rozabon Hacker News • Recommends
On “List of Special Elevator Modes”
Deviant Ollam's talks are always first class. I also love this one, about physical pentesting in general: link to this video
0:00 / 0:00
#physicalsecurity#deviantollam#lockpicking
I'll Let Myself In: Tactics of Physical Pen Testers
Wild West Hackin' Fest
56K subscribers • 1 video on Hallway
- Recommended by 5 people: 5 on Hacker News.
- Presented by Deviant Ollam, physical security specialist
Beginner. No background in the topic needed.
2.9M views8 years ago5 recommendations
SecurityWeb and application securityExploits and vulnerabilities
Deviant Ollam demonstrates common vulnerabilities in physical security, showing how easily doors, locks, and access controls can be bypassed.
Join us at the annual information security conference in Deadwood, SD (in-person and virtually) — Wild West Hackin' Fest: wildwesthackinfest.com/ Wild West Hackin' Fest 2017 Presented by Deviant Ollam: enterthecore.net/ Description: Many organizations are accustomed to being scared at the results of their network scans and digital penetration tests, but seldom do these tests yield outright "surprise" across an entire enterprise. Some servers are unpatched, some software is vulnerable, and networks are often not properly segmented. No huge shocks there. As head of a Physical Penetration team, however, my deliverable day tends to be quite different. With faces agog, executives routinely watch me describe (or show video) of their doors and cabinets popping open in seconds. This presentation will highlight some of the most exciting and shocking methods by which my team and I routinely let ourselves in on physical jobs. ________________________________________________________________ While paying the bills as a security auditor and penetration testing consultant with The CORE Group, Deviant Ollam is also a member of the Board of Directors of the US division of TOOOL, The Open Organisation Of Lockpickers. His books Practical Lock Picking and Keys to the Kingdom are among Syngress Publishing's best-selling pen testing titles. In addition to being a lockpicker, Deviant is also a GSA certified safe and vault technician and inspector. At multiple annual security conferences Deviant runs the Lockpick Village workshop area, and he has conducted physical security training sessions for Black Hat, DeepSec, ToorCon, HackCon, ShakaCon, HackInTheBox, ekoparty, AusCERT, GovCERT, CONFidence, the FBI, the NSA, DARPA, the National Defense University, the United States Naval Academy at Annapolis, and the United States Military Academy at West Point. His favorite Amendments to the US Constitution are, in no particular order, the 1st, 2nd, 9th, & 10th. Deviant's first and strongest love has always been teaching. A graduate of the New Jersey Institute of Technology's Science, Technology, & Society program, he is always fascinated by the interplay that connects human values and social trends to developments in the technical world. While earning his BS degree at NJIT, Deviant also completed the History degree program at Rutgers University. Wild West Hackin' Fest Socials Twitter: twitter.com/wwhackinfest LinkedIn: linkedin.com/company/wild-west-hackin-fest/ Wild West Hackin' Fest Shirts & Hoodies spearphish-general-store.myshopify.com/collections/wild-west… Backdoors & Breaches - Incident Response Card Game Backdoors & Breaches: backdoorsandbreaches.com/ Play B&B Online: play.backdoorsandbreaches.com/ Antisyphon Training Pay What You Can: antisyphontraining.com/pay-what-you-can/ Live Training: antisyphontraining.com/course-catalog/ On Demand Training: wwWhy it's here
5 people recommend thisWhat people say. Widely recommended as an entertaining and eye-opening introduction to physical security bypasses and penetration testing.
jstriebon Hacker News • Recommends
On “Ask HN: What's the most valuable thing you can learn in an hour?”
Simple physical penetration testing tactics are easy to learn and apply widely. These skills can be a quick way to have better security awareness, and can be a fun party trick. For example, many of the techniques listed in this (<1hr) video: link to this video
jodrellblankon Hacker News • Recommends
On “The first chosen-prefix collision for SHA-1”
…does break down. 1 is a fun YouTube video about physical pen testing; one example at 13:45 in the video, the presenter is walking home from a bar, walks up to a locked high street bank, spits a mouthful of beer through the gap in the doors, triggers the presence sensor on the inside which lets people out, and the door opens and lets him in. 1 link to this video…
magicalhippoon Hacker News • Recommends
On “DIY Smart Doorbell with a Raspberry Pi”
Reminded me of this talk. So many silly things leading to easy access. "I'll Let Myself In: Tactics of Physical Pen Testers" link to this video
jimpudaron Hacker News • Recommends
On “Phone app can figure out the shape of your house key by listening to you use it”
This is nowhere near being viable for real world use. Far more concerning is how easy it is to bypass most physical security measures. Forgetting about how easy it is to pick open most locks, many doors aren't even installed properly in the first place. Check out this YouTube video 0 to see what I'm talking about. 0 link to this video
u/ztherionin r/compsci • Mentions
On “Entertaining YouTube Series”
Any of James Micken's talks
Also, only tangentially related to CS, here's an infosec talk I keep coming back to
8-Bit Guy has some videos on old school/retro CS like how to make a color display work on a computer with a tiny amount of memory or how to make an interesting song with a 3-voice synthesizer
This talk on JS and Ruby type casting is only a few minutes but it's hilarious
Konnstannon Hacker News • Mentions
On “Dear Developer, the Web Isn't About You”
>Wait, what? I can't find anything about door levers having this kind of security risk. I specifically remember this talk: link to this video at around 18 minutes in he shows one of his employees(?) use a long bit of wire to pull the lever and open the door in a matter of seconds.
dotancohenon Hacker News • Mentions
On “A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts”
All those cabinets use the same key across cities as well! Otherwise FEMA and other services would be unable to function. For the same reason all LEO handcuffs use the same key, so that any officer could release any handcuffed individual. Edit: Some googling for links let me to this video, which seems relevant: I'll Let Myself In: Tactics of Physical Pen Testers link to this video
isbvhodnvemrwvnon Hacker News • Mentions
On “Hacker increased chemical level at Oldsmar's city water system, sheriff says”
They don't even need to be internet-accessible, physical security is often weak as well. Surprisingly relevant: link to this video
josefxon Hacker News • Mentions
On “Saintcon: Lock Picking Lawyer Keynote”
Going by a presentation from a professional pen tester lock picking is usually far down on their list because there are easier ways to open many doors without picking the lock. link to this video Someone who wants to get in is probably already on his way out while LPL is only halfway through with the lock.