5. Physical

10,000’ view and lower of Physical Security

Physical security is often over looked, especially by technical people, although in most cases, it is the simplest and easiest to circumvent, as well as the simplest and easiest to mitigate.

1. SSM Asset Identification

Take the results from higher level Asset Identification. Remove any that are not applicable, and add any newly discovered. Here are some to get you started:

Servers: the cabinets they reside in, the rooms cabinets reside in
Physical buildings: their openings, such as doors and windows. Keys, RFID cards and access codes
Sensitive printed matter
Plant: such as work-stations or any other devices that could be used to launch attack sequences from, or even cause diversions, to allow an attacker to carry out an action they wouldn’t be able to otherwise. Laptops and mobile devices (including personal) configured to access internal Access Points (APs). Wi-Fi APs
Visibility into who is where and doing what. Visibility brings immense power to make good decisions, and is often an excellent target for an attacker to deny you

2. SSM Identify Risks

You can take the same process that we did at the top level, but abstract the ideas, and then solidify them on physical components. Some of the ideas will work, some won’t.

Many times physical security is good, but then is compromised by the people problem. My wife used to do commercial cleaning when she was younger, and every night she would come home with new stories about how people were the weakest link when it came to security. Most of the time when physical security is breached, there is actually no security, because people have failed the design.

I am also a qualified carpenter, and part of my job was to break into buildings when the tenants had run out on the lease, so I know a few things about physical security as well. Even when doors and windows are locked, their security is usually trivial to compromise without damaging anything. Funnily enough, it was seldom that we were required to force latches, bump or pick locks. There is always a path of least resistance, the lowest hanging fruit, because people are usually the weakest link in any security solution. This does not actually have to be the case though, they can be the strongest link as well. Refer to the chapter on People for further details.

Fortress Mentality

We see the same analogy of the candy bar (fortress) running through many areas of security.
“Many organizations still adopt a fortress mentality, where everyone on the outside is bad and stuff on the inside is less dangerous,” said Brian Krebs, author of the Krebs on Security blog. “Years of experience has taught us that the biggest problems often stem from the fact that once something gets through the outer defences, it’s often a cakewalk to move around the internal network unimpeded.”
We not only see this principle applied to networks, but also to physical security.

Internal Doors and Cabinets Left Unlocked

Consider doors that lead to isolated areas, filing cabinets and other cupboards left unlocked or locked, and keys or combinations put in obvious places. What assets or potential foot holds are in those areas? What about electronic systems other than core computing systems, such as alarm, surveillance or air conditioning components? Sometimes all that is in the way of a successful exploit being carried out, is the fact that someone’s watching something. If an attacker can take that someone’s attention away from an exploitable target (be it a computer, another unlocked door, person, or whatever) for a short period of time, they may be able to carry out an activity that takes them further along their attack traversal path.

Insecure Doors and/or Windows

Open doors and windows are typically uninteresting because they represent so little challenge to mitigate. So little challenge, in fact, that the vulnerability is often ignored. Believe it or not, it is often the cleaner’s responsibility to lock doors, windows and set alarms. Anyone can be, or masquerade, as a cleaner. I have discussed some of these types of threat agents on my blog. Many places I have worked in that have double latched windows, are only single latched when I do the rounds just before I leave. It is very easy to pry a double latch window open from the outside when it has only been single latched.

Easily Penetrable Building Materials

There are many building materials used today, that are trivially easy to compromise. Although cyber attacks, as opposed to simple physical penetration, are on the increase, physical attacks are generally lower tech and easier to carry out by less technically skilled people. One factor being realised with regard to cyber-crime is that the physical vector can also be a key component of carrying out a successful technology based attack, in a manner similar to social engineering as we cover in the People chapter.

Roofing iron, and most roofing materials, are very easy to either break through or remove. Once an attacker has a small section of roofing material removed, there is little in the way of physical elements stopping them from entering the human inhabitable areas. Ceiling and wall linings have little strength and are easily pushed from their substrate
Skylights, as are windows, are easy to break through. Skylights are often just less obvious than windows, although not always. There are usually metal strips with rubber moulding underneath holding the glass panes in. With a flat blade screw-driver or any other similar tool, these are typically simple to remove. This would be my usual approach to entering my house when I have misplaced my keys. This is quick, easy, and does not result in any damage
Weak exterior cladding: There are lots of fairly weak building materials used today. Fibre cement for example is often only 6mm thick. Sometimes this may have a plaster coat on it, which may give a deceptive appearance of strength. Either way, with a good kick, penetration is fairly straight forward
Suspended ceilings: If you have sensitive information stored in any area, such as server rooms, archive rooms, etc. Which has a false or suspended (dropped) ceiling, this is often an easily penetrable vulnerability. GIB or Acoustic NRC tiles are extremely common in office environments, but can be removed easily with bare hands, no tools required

Service Labels

Often labels are attached to doors, windows, air conditioning units, and any other number of electrical appliances, clearly displaying who the service agent is. This sort of information can be very useful to aid an attacker in their social engineering pretexts. With this sort of information, an attacker can pretend to be the service agent specified on the label and will more likely succeed with this attack.

Sensitive Printed Matter

Dumpster diving: Trash baskets or shredded material inside the building or dumpsters outside of the building. Even if the printed material is shredded, there have been quite a few tests and studies performed on the effectiveness of many shredders and how easy it is to reassemble shredded printed matter with time. In fact, there are competitions devoted to reassembling shredded printed documents with contestants that have successfully reassembled all printed matter. I also know of organisations that pay a service to pick up printed material, take it away, and destroy it. What is to stop an attacker masquerading as someone from the organisation you pay to do this?
Printed material left in insecure places: Your desk is insecure. Visitors or service contractors can easily photo documents when you are not there, without you ever being aware that they have copied them
Printer Management: Most businesses use Multi Function Devices (MFD’s) for the convenience of having printers, scanners, faxes, binders, etc. all combined into a single unit. This is generally a cost saving initiative, and also saves floor/desk real estate considerably. However, MFD’s contain hard drives which can store a plethora of previously printed documents. These hard drives are not only easy to remove, but are generally forgotten about when a device is retired or lease expired etc. Any sensitive information that is retained on the hard drive at time of sale or release, then becomes the legal property of the new owners or leaseholders.
There is a well known incident involving a Californian Police department who put 6 old MFD’s up for auction. All of these devices were subsequently purchased by a local motorcycle gang. Unfortunately for the police, they forgot to wipe and/or remove the MFD hard drives, resulting in thousands of sensitive police reports and case files becoming the legal property of the motor cycle gang

RFID Tags

What about all the RFID cards or tags used for accessing buildings, elevators, car parks, etc? Again, these are relatively easy to exploit with readers and cloners which can be bought across a full range of prices.

You can even build your own with the likes of the Tessel and its RFID module.

Of course, there are many more that I may explore in a later book or blog post.

Computers Logged in and Unlocked

Computers left logged in, not locked, and screens left on often include very sensitive material clearly displayed. This is very common. Again physical security is rendered useless due to the people problem.

Networking Equipment

Wherever you have networking equipment installed, it represents an optimal target for an attacker looking to compromise assets on your network. An attacker only needs just enough time to plant infectious media that will do their bidding, perhaps destruction or establishing a reverse shell to an external host they control, giving them full access to your network. Do not underestimate how quickly this can be done. Often simply plugging media in, is all that is required.

Network Ports

Active network ports are just that, active and waiting for a malicious actor to plug in a rogue Wi-Fi Access Point or drop box that will allow malicious activity on the network, including exfiltration of information it has gathered. Devices such as the Lan Turtle are popular for this.

Wi-Fi Access Points

Wi-Fi took the world by storm. It provided an extremely convenient way to access the network from both transient and stationary devices. Connected devices no longer required a physical data connection. Because of the amazing convenience Wi-Fi brought with it, users were blind-sided to the huge attack surface Wi-Fi created. With any increases in convenience, there is also an increase in attack surface. You can not have one without the other.

The human race seems bent on adopting technologies as integral parts of our lives with often almost complete ignorance to the costs we are incurring. As ubiquity and convenience increase so too does the cost. With Wi-Fi, the cost represents the huge attack surface that comes with it. An attacker no longer needs to break into a building and find an active port. They can just sit in their car in the parking lot pretending to answer email or the like. Worse, they can wait until staff have left for the day and comfortably establish themselves outside the organisations premises, then go to work on the internal network. It could not be much easier. Keep in mind, most attacks come from within organisations.

This is discussed in more depth in the Network chapter of Fascicle 1.

Hiding the SSID

Hiding your SSID is security via obscurity. It’s useful against the casual unskilled observer, but it is not really the casual unskilled observer you need to be concerned about. Depending on an attackers kit, there are plenty of ways to locate hidden SSIDs.

Wi-Fi Protected Set-up (WPS)

WPS is a network security standard that is supposed to allow users to easily add devices to an existing network without entering pass-phrases. WPA is available on many consumer-grade APs and even some entry level enterprise devices. This standard as implemented provides a large, easy attack surface that provides convenience, thus significantly reducing security.

There are several methods in the WPS standard to provide authorisation to an Enrollee (entity wanting to connect to the AP). No method provides security if the Enrollee has physical access to the AP, and little security even if they do not. If the Enrollee can obtain physical access at some point, then a trust relationship can be established for an ongoing remote relationship. The method names are:

PIN
Push button
Near field communication (NFC)
USB

Several brute-force attacks exist in which an attacker can compromise the PIN method. How WPS on the specific AP is implemented determines how long brute-force attacks will take to crack the PIN. In most cases this is only a matter of hours.

Once connected, the wireless pass-phrase can be extracted from the Enrolled device with no special tools. Essentially the AP just trusts the Enrollee.

Transient Devices

In my experience, when a staff member finishes working for an organisation, they are never made to, or even encouraged to remove wireless access point credentials from their personal transient devices, but yet, keys and RFID tags are claimed. This makes no sense at all.

Lack of Visibility

A lack of visibility removes the ability to make well-informed decisions. Visibility dictates your ability to react when a malicious actor is doing something to compromise your asset(s).
The tools you use to provide visibility will determine what an attacker needs to do to go about avoiding or removing it.