Please create an account to participate in the Slashdot moderation system

 


Forgot your password?
Close
typodupeerror
×
Security IT

How To Sneak Into the Super Bowl With Social Engineering 164

Posted by timothy from the appropriate-authorities dept.
danielkennedy74 links to an instructive story captured on video introduced with these words: "Sneaking in near press/employee access points without going thru them, zigzagging through corridors, and once carrying a box so someone opens a door for them, two jokers from Savannah State University social engineer their way into Super Bowl XLVII for the most part simply by looking like they belong." USA Today has a slightly longer article.
This discussion has been archived. No new comments can be posted.

How To Sneak Into the Super Bowl With Social Engineering More

How To Sneak Into the Super Bowl With Social Engineering

Comments Filter:

  • Comment removed (Score:5, Funny)

    by account_deleted ( 4530225 ) on Monday February 11, 2013 @03:24AM (#42856543)
    Comment removed based on user account deletion

    • Re: (Score:2, Insightful)

      by Anonymous Coward

      Are you so afraid you can not read such stories without immediately thinking about "gitmo", black helicopters or something? Don't be a coward, you will be dead in 100 years no matter what you do. Let go, don't worry and start doing stuff you want to do before your time is up.

    • Re: (Score:2)

      by Kagato ( 116051 )

      Gitmo, nah. But they did document their trespassing. They have a scene where they are shown lying to a cop which might be a bigger crime than the trespassing.

  • Justice works slowly, but finally it will get one.

  • "by holding a box" (Score:5, Insightful)

    by girlintraining ( 1395911 ) on Monday February 11, 2013 @03:30AM (#42856571)

    How many hundreds of millions did Homeland spend to "secure" the super bowl again? Of all the things they've been accused of, fewest of the charges have been competence. When a couple college kids carrying a box can sneak past every security check point, without either them or their box being inspected, it becomes painfully obvious that the security provided is just a show... not unlike the one they're "protecting".

    • Re:"by holding a box" (Score:5, Interesting)

      by Pubstar ( 2525396 ) on Monday February 11, 2013 @04:26AM (#42856781)
      This whole thing reminds me of the oldest trick in the book to get into night clubs: Have an extension cord/Power strip/DMX cable over your shoulder and just book it past the bouncer saying they need it on the stage NOW or the DJ is going to flip out. Works 99% of the time without you being so much as questioned.

    • Re:"by holding a box" (Score:5, Funny)

      by guttentag ( 313541 ) on Monday February 11, 2013 @04:36AM (#42856829) Journal
      Actually, carrying a box that looks burdensome implies you are doing work, so people assume you belong there. I once walked into the courtyard of a large "fruit company" by helping a vendor carry in a box. He assumed I worked there, and they assumed I was with him. I even got a name tag at the door.
    • Comment removed based on user account deletion

  • congrats! (Score:3, Insightful)

    by sdnoob ( 917382 ) on Monday February 11, 2013 @03:37AM (#42856589)

    You just ensured DHS VIPR teams will harass, molest and radiate every person that gets within a block of every Superbowl venue from here on.

    • Re:congrats! (Score:5, Insightful)

      by Anonymous Coward on Monday February 11, 2013 @03:44AM (#42856617)

      I find it funny how You somehow make it their fault and not DHS'

    • You just ensured DHS VIPR teams will harass, molest and radiate every person that gets within a block of every Superbowl venue from here on.

      Yup. Because all it takes is a couple of teenagers pulling a prank for our government to whip out the disintegrator rays and their flying armchairs and start zapping people while screaming "We're saving you motherf--ers! ZAP! SAFE! ZAP! SAFE!"

    • You just ensured DHS VIPR teams will harass, molest and radiate every person that gets within a block of every Superbowl venue from here on.

      Fantastic! The only way the war diginity gets cancelled is if enough people are made to suffer the indiginities of it.

  • Security is only as good as its weakest link. (Score:5, Insightful)

    by Chas ( 5144 ) on Monday February 11, 2013 @03:49AM (#42856647) Homepage Journal

    Unfortunately the weakest link is always going to be found in the form of huge sacks of protoplasm known as "people".

    This is why, no matter how well trained you get security, social engineering attempts like this will succeed more often than not.

    People are pretty much indoctrinated since birth to try to get along. So if someone looks authoritative, there's a default reaction to simply go with it.

    There's only so many things a person can pay strict attention to at a time. Eventually they're going to reach the limit of things they can keep straight in their heads. And openings in their awareness will occur.

    There's only so long that people can keep up such vigilance before they start relaxing. It's not laziness so much as stimulus saturation.

    I don't care how much money "security" firms and agencies throw at the situation. The only way to avoid it is to not have such events in the first place.

    • Re:Security is only as good as its weakest link. (Score:4, Interesting)

      by Anonymous Coward on Monday February 11, 2013 @04:32AM (#42856805)

      Pay one person who knows what he's doing per hour to try to sneak in. Track performance and give bonuses to the people who manage to stop the intruders. The job of security is now suddenly a lot more interesting and challenging. Of course, actual productive work that spans the security area will grind to a halt due to security delays. In the military, newbies get told to guard something and then everyone else is supposed to try to get in. You don't have security if you don't test it.

      • In which military, and in what years, did this happen? I find it hard to believe that this is/was common practice in any branch of the US Armed Forces.

        Marines guard most of the Navy's gates, facilities, etc, and it makes a marine's day to throw a sailor on the ground, stick the muzzle of a rifle in his ear, and shout "DON'T MOVE MOTHERFUCKER!!" In fact, a private on Adak Island was promoted to corporal after doing exactly that to a Navy Captain. Marines might be slightly more polite to civilians, dependi

        • I will guard everything within the limits of my post and quit my post only when properly relieved. _1st General Order, US Army. Heresay military studies of the time of my introduction to olive drab as a fashion statement were reported to suggest that privates with higher ASVAB scores (military IQ test) made worse sentries that those below a certain level of measured intelligence.

        • Re: (Score:3)

          by sribe ( 304414 )

          NO ONE goes into a secure area without authorization. Period.

          I did once. As a civilian no less. Stupid gits I worked for sent me out with spare parts and neglected to tell me that the small anonymous-looking complex in the middle of town with an obscure bland name was a military research facility. Guard was asleep, slumped over so far I didn't even see that the uniform was real military as opposed to generic rent-a-cop. I drove on in, thinking I was being nice not waking the guy up.

          Oh boy, from what I heard, hilarity ensued in my wake. Fortunately this happened decad

        • The Army? I can't speak for them. I had almost zero contact with them while on active duty.

          I can't speak for actual security around the base (I was a bit too paranoid to deviate from my known-safe route), but the gate guards at the Army base where I had a civilian job were just rent-a-cops. That base is now joined with the neighboring Air Force base, but I (along with just about every coworker I had), left long before that happened so I don't know if the rent-a-cops were replaced.

      • Re:Security is only as good as its weakest link. (Score:5, Insightful)

        by Dr. Evil ( 3501 ) on Monday February 11, 2013 @07:35AM (#42857613)

        "Track performance and give bonuses to the people who manage to stop the intruders."

        Ensure the bonus even goes to the average schmo hot-dog vendor who challenges somebody who doesn't have their ID showing. It's not a new strategy, but turning it into a game like this shifts cultures. Suddenly all the con-man defenses of "seriously, don't you know me?", "man, you're uptight, chill." or "Bob says it's okay" fall out the window to your "hey, I get $50 if you don't have a badge".

        Not to pick on hot-dog vendors. They're probably more people savvy than most of your security team.

        • This is a really really good idea. I might actually recommend this where I work. They are super anal about security here... hmmm :)

        • "Track performance and give bonuses to the people who manage to stop the intruders."

          Ensure the bonus even goes to the average schmo hot-dog vendor who challenges somebody who doesn't have their ID showing. It's not a new strategy, but turning it into a game like this shifts cultures. Suddenly all the con-man defenses of "seriously, don't you know me?", "man, you're uptight, chill." or "Bob says it's okay" fall out the window to your "hey, I get $50 if you don't have a badge".

          Not to pick on hot-dog vendors.

    • While I agree social engineering more often then not works, it is actually a sign of POOR training or execution of the security staff. This is exactly the type of thing they should be looking for. I work in areas with security where even if you know the name of the guard and drink with him on a Friday night he won't let you in without a security check and a valid pass as he knows that if he doesn't do it and someone sees him not doing the check he will get canned, The fact that they could socially engineer

    • Re:Security is only as good as its weakest link. (Score:4, Funny)

      by thegarbz ( 1787294 ) on Monday February 11, 2013 @06:59AM (#42857433)

      Unfortunately the weakest link is always going to be found in the form of huge sacks of protoplasm known as "people".

      I've heard the TSA called a lot of things, but never "people".

    • Re: (Score:2)

      by m00sh ( 2538182 )

      This is why, no matter how well trained you get security, social engineering attempts like this will succeed more often than not.

      As long as the security is better trained than the social engineer, this will not succeed.

      People are pretty much indoctrinated since birth to try to get along. So if someone looks authoritative, there's a default reaction to simply go with it.

      Something that can be easily changed with training.

      There's only so many things a person can pay strict attention to at a time. Eventual

      • Re: (Score:2)

        by Chas ( 5144 )

        This is why, no matter how well trained you get security, social engineering attempts like this will succeed more often than not.

        As long as the security is better trained than the social engineer, this will not succeed.

        Sorry. But it's not only a matter of training. You can train people all day, every day to eat breathe and live this stuff. And, given the proper environment, it STILL all goes out the window and they default to social indoctrination.

        People are pretty much indoctrinated since birth to try to get along. So if someone looks authoritative, there's a default reaction to simply go with it.

        Something that can be easily changed with training.

        *Easily* huh? I believe your idea of *easy* and mine are two COMPLETELY different things. And, again, it's not merely all about training.

        There's only so many things a person can pay strict attention to at a time. Eventually they're going to reach the limit of things they can keep straight in their heads. And openings in their awareness will occur.

        The human brain does not work that way. With increasing complexity, the human brain groups patterns of actions into one and there is no shown limit of how much stimulus a human brain can handle in this way.

        With increasing complexity, the human brain groups patters of actions into one. Which means they lose to stimulus saturation. Reacting

    • I don't care how much money "security" firms and agencies throw at the situation. The only way to avoid it is to not have such events in the first place.

      What, just ban any event where two or more people gather together? That'll work out well.

      • Re: (Score:2)

        by Chas ( 5144 )

        That's not what I meant.

        It's a way of saying that there is no easy or pat, acceptable answer to this.

    • People are pretty much indoctrinated since birth to try to get along. So if someone looks authoritative, there's a default reaction to simply go with it.

      I think that people (hominids) have been bred for at least the last 2+ million years to try and get along. It is a vital tactic for creatures weak in tooth and claw to band together, and earlier hominids were much smaller and weaker than those that can later.

      The ideas of "truth" and "rules" are very modern, maybe just tens of thousands of years. You may happen to be correct that heading north is 75% likely to find game animals, but if the Alpha says we should go south where you correctly believe success i

  • This was done 6 years ago (Score:5, Interesting)

    by mentil ( 1748130 ) on Monday February 11, 2013 @04:00AM (#42856681)

    Zug.com snuck into the super bowl using social engineering as well.
    Details here [zug.com]

    • Re:This was done 6 years ago (Score:5, Interesting)

      by girlinatrainingbra ( 2738457 ) on Monday February 11, 2013 @04:28AM (#42856789)
      Very nice linked article about the Zug.com prank team. I particularly like that they did it just a few days after the Boston LED Art prank that everyone thought was part of a bomb, and that they were still able to get away with it. They fucking moved two pallets of shrink-wrapped necklace LED lights that weighed a quarter-ton through security and into the stadium. Astounding that anyone can sneak in if they can pass the cardinal 5 rules listed!
      Lost in this spectacle, it was easy for me to slip past the security station by just pretending I belonged. I make this sound easy, but in fact I was just following the five magic rules for getting into any event in the world:
      1. Wear a suit.
      2. Wear a Bluetooth headset.
      3. Pretend to be talking loudly to someone on the other line.
      4. Carry a clipboard.
      5. Be white.

      Also another killer quote from the fifth page when they ask the bomb squad to be allowed to borrow a small flatbed truck: http://www.zug.com/pranks/super/index05.html [zug.com] :

      The psychology of cat and mouse is that the mouse will never walk up to the cat and ask if he can borrow a forklift. Mice just don't do that.

      Now of course, they never show the message, and I don't see proof that they plled it off, so is the prank on us? ;>)

      • Re:This was done 6 years ago (Score:5, Informative)

        by MichaelSmith ( 789609 ) on Monday February 11, 2013 @05:07AM (#42856923) Homepage Journal

        Yeah like the Chaser APEC prank [wikipedia.org]

        • Thanks for the link about the Chaser APEC Prank. It is closer in that they were surprised by how far they got:
          Morrow pointed out that while they did extensive planning for the stunt, the one thing they "didn't plan for was success"; the participants were confused by the unexpected permission to enter the area, and unsure how to proceed; they clearly sensed danger, but the atmosphere was actually very quiet and subdued.

      • This is also a very real possibility, in this crispy new age of "sensational story - haha, it's just a joke, so long and thanks for all the ad clicks."

        My big response is below. I'll end here by just saying that there is something seriously wrong with this story, so I'm not going to sit on pins and needles for 2-4 days for it to pan out as a joke if it is. Because if it's not, we're all busy going "haha cool joke man" when the 100 people pictured in this video are going to lose their jobs.

      • 5. Be white.

        Did you watch this video? The two guys who got in were black. I know it's fashionable to hate on whitey and grant him magical unfair advantages at *everything*, but these two dudes just proved that black guys can play that game too.

        • Re: (Score:2)

          by Dins ( 2538550 )

          He was quoting the article on Zug.

          (But I agree with you on general principle)

        • There's a very real possibility a couple of black men sneaking into certain events, for instance a Superbowl in New Orleans, would stand out even less than a couple of young white men. That said (with regard to the cat and mouse analogy), when you're playing a mouse and there's no real chance the cat will catch and eat you, the pressure and nervousness factor is an order of magnitude less than a real run at espionage.
  • Is it too much to ask for steadycam?
  • After doing some security work at events, there's some easy tips on what todo/not todo.

    1) have some good lucking women with you. Chances are you'll have a guard somewhere that can be distracted by cleavage.
    2) if there's 2+ of people trying to blag their way in, A) only let 1 person talk B) if you're both talking, have the same script "My boyfriend went to the room to get the tickets and they were gone" from the girl, as the guy's saying "I left the tickets in the car, I think the valet took them" WILL get you turned away.
    3) turn up when there's a line, before the event starts of course, but not too early, if you make a scene, it might be easier to just let you in.
    4) if you get turned away by one guard, ask who you need to see to sort this out, go to them, be nice, wave back at the first person who sent you over, if they wave, say 'he took the ticket and said it was ok'
    5) never say 'do you know who I am', and if you do, don't claim to be the person stood behind the guard. (that cracked me up)
    6) if there's a list with names on, you might be able to peek and claim a name.
    7) "where'd you get this obviously fake ticket?" "there's a guy in the foyer selling them, he said it was legit" "it's not, you need to see that person and get your money back" "but I have a ticket!" "it's fake" "but it's for this event" "yeah, no." is the wrong way. Playing the sob story that this was what you bought online, give as much info as you can. If an event has 5k tickets printed, it's not unknown for the printer/promoter to not only keep some tix behind, but to run dupes. This isn't the punters fault, dropping hints that the promoter/printer is dodgy is all too believable and may help you get in if they think you've done the right thing, not got a cheap tix from a dodgy guy out front.
    for an event that's 'no re-admittance', the old 'I have explosive poop' will get you out, but might not get you back in, still, worth a try.

    I get how social engineering works. Work a door for a few nights, manage an event, you'll hear all sorts of things and very quickly learn what'll never work, what /might/ work.

  • Somebody here called for an electrician. Can you tell me what the fault is?

    Shit man, it's dark in here!

  • I've done this by accident a number of times at both the Asia Series and World Baseball Classic at Tokyo Dome. Thinking back, all I did was have a general admission ticket on a pass carrier around my neck and just walk into the press area while nodding to the guard at the entrance. I was supposed to meet some friends there once, but they got stopped by security. "What? This is a restricted zone?" I had no idea before then that anyone wasn't allowed in there.

    I guess it goes to show that if you really b

  • The best I've seen yet... (Score:5, Interesting)

    by Anachragnome ( 1008495 ) on Monday February 11, 2013 @05:29AM (#42856981)

    The best I've seen yet was a kid (I'm guessing around 16 yrs old) I watched in action at a concert at the Cow Palace in San Francisco many years ago.

    A friend and I were waiting in line at a Judas Priest concert when I noticed this guy, wearing a light-blue button-up shirt and slacks, using one of them sweeper things--you know, the little broom and a pivot mounted dustpan thing on a long handle that is used to sweep trash into. He was working his way along the line, sweeping up all the crap the people in line were dropping. I watched as he filled the dustpan with trash, walked over to a trashcan near the door, emptied it and went back to work around the entrance--he swept the place clean, then started working his way around the inside of the front door area, even asking one of the security personnel to step aside so he could get to a soda can just behind him. I remember telling myself "What a lame job".

    45 mins later, he was standing next to me about 10 feet from the stage, smoking a joint and obviously enjoying himself. After asking him if he minded passing that thing, I asked him where his broom was. He said with a big, stoned grin on his face that he usually leaves it in the bathroom until after the show. Sure enough, when I went to the bathroom between acts, his sweeper and broom were sitting in the corner.

  • So why is this on Slashdot?

    • Because of the immense blowback that's about to happen.

      If this was told as a "college beer frat party" story even if it was all the same, we would all have "lol okay back to work". Instead there's *video footage of people and "stuff" (places, unmanned areas, etc.)

      So we have a real problem coming up: Youtube is already ahead of us wondering if this is just a "footage hoax" ... or the big mean Security Theater Beast will be really PISSED and then we'll see more rounds of lockdown.

      Bruce Schneier himself said a

      • Easy there... this is Slashdot and generally folks here who exploit weaknesses in security systems without regard for personal gain are on the white hat side of the field. Here's what should happen: these two will make their 15 minutes complete with a round of guest appearances on the morning show circuit, and if the story really catches on, maybe even culminating with a nighttime appearance on Letterman. If any lesson is to be learned from this breach by security forces, it is probably one they already s

  • Public shows (Score:4, Interesting)

    by adolf ( 21054 ) <flodadolf@gmail.com> on Monday February 11, 2013 @06:00AM (#42857097) Journal

    It's not so hard to get from A to B in any public show: The trick is just to act like you belong there, just like everyone else who also belongs there. Blend in.

    My own favorite was at a show at the Detroit State Theater. We had assigned seats in the balcony, but the sound really was very bad up there. So we left, wandered, and came up to the entrance for the general-admittance floor area.

    There were two security guards looking at tickets before people were allowed into this space, with a small line formed before each of them. We walked right between them as if we owned the venue ourselves, and didn't encounter any trouble. (The sound at front, stage-left was excellent. Kudos to the boardmonkey, and meh to whoever it was that specified the line arrays for that show.)

    And for other intermittently-crowded places, carrying a Motorola 2-way portable radio helps. You can direct traffic and behave authoritatively in almost any capacity, even with long hair, regular clothes, and a beard, as long as you have a radio and the gumption to make it look like you belong there. Do that for a little bit, and nobody around will think twice when you slip in through a side door. And after that, just blend in differently: At that level, people aren't paying much attention to security.

    (And no, it doesn't matter if the radio works or can talk to anyone.)

    So: Social engineering one's way into the Superbowl? Nice feat, but not very surprising.

  • This method has been used by about a gazillion people in so many places, so many times, it just doesn't seem like news. Perhaps the only reason it is "news" is because these guys filmed it? I don't know.

    I've done the same thing plenty of times to get in place I shouldn't be; all it takes is a pair of cohunas and a bit of front to just go right in where you want to, without stopping once to check you are in without being noticed.

  • Look like you belong... (Score:5, Interesting)

    by LoRdTAW ( 99712 ) on Monday February 11, 2013 @08:11AM (#42857835)

    is one of the oldest tricks in the books. I used to work for an entertainment company lugging around equipment. I have been to many venues and big hotels in Manhattan and some are pretty secure, requiring you to sign in and have your picture taken. But there are plenty where all you do is is walk in there like you own the place and no one says anything. As long as you are carrying something then they assume you are part of some staff and just let you walk right in. Even the secure places just require you to say you are from company X for party Y and they let you in without any scrutiny. The parties are planned by a planner who is not part of the venue. So security has no way to easily contact the planner to verify if vendor x is legit or not. They just do their job which is to get a signature and hand out a flimsy sticker pass. If you use a little creative social engineering and figure out what party is happening where you could easily gain access. Even carrying around some legit looking paper work is enough to get you into a venue.

    Once we did a party in the museum of natural history, they have a private room in the back (I hear it was $20,000+ just to rent the room, rich kids, you should see some of the parties I have seen, amazing. Once I setup a million dollar bar mitzvah on the intrepid). Me and the guy I did the delivery with setup all the equipment and then walked down the hallway, jumped a set of ropes into the museum and went to the planetarium. No one stopped us or asked us what we were doing.

    Across the street where I live is a house which the owner defaulted on his loan. Well he also had a loan through two other banks so the house sits there as the banks cant agree on a decent price which would let it sell. So one day I hear the house was robbed of all its copper pipe, electrical wiring along with the boiler and hot water heater. One neighbour said he saw a van parked outside with some men working in the house. They weren't working but robbing the place. All they needed to do was look legit and no one would question them. Essentially its more difficult to gain access if you look suspicious or try to hide what you are doing.

    • Re: (Score:2)

      by sribe ( 304414 )

      One neighbour said he saw a van parked outside with some men working in the house. They weren't working but robbing the place. All they needed to do was look legit and no one would question them.

      Yep, unoccupied house next to mine, one day all the furniture went away in a moving van driven by thieves...

      • Re: (Score:2)

        by LoRdTAW ( 99712 )

        Seriously, if you want to rob someones house all you need to do is to stakeout the place for a few days to get the owners habits down and then come back with a van with lettering on the side. I have seen so many beat to shit vans with writing done in marker, spray paint and those black-lettering-on-gold house number stickers. They look like creepy rape vans but they are legit. So its impossible to know who is legit and who isn't. Just roll up in a van or pickup truck, wear a tool belt and your good to go. T

    • The high use of subcontractors and contractors makes it even easier as you can say stuff like my firm does not give us ID's or just show some thing that looks like a work order.

  • I remember this was called a con job. You con someone into believing you are someone else, just like conmen have been doing for thousands of years. There's nothing really new about it.

  • That is all.

  • In a discussion about shoulder mount ENG cameras (are we getting to a point if it's shoulder mount, is it regarded as old technology including new $40K Panasonic HD with P2?). Someone said he attends lots of concerts for free. He stops by the news station, gets a non-working camera and gains access as media (does not show a badge but it's the impressive camera that does it). And if his girlfriend wants to join, he gets a microphone for her. He said at one concert the security guard wanted to be interviewed.

Slashdot Top Deals

The unfacts, did we have them, are too imprecisely few to warrant our certitude.

Close