How I Breached a Company with Donuts, my Story: 7:30am. I sat in the employee parking lot in my car watching people walking in and out of the corporate building. Most stood at their cars and talked for a few and then headed into the building. I was hired by this particular company to do a physical penetration test. Their goal was to see if I would be able to infiltrate their company unnoticed and see what I was able to gather. Many large corporations do a great job of having external and internal network penetration tests but often lack having a physical test performed. This company wanted to learn their physical weaknesses. 8:10am. Most of the employees are already in the building. I knew there would be some late stragglers in a hurry, so I thought I'd take advantage of that. I got out of my car, grabbed the 5 dozen donuts in the back seat and made my way to the door. As I looked like I was struggling to carry the donuts, they kindly held the door for me. I'm in. I wore no badge. I didn't have a keycard to get into the building. However, kindness and possibly the love of donuts got me in the door. I asked the person who left me in the door where the closest breakroom was. They pointed me down the haul on went on their way. 8:15am. I'm let loose inside the building of this company. As I walked down the hallway to the breakroom, I noticed many empty cubicles. I took a mental note in my head and kept walking. When I got to the breakroom I put the donuts down, stood there and ate one, and even said "Hi" and nodded to a few people as they came in and out for their coffee and donuts. I'm pretty sure I even made some lame jokes about it being too early in the morning. Again, no questions asked about who I was or why I was there. I walked back to the empty cubicles I saw earlier and I sat myself down. Being a fairly short guy, I was able to walk around pretty easily because the cubicle walls were taller than I was. 8:30am. Sat down with my laptop that I had in my backpack. Opened it up, plugged it into the local network port. There I was, fully connected to their internal network as well as the internet. No Network Access Control in place. I sat there for about an hour running tools to get a complete picture of their entire network. I got up, walked to the breakroom to grab another donut, and then walked out of the building. From my tools and scans, I had a list of every system and technical vulnerability within the company. Undetected. The only good news is that I was hired by that company to do this. Certain people (VPs, Management) knew that I was there. They used my results to educate their employees on awareness so that it didn't happen again. Moral of the story? People are kind, but companies need to do a better job of educating awareness. Always keep your eyes open. Ask questions. Donuts are good, but not always worth it. p.s. Chocolate covered are my fav. 🍩 Want to Work with Me? There are Two Ways: 1. Want in Cyber? Visit me at breakincyber.com. 2. If you are already in Cyber but stuck, let's talk. ⬆ #cybersecurity #informationsecurity #infosec #leadershipbyexample