Slashdot Mirror

← Back to Stories (view on slashdot.org)

Card Locks Thwarted by Shopping Club Card

Posted by ryuzaki0 on from the hmmm-not-so-good dept.

hal9000(jr) writes "A recent column ('Social Engineering, the Shoppers' Way') on darkreading.com shows how easy it is for a pen test team to walk into a supposedly secure facility using a shoppers club card because the man trap feature was enabled. Man-traps allow people to enter an outer door but not an inner door similar to ATM kiosks. Once inside, of course, they had the run of the place." Lessons: after writing down your password, eat your sticky notes rather than leave them on the monitor.

3 of 361 comments (clear)

  1. Works for me by Knytefall · · Score: 5, Interesting

    Where I work, one of my friends was able to use his shopper's club card to get access to doors he didn't have access to, but I did. I thought the odds of that happening must be astronomical, but apparently it's more common than I thought.

  2. insecurity 101 by digitaldc · · Score: 5, Interesting

    Maybe...

    1) Have a photo ID badge that is the only card that can be swiped to get in to the location
    2) Install fingerprint readers and cameras for employees to gain entry
    3) Lock all doors/locations not in use, & again use ID Badges and fingerprint readers to gain entry
    4) Have have all passwords on keychains updated every few minutes
    5) And finally, have all employees meet regularly so they know each other by name and by face

    Just a thought.

    --
    He who knows best knows how little he knows. - Thomas Jefferson
  3. Other items that work well. by Demon-Xanth · · Score: 5, Interesting

    Pretty much any type of tools. ESPECIALLY telephone buttsets. My dad worked for a phone company for a long time, and if he had a telephone buttset, nobody every questioned his credentials, or took a second thought about letting him into anywhere in a building. Locked door? Just ask someone to open it for you!

    Clipboard. If you got a clip board, people are AFRAID to question you. A coworker of mine visited a major plant once, and the employees mistook him for a CEO or something like that because he had a clipboard.

    Suit and tie. People will assume you're a rep of a visiting company and will give you directions.

    The best locks in the world won't do any good if someone trusted opens it for an attacker.

    --
    If you think education is expensive, you should try ignorance -- Derek Bok, president of Harvard