

DKM's Security Hack



 Daniel Keys Moran's Amazingly Cool
Security Hack 


Date: Mon, 02 Oct 1995 02:58:00 UTC
 
I had an amazingly cool day Friday.

 
There's a Japanese bank here in Manhattan for which I was approached to put
up an Internet web site -- which I've never done, but they want to publish
some content, realtime, out of Microsoft Access, and I'm a great Access
programmer, so it looks like I'm the guy for this job.


 
Friday morning, I've dropped off my proposal (which they're generally
pleased with), we're discussing various details of internet security, and I
say, By the way, don't forget that there's a physical element to computer
security -- we're going to have to control physical access to the site as
well as net access. (I could have mentioned, but didn't, the scene at the
end of tLR, where Trent demonstrates this principle for the PKF.)


 
They got really snooty. Turns out they -- their company -- had
demanded all sorts of security upgrades to this building when they moved
in, which had been put in place. Nobody but one of their -- totally 
trustworthy -- people would ever be allowed into the IS center, they said.
Couldn't even get into the building.

 
"Sure someone could," I said.

 
"No, Mr. Moran. We have card-only access except for guests, and the guests
have to be approved by someone on the list to be given a temporary pass."
(Which I knew, having been through it that morning.)


 
"Okay, all that means is that you'd need an inside connection to get someone
in the building," I said politely. "But in reality it doesn't even mean that
-- your building is a lot less secure than you think. I'm sure I could 
get in without inside help --"


 
(I don't recommend this as a sales approach, by the way.
The temperature in the room had dropped about twenty degrees.)



One of them gave me a real shark's smile. "Mr. Moran, allow me to escort you
out of the building. Can I have your pass, please?" I handed it to him. "If
you can get back into the building without your pass, I'll be terribly
interested."


 
I was leaving anyway (really) so I smiled and let him escort me out of the
building, figuring that at worst I'd just blown a (minimum) 20K consulting
job, and at best I'd just annoyed the people I was going to have to work
with. In any event, the damage was done, so at the main entrance I thanked
him and said, "I'll see you again later this afternoon."


 
His grin got real big. "We'll wait for you."


 
I took a cab home. I changed out of my long-sleeved blue shirt into a short-
sleeved white shirt, changed out of my suit into a pair of black slacks,
cowboy boots, and a sports jacket. I took my ID badge from PC Expo, a couple
of months back, and dug up a sheet of fluorescent white bond and ran it
through the printer. It said in big black letters:



M I K E &nbsp;&nbsp;&nbsp;
M C C L A R Y



BUILDING SECURITY SUPERVISOR



 
(Why Mike McClary? I dunno. Something about the Irish and rent-a-cop
security, I guess. It was the first name that came to mind. And I'm half
Irish anyway, and look Irish. Now that I've done it I wish I'd used "James
Camber," or "Trent McClary," or something.) I cut the name out of the stiff
white bond and slipped it into the PC-Expo badge holder, and clipped the
badge onto outer top pocket of my sports coat.


 
I hunted for, but couldn't find, a clipboard. I typed up in Microsoft Word a
grid that showed NAME, TIME OF EXIT, and VISITED, and then wrote in, by
hand, 7 or 8 names and names of companies, under VISITED. I left the TIME OF
EXIT column blank, because I wasn't sure what time I was going to make it
back there.


 
Took a cab back to midtown, and had it drop me off at the Staples office
supplies building down the street. I bought a clipboard, clipped my
worksheet to it, and walked the several blocks over to the building. It was
about 2:20. I parked myself just outside the front door, wrote in times of
exit from 2:12 through 2:18 in the TIME column, and then accosted the next
fellow leaving the building. (This took a little effort -- stopping a New
Yorker out in the open is not an easy task. They stare straight ahead and
walk like mad.)


 
"Excuse me, sir. I'm Mike McClary, Building Security Supervisor." I tapped
the badge on my coat. "We've been upgrading security at the building, and
the guards are now supposed to request your visitor's badge when you leave.
Did they request yours?"


 
"No, they didn't."


 
I shook my head in disgust. "You're the ninth person who's told me that. Do
you mind if get your name and the company you visited, for our records?" I
gestured at the half filled-in worksheet. He actually gave them to me, which
surprised me a little, New York paranoia being what it is, but who knows,
maybe he was lying about his name. In real disgust I said, "I'm going to
start collecting those damned visitor's badges. Do you mind if I take yours?"


 
I was almost certain I was caught -- he gave me this look. But then he
dug into his coat pocket and pulled it out, and I said, "Thank you very much,
sir," and tucked it under the edge of my clipboard, and started off as
though to accost someone else leaving the building. He walked away, and
after a minute I took the badge off and walked into the building. There are
two guard stations in this building -- one at the entrance, where they hand
out temporary passes, another one a ways back, where they check them. Bad
design -- the guys at the pass-through station can't see the front station,
so they don't know if you stopped for a pass or not. (I.e., people with
visitor's passes should have had to stop and pick up a pass at the front
door; no one should ever walk in with one.) I sailed by the front desk,
waved at them; they didn't even blink. Turned the corner, walked up to and
through the blinking/buzzing security gate; a guard on the other side
glanced cursorily at my visitor's pass -- time-stamped for that day -- and
waved me through.


 
I took the elevator up and came on up to reception, which also has a glass
door separating office space from the elevators. I tapped at the glass door,
and the girl, who recognized me, smiled at me and buzzed me in.


 
"I forgot something in Ben's office," I told her, sailing by. "I'll be right
back."


 
The offices had that late-afternoon calm happening; most of the executives
had their doors closed. I went down the hall to IS -- and there was nobody
in the room, which was too bad; I'd already decided to try talking them out
of their Netware installation disks, on the grounds that the boss wanted to
see the serial number on it, there being some question about the serial
numbers on the invoice -- I think I'd have gotten them to give them to me,
too. At any rate, the door to IS was locked, and I didn't want to be accused
of actual B&E, so I didn't try that one any further, but I looked at the
lock longingly -- it was one of those 1960s "locks" that you can open by
slipping something long and thin through the door and sliding the door latch
open.


 
I wandered down the hallway, drawing a few curious looks, but no stares or
hostility, looking for an empty workstation. I found one, opened up
Microsoft Mail, and sent a message off to the 5 guys I'd met with that
morning -- roughly the account above, very condensed, at my popcorn-popping
110 WPM -- and left my phone number at the end of it. "Feel free to call me
on Monday. Maybe we can try this again and see if it turns out better."


 
I sent the mail and got up and walked out quickly. I told the receptionist,
"Thanks. Got what I came for."


 
They'll either hire me or hate me, I figure. But I enjoyed the hell out of
myself.



Date: Tue, 03 Oct 1995 03:11:00 UTC

 
Surprisingly (to me, at least) several people have wondered if I made that
story up. Every word is true -- I may tell you the name of that company if I
don't get that job; I won't, for obvious reasons, post the name of one of my
clients. When I was typing it up I had to resist the desire to "sweeten" it -
- I mean resist; I really wanted to tell the story where I
talked the IS guys out of their Netware disks.


 
Didn't occur to me until after the fact that I could have accomplished the
same thing, lots quicker, by offering someone leaving the building $50 for
his guest pass; assuming one of them didn't raise the alarm, I'd have been
back inside in 5 minutes. Instead I gave my potential clients time to alert
the security people, if they'd been smart/paranoid enough to do so.


 
As several people have pointed out, the security there was a joke. But
that's almost inevitable at any building that the general public has
to have access to; there was no way for them to really secure that building
(though they could improve things dramatically by simply taking back guest
passes as the guests left -- which they may be doing, today.)


 
Anyway, there were probably a half dozen simpler ways to get inside that
place than the one I used. That one worked, though.

 


 
Shark Man called this morning and left this on my answering machine: Beep
... "Dan." Really long pause. "That was ... funny. Give me a call back." He
hung up and we've spent the rest of the day playing phone tag, so I still
don't know exactly how it went over.


 
Thank God none of them are on this list. I don't think.


 
This will probably show up in a story somewhere, sometime, though you might
not recognize it after I tell it the way it shoulda happened. <G>



Date: Sat, 21 Oct 1995 15:25:00 UTC

 
John Snead said:
 
A question for DKM, what exactly happened with the company who was so
smug about their security.  Did you get the job?
 



Got a forty-hour retainer, in fact, but since then it's gone south way fast.
They're merging with another company, and it looks very much like all the
people I'm dealing with are going bye-bye. We're in a holding pattern that's
going to last forever, it looks like. Right at the moment I don't give a
damn, though. :-)




