A candid chat with our red team penetration testers

What’s the difference between red and black teaming?

Recently, in a Black Team engagement we incorporated some phishing elements. We found that having access to staff's phone numbers and being able to send phishing emails at the same time allowed us to reproduce a convincing requirement for us to be on site. If it was a random case of somebody wanted to remotely access your laptop to ensure that it was compliant, and you were from the IT team you'd be suspicious. But because we'd already figured out a way to enter the site, being able to phone up employees and say, 'I'm on site on this day can I come to your desk, and we can do this?' That implies a 'higher level' of trust, they assume that you're meant to be there. If you're able to walk to the desk the likelihood is that they're going to give you the laptop.

That’s ultimately how Black Team, Red Team OSINT and phishing can all work together in a simulated attack.

Jordan

What’s the difference between red teaming and penetration testing?

Social engineering at work

Sometimes businesses have good protection systems against phishing and people will be quite well trained. You phone them up and they're immediately suspicious, but then you can just walk in! Sometimes it's the other way around; a phishing email goes through, you ring someone up, they're happy to meet you, give you their password etc, but walking in will be difficult.

Gillian

I think having that fake level of confidence is hard because when we're planning an assessment, we create stories that we're going to use on the day to get past reception, to get through doors or to tell security guards.

One thing that's difficult is to think 'Okay but if they come back with this question? What are we going to say, what's believable, what do we have on us that could like help with that illusion of trust?'

Jordan

Fake it ‘til you make it

If you get to reception and you look nervous like you're not supposed to be there, people notice straight away. If you have that 'fake level' of confidence people don't tend to question you as much. But I guess another one of the hardest things is if you gain entry to the building, looking like you know where you're going because you need to get to point B and you don't know where point B is!

Jordan

If you're able to do it, it works even if you're wrong! We had an assessment where I walked into the building, I went into a meeting room to try and see if I could plug in, (because usually that has ethernet ports) and someone came in and they said, 'Where are you from?' I just gave a name and apparently, this wasn't even the office we were supposed to go to and the name I gave made no sense to the people that I said it to, but they were like. 'Oh, okay’ and everybody just left, and let me be on my way.

Gillian

Mapping the surroundings

The last assessment we did as soon as you walked in, had a massive touchscreen with every floor, and it had a floor plan of where each room was. That was perfect because Gillian went in first and took pictures of each floor and I hadn't been in yet so I could study each one. So, even though I hadn't been in the building when I went to each floor, I'd memorized the floor plans, so I knew where I was going, and because I knew where I was going, I didn't look suspicious.

Jordan

On scoping calls, I often get people saying, ‘why do we need to do internal tests, because someone would need to break into our building, and who's going to do that?' But you can prove to people that it is possible to do and that it is needed.

Gillian

What do you think companies get out of Red Teaming?

Testing the security setup

We have some examples where we managed to get in, tried to plug in and nothing happened. And that is something that companies can get out of it.

We also take a holistic view. We don't just say, 'Oh you need to fix just one thing,' we go at it in layers, find out if people are being educated and if they have an extra layer of security if someone breaks in. Taking a holistic view can pinpoint issues that need to be addressed as well'.

Gillian

Alerting to internal issues

Sometimes it's better to work backwards. If you do an internal infrastructure and you say, 'These are all the things that are wrong in the network.' Then when we do a Black Team assessment we can say, 'here's how easy it would be for an attacker to break in.' what we do is basically provide a bridge. It can also help a CISO (Chief Information Security Officer) to say how easy or hard it would be for an attacker.

I've worked in some large banks and what they do when we raise a lot of issues is they will often reduce the severity that's available externally. Say we find SQL injection- which is a big issue if it is unauthenticated. They reduce the ‘rest rating’ quite significantly if it is only available internally. Us being able to do a Black Team assessment and bridge that gap to say, 'You know, this is how easy it would be to break in,' gives everything more context.

Jordan

Testing the SOC

On the technical side, organizations don't really get a chance to properly test their SOCs or their Intrusions Detection Systems (IDS) against being targeted by trained professionals. Quite often, random attacks on the internet are loud scans that are easy to detect. Red Team scans are slightly harder, so it’s good for a company to know if a hack team were to target them, would they pick that up.

Jordan

Is that when Purple Teaming can come into play?

Yes, if they want to have that collaboration, it very much depends how companies want to approach it. On one of the tests, they wanted to have their blue team (their defensive team) be aware of what we were doing only after they realized we were doing something. So, we just did it in stages. At first, we tried to be quiet, and then upped it a little bit, and then at one point we threw a lot at the network. Then it became a Purple Teaming collaboration where we would say, 'Okay we've done this did you pick it up? We've done that did you pick it up?'

Gillian

So, when would you advise a business to start Red Teaming or Black Teaming?

Don’t use Black Teaming when… You have an organization that's very remote, has very few sites, and the sites they do have aren't really connected to their internal network (it's literally, just like a shared office with access to Wi-Fi), then there’s not much value in a black team assessment because most of the company resources are not on site.

Do use Black Teaming when…Your organization has at least one site where there's a lot of potential sensitive data, that's either on the network or stored in files or there are server rooms, that's when black teams can become beneficial. If you have a lot of sites, then obviously it's going to be more beneficial, because the physical attack surface is much bigger.

Jordan

Sample testing sites

Because some organisations use similar security controls across multiple sites, companies may choose a select approach, for example testing one or two out of five possible customer support centres. and the recommendations that we raise can be applied to all the sites in scope.

Jordan

When to use a Red Team?

Where a Red team differs from a standard pen test is when you have security controls in place, like a mature SOC and you want to understand the full attack path. As pen tests have a narrow scope that focuses on one thing, to test something like whether an attacker would be able to get from outside the company (for example, on the internet) to three or four internal networks in, a Red Team is going to give you that knowledge.

Jordan

What's the coolest thing you've done as part of a Red or Black Team exercise?

Empty parcel delivery

The first one that we did together I think was cool just because it looked a bit hopeless from the start. It's one where we were there the day before and there were turnstiles everywhere and guards. We went around the back looking for a side entrance, and immediately someone walked up to us and asked what we were doing there. So, I thought 'This isn't going to work.' Then we went to a parcel shop, got a little parcel ticket made, tried to get in that way, they stopped me and took my parcel. So, someone got an empty parcel that day.

Gillian

Drunken acting

We saw there was a box filled with lanyards and with key cards on top of the reception desk. Jordan had the idea to pretend to be drunk, knock it over and then I pick one up, which we didn't go for, but that would have been funny! What we did instead was Jordan went in pretending to be an IT engineer and the moment the receptionist looked away he grabbed a pass, came back outside, and gave it to me. I went in, tried to beep it but it didn’t work so I went to reception and said, 'Hey you just gave me a pass that's not working.' And they said, 'Oh so sorry', and gave me a new one! That's how we got in.

Gillian

There was quite a lot of like moving parts to that one. When we stole a badge from the box it wasn't simple because there were so many cameras and security guards all looking at this box. How do you steal something in plain sight?

Jordan

Fake badge swap

When I went in the following day, I wore a fake badge that Gilly had made. My plan was to take my badge and put it in the box, pretend that I forgot something, run in, and when I went to get my badge, take a different one. It ended up being much better because when I put my badge in the box, the receptionist for whatever reason turned around to sort some paperwork, the security guard was behind me and my body was blocking the box, so I just swapped it instead.

Jordan

Police got involved!

The police got called because the fake badge used my real name to match the name on the car. After I swapped it in the box they realised when they emptied the badges at the end of the day that my badge was wrong, and they phoned the police, but we managed to catch it before they came.

Jordan