I Got the Badge - means I have everything

It is 6:14 AM on a Tuesday-it’s raining which is why I am choosing today to make my move-People are more likely to be grumpy less chatty and look the other way on crummy days. 

I am across the street from a 38-story tower in the financial district, drinking tea, watching the loading dock. Nine days now, same time every day, different spot. I know when the cleaning vans arrive. I know when the guard takes his smoke break/coffee, 6:22, every morning, by the Dunkin’.

The badge is a standard HID iCLASS 13.56 MHz card. The building issues hundreds of them. I have a long-range RFID reader in a leather messenger bag, cost me $400, legal to own. Nobody has ever asked me what is in the bag.

At 6:21 the analysts arrive. Fleeces, AirPods, badges clipped to belts (let’s be truthful they are easy to spot). Eleven reads in seven minutes. I go home. I cross-reference credentials against camera footage I captured with my iPhone. Reverse image search. Nine faces on LinkedIn in forty minutes. I pick a second-year associate. I clone his card on a Proxmark3 in nine minutes.

Wednesday at 9:47 PM I walk into the loading dock in a gray cleaning uniform with his cloned badge in my pocket. The reader chirps green. The system logs an entry under his employee ID.

I take the freight elevator to 27. Ninety-three minutes alone on the floor. Forty-seven desks photographed. Eighteen printer drives pulled-they keep a huge amount of images of recent copies- lots of good stuff. The network closet documented, patch panel, switch labels, papers taped inside the door. The guard does not look up as I leave, they never do. 

By Monday I have his password from a Post-it, photographed off a coworker’s monitor. I log in from a residential IP (not mine). I do not send anything. I read, six weeks of deal calendars, offer prices, names. Nothing on your network ever looks wrong, because everything I do looks exactly like him.

His badge entered the building Wednesday at 9:47. His phone records will say he was home. The investigation will not believe in impossible. He is twenty-six and he did nothing wrong. His only mistake was walking past me, a middle aged man with a messenger bag, sipping my tea, who was looking at his phone.

You spent $500-1 million dollars on cybersecurity last year. You did not upgrade the badges, more accurately your building didn’t. You did not move to Seos or DESFire EV3 or mobile credentials. You did not reconcile the cleaning roster against the access logs. You did not train the guard to look up and make eye contact. 

Reach out if you wish to discuss.