Slashdot Mirror
How To Sneak In To a Security Conference
jfruh writes "You'd think that, of all events, security conferences would have tight security. But one anonymous human pen tester managed to sneak into the RSA conference without credentials, using tried and true techniques like waving a badge from another conference at security guards and slipping in through exits."
It's easy to avoid notice if you act like you know what you're doing, where you're going and that you belong where you are. Never stand still or look around.
Like everything else, security is no better than the people implementing it.
You'd think that, of all events, security conferences would have tight security.
No, I wouldn't think that. I'd think that a bank, or an event involving a US President would have tight security. Security is about what you're protecting, not who's involved in it. For the most part "stealing" admission to a conference is harmless, as long as a few people do it. The security only has to be good enough to make it so only a few people sneak in.
Security conferences aren't exactly a high profile event like, that appeals to millions (like say a Rock Concert), so people sneaking in is really not a big problem. If you didn't think you could sneak in to a conference before, you obviously haven't been paying attention.
You'd think that, of all events, security conferences would have tight security.
Why?
I suspect the cost/hassle of doing more than basic security outweighs the benefit of catching a few people who didn't want to pay the $100 conference fee. I doubt the information being presented is secret and needs protecting. And I imagine of all conference organizers, the organizers of a security conference would have best grasp on this security cost/benefit.
You can easily sneak into large concerts, gigs, expos, whatever if you have a cap with a TV station logo, dress shabby and carry a large video camera. If you don't have a camera, a set of cables or a tripod would do just fine. Badges? No need.
I used to work for a local branch of a known TV station, I had access to an old training video camera at all times. Every time there was a gig I wanted to attend to, I went to my workplace, grabbed that camera, went to the gig, got in, left the camera in one of the the tech rooms, achievement unlocked. Sometimes I brought my girlfriend in by letting her carry a microphone. We even interviewed a security dude just for the kicks.
So yeah, it's easier than expected.
...gis sdrawkcab (usually not responding to ACs; don't bother posting as AC)
is about risk.
There is no black and white demarcation.
An important lesson many people in the modern security business seem to forget.
The Kruger Dunning explains most post on
The security you're talking about it's not the type you think.
Now, if it were a bodyguard conference, maybe. But it's network security not building security or police security. It's also a conference, not a classified meeting. So I don't understand why they should have very tight policies, then it's an event open to public.
Just saying.
My first Defcon I didn't know what I was getting into, so I thought before paying the conference fee I would check it out. Checking it out turned into three days when I realized that anybody worth their social engineering salt was not paying :)
This is called "Operational Security" I am sure all the vendors were all about crypto and wireline/wireless security so it's not that embarrassing. A real achievement would be to access customer lists from one of the machines in the expo floor via the wi-fi network.
Like I once heard "SSL is like hobos sending letters via armored cars."
Really? this isn't surprising at all. the point of the conference is to share information, sell product, network with like minded and make a buck or two at the same time. what would you have them do, issue prox cards, setup access readers, post armed guards and install turnstiles? security measures are supposed to be commensurate with the risk based on the vulnerability to the value of the asset. value is low, vulnerability is moot, therefore risk is low. and this kind of press is actually free marketing, pure gold, you're a tool.
The RSA conference, like most industry conferences, is in very large part a sales conference for industry products. There's no reason for it to be particularly secure (obviously, they want to maintain some security to maintain ticket prices and the marketing value of the information gathered along with those sales), a few extra people coming in without paying isn't a huge deal (whereas intrusive security measures that inconvenience legitimate ticketed attendees would be.)
Its not like the conference presents eyes-only sensitive material that only ticketed attendees are cleared for and that there is some danger to the conference sponsors if anyone outside gets wind of it. Just because its a conference about security practices and products doesn't mean that it somehow has any particular high-security needs.
RSA 2012 is basically a big sales presentation.
To suggest sneaking in is a big achievement is like saying you got into BestBuy a few minutes early one day to shop for TVs.
Journalists do this all the time (good ones at least). My favorite is holding a walkie talkie to your ear and waving in acknowledgment to the guards (with a slight nod) while walking in. It's better to wear dark glasses for this one.
The security researchers inside the conference are no doubt very aware of security. The security hacks that implement the security for such conferences: not so much. Same problem with security everywhere.
The "security" at the RSA conference is the same "security" at CES. They aren't RSA people..they are event location employees. I go by them all the time for reasons..just say you are a speaker or something like that. They'll wave you right by...
We're not talking the internals of a bank here. It's just a big marketing event. The whole idea is to get more people in to see what's for sale.
"Breaking in" to a marketing event isn't something to get excited about.
fooling some of the people all of the time.
lost and confused some times can get you past people or if you get caught just act like you have the wrong building, wrong date, wrong conference.
I think security guards should be ready to be assertive and aggressive in securing a portal. If you're one of two guards and you've been given a post at two propped-open double doors, or any other very wide entryway, you should tell the boss to gather you up some form of corraling and queueing the incomers or else a way to partially block the entry, with a nice covered table perhaps.
Also, security guards should sign to responsibility for losses or threats incurred due to someone slipping past.
"Stratigraphically the origin of agriculture and thermonuclear destruction will appear essentially simultaneous" -- Lee
Security is everyone's responsibility. It's a common misunderstanding that techniques, methods etc should be kept a secret. /oldbie Infosec manager with a lawn to protect
even the subway may not check that close with a big group moving though.
A stadium just let out the station was packed and I like could of flashed a out of date / used ticket and they would likely not seen it or would of not tried to stop you if you did have a bad ticket.
Some times even on trains where you pay / check tickets on the train they can get so packed they don't even get to all the people.
When you have a big crowd moving in a small space some times fully checking cards / badges takes to much time.
I used to carry my shopping list on a clipboard, but I had to stop because people kept asking me questions about various products or where to find things. It was funny the first few times, but after a while it started to get old.
There's no -1 for "I don't get it."
I've been going to RSA now for many years, both as an attendee and as an exhibitor. By Thursday you'll see the occasional homeless woman (almost always female) going up and down the aisles grabbing all the candy, clothing and electronic widgets she can find.
Furthermore, I've never had to pay to get in. Simply mention an IT job title to a sponsoring vendor or sign up on a sponsoring vendor's web site and you can get a free pass months in advance.
Color me unimpressed by this article.
I was on the commuter train in San Diego. It was run mostly on the honor system but you can get a ticket if you can't show you have paid. It was packed and there was bairly room to stand
Two police officers jumped on and about 1/2 of the people (most looked like students) suddenly remembered it was their stop. Suddenly you could even sit down,
he is in the business of "pen-testing humans"
Is that not called "rape"? :)
I'm a good cook. I'm a fantastic eater. - Steven Brust
Hell, I joined the Ops team at Shmoocon this year without any credentials or signup. I tell you that isn't part of their plan. http://storyinmemo.com/?p=48
I spent a day at my first DEFCON missing my badge and managed to keep going all over the conference. Every year at DEFCON I make it a point to get into a guest-listed party that I didn't have access to. Why would RSA be different? I guarantee the DEFCON goons care more and the RSA ticket funds aren't going to making the conference more secure.
Their cost / benefit for tightening things down would be basically nothing.
SIG: HUP
It wasn't just any old 'badge though, it was psychic paper...
http://www.acetonestudio.com
It gets worse.
You don't even have to voluntarily sneak into a conference
Some of these conference security folks are such a joke and hotel layouts are messed up that you can end up in a conference even if you never intended to go to that conference.
I booked a night at a hotel in San Francisco once. I arrive on my bicycle after a long trip. I just wanted to check in, go to my room, and shower and *crash*.
Well, I ended up at this stoopid keynote reception with a bunch of suits. I was in lycra shorts and tee shirt.
***No one*** challenged me nor asked me if they could help me. I looked **utterly lost, tired, and miserable**.
After about 1/2 hour, I finally found the darn reception desk and checked in.
After a shower and a 6 hour nap, I got up to get something to eat.
And ended up in their stupid **banquet reception**.
I gave up and found a restaurant outside and ate
Sometimes I wonder if these conferences actually want to suck you in and get lost.
Just a tired bicyclist after 50 miles of 95 degree dusty heat wanting a little cool rest.
Most Respectfully Yours Mark Allyn Bellingham, Washington
Mwahaha, who thought that the real honey pot would work. Smoke and mirrors, smoke and mirrors...
Human penetration tester? Sounds interesting...
Are you mad? Never let a PHB have root. Give him a fake account and password and tell him it's better than root, only the VIPs can have it because it's so powerful.
Everything I need to know about disguises and being where I don't belong I learned from Fletch...
"I'm afraid I'm gonna have to pull rank on you. I didn't want to have to do this. I'm with the Mattress Police. There are no tags on these mattresses."
to cut costs. And if you look like you belong- the right age and clothing for the meeting- they may ignore you. I've snuck in to hear single talks by a friend. I didnt want to pay a multi-hundred dollar fee for that priviledge. I do pay if attend more of a conference.
I remember when DEFCON first moved to the Riviera and had large, white badges with LED arrays (the first of DEFCON's electronic badges, I think). Some guy got an honorable mention at the "Hack the Badge" contest because he'd been able to get by the hotel-provided guards (union rules or something prevented the goons from performing this function) with his own "badge." That "badge" consisted of a rectangle of white plastic with the work "HUMAN" written on it in with a black Sharpie.
"The art of disguise is knowing how to hide in plain sight." http://www.youtube.com/watch?v=mgJonrtCk0M