If you practice, you don’t even have to run to get the door, you use your sense of timing.
- The New Employee: “Hi, I’m new here and they told me it would be a week until I got my badge. Can you let me in?”
- The Clipboard: Hold a clipboard and act like an auditor who is dismayed that they couldn’t get into the area that they need to inspect.
- The Visitor: Ask somebody to sign in so you can legitimately get access to the area. After that, it’s a simple deal to shed your escort.
The commonality to all this is that you’re preying on peoples’ sense of either being a team player or giving other people some common hospitality. You can teach people to not let anybody else in, but our brains just won’t let us slam the door in somebody else’s face.
Come to think of it, it’s suspiciously like trying to teach your kids not to talk to strangers.
Similar Posts:
Posted in Hack the Planet, What Doesn't Work, What Works | 
3 Comments »
July 18th, 2007 at 10:22 pm
When I worked at “a large network equipment vendor”, I would regularly get called out for not having a badge to “sensitive areas” such as security and performance labs that contractors had “every other day” access to.
I quickly learned many of these tactics, but what really paid off was figuring out that their 24 hour “chemical-based vanishing” visitor badges would not de-activate if put in the freezer.
July 19th, 2007 at 10:28 am
Often, you can just strike up a conversation with someone walking in at the same time you are. “Hey, how are you doing, nice weather…?” pretty much always leads into holding the door for you. Criminals can’t be nice, right?
Likewise, a cute chick will rarely have to open the door themselves if there is a guy also walking in at the same time… 🙂
July 19th, 2007 at 3:56 pm
Yeh, I always wondered why my fu-manchu moustache kit and black trenchcoat weren’t cutting it….