How To Sneak Into the Super Bowl With Social Engineering 164
danielkennedy74 links to an instructive story captured on video introduced with these words: "Sneaking in near press/employee access points without going thru them, zigzagging through corridors, and once carrying a box so someone opens a door for them, two jokers from Savannah State University social engineer their way into Super Bowl XLVII for the most part simply by looking like they belong."
USA Today has a slightly longer article.
This was done 6 years ago (Score:5, Interesting)
Zug.com snuck into the super bowl using social engineering as well.
Details here [zug.com]
Re:"by holding a box" (Score:5, Interesting)
Re:This was done 6 years ago (Score:5, Interesting)
Also another killer quote from the fifth page when they ask the bomb squad to be allowed to borrow a small flatbed truck: http://www.zug.com/pranks/super/index05.html [zug.com] :
Now of course, they never show the message, and I don't see proof that they plled it off, so is the prank on us? ;>)
Re:Security is only as good as its weakest link. (Score:4, Interesting)
Pay one person who knows what he's doing per hour to try to sneak in. Track performance and give bonuses to the people who manage to stop the intruders. The job of security is now suddenly a lot more interesting and challenging. Of course, actual productive work that spans the security area will grind to a halt due to security delays. In the military, newbies get told to guard something and then everyone else is supposed to try to get in. You don't have security if you don't test it.
Re:congrats! - This isn't news (Score:4, Interesting)
I guess I fail to see how this is new
Who said it was new? What is great about it is that the superbowl was classified as a "Level I National Security Event" [forbes.com] - the very tippy-top of Homeland Security's classification system. These are the events they spend beaucoup (but not published) dollars on "securing" from oogy-boogy terrorists.
So, despite all this focus on security and crap, these kids just waltzed on in. Yet more proof of how much of a waste of money DHS's 43 billion dollar budget really is.
The best I've seen yet... (Score:5, Interesting)
The best I've seen yet was a kid (I'm guessing around 16 yrs old) I watched in action at a concert at the Cow Palace in San Francisco many years ago.
A friend and I were waiting in line at a Judas Priest concert when I noticed this guy, wearing a light-blue button-up shirt and slacks, using one of them sweeper things--you know, the little broom and a pivot mounted dustpan thing on a long handle that is used to sweep trash into. He was working his way along the line, sweeping up all the crap the people in line were dropping. I watched as he filled the dustpan with trash, walked over to a trashcan near the door, emptied it and went back to work around the entrance--he swept the place clean, then started working his way around the inside of the front door area, even asking one of the security personnel to step aside so he could get to a soda can just behind him. I remember telling myself "What a lame job".
45 mins later, he was standing next to me about 10 feet from the stage, smoking a joint and obviously enjoying himself. After asking him if he minded passing that thing, I asked him where his broom was. He said with a big, stoned grin on his face that he usually leaves it in the bathroom until after the show. Sure enough, when I went to the bathroom between acts, his sweeper and broom were sitting in the corner.
Public shows (Score:4, Interesting)
It's not so hard to get from A to B in any public show: The trick is just to act like you belong there, just like everyone else who also belongs there. Blend in.
My own favorite was at a show at the Detroit State Theater. We had assigned seats in the balcony, but the sound really was very bad up there. So we left, wandered, and came up to the entrance for the general-admittance floor area.
There were two security guards looking at tickets before people were allowed into this space, with a small line formed before each of them. We walked right between them as if we owned the venue ourselves, and didn't encounter any trouble. (The sound at front, stage-left was excellent. Kudos to the boardmonkey, and meh to whoever it was that specified the line arrays for that show.)
And for other intermittently-crowded places, carrying a Motorola 2-way portable radio helps. You can direct traffic and behave authoritatively in almost any capacity, even with long hair, regular clothes, and a beard, as long as you have a radio and the gumption to make it look like you belong there. Do that for a little bit, and nobody around will think twice when you slip in through a side door. And after that, just blend in differently: At that level, people aren't paying much attention to security.
(And no, it doesn't matter if the radio works or can talk to anyone.)
So: Social engineering one's way into the Superbowl? Nice feat, but not very surprising.
Look like you belong... (Score:5, Interesting)
is one of the oldest tricks in the books. I used to work for an entertainment company lugging around equipment. I have been to many venues and big hotels in Manhattan and some are pretty secure, requiring you to sign in and have your picture taken. But there are plenty where all you do is is walk in there like you own the place and no one says anything. As long as you are carrying something then they assume you are part of some staff and just let you walk right in. Even the secure places just require you to say you are from company X for party Y and they let you in without any scrutiny. The parties are planned by a planner who is not part of the venue. So security has no way to easily contact the planner to verify if vendor x is legit or not. They just do their job which is to get a signature and hand out a flimsy sticker pass. If you use a little creative social engineering and figure out what party is happening where you could easily gain access. Even carrying around some legit looking paper work is enough to get you into a venue.
Once we did a party in the museum of natural history, they have a private room in the back (I hear it was $20,000+ just to rent the room, rich kids, you should see some of the parties I have seen, amazing. Once I setup a million dollar bar mitzvah on the intrepid). Me and the guy I did the delivery with setup all the equipment and then walked down the hallway, jumped a set of ropes into the museum and went to the planetarium. No one stopped us or asked us what we were doing.
Across the street where I live is a house which the owner defaulted on his loan. Well he also had a loan through two other banks so the house sits there as the banks cant agree on a decent price which would let it sell. So one day I hear the house was robbed of all its copper pipe, electrical wiring along with the boiler and hot water heater. One neighbour said he saw a van parked outside with some men working in the house. They weren't working but robbing the place. All they needed to do was look legit and no one would question them. Essentially its more difficult to gain access if you look suspicious or try to hide what you are doing.
Re:hmmmm (Score:5, Interesting)
Not necessarily. Sometimes social engineering takes advantage of people's assumptions. If you wear a printer servicing uniform and people assume that you're there to fix a printer, are you lying or deceiving them? I'd posit that their assumptions are incorrect and you're not deceiving them unless you're challenged and you start lying.
Bullshit, of course you're deceiving them. You cannot expect normal human beings to question all their assumptions 24/7. Every time you blinked you'd have to prove to yourself that the whole universe hadn't just been switched off and then instantaneously recreated itself.