Behind Closed Doors: Physical Red Team Tactics

The talk opens by separating penetration testing from red teaming, where stealth matters and a physical breach can serve as the initial foothold without the customer's blue team knowing. The methodology has three phases: reconnaissance from a distance and on site, then covert or overt entry, then objectives and persistence. The speakers use this structure to walk through several engagements.

At an industrial plant, satellite imagery and fence sensors ruled out climbing in, so the team posed as replacement cleaning staff during a pandemic-era staffing gap. A Raspberry Pi implant that was never tested failed the night before because of an incompatible LTE modem, and the fix took most of the night. At a mountain facility, a pretext for a new-joiner tour was cut short when HR could not verify it. A later night visit with the client's white team reached a control room, where an unlocked interface and cleartext admin credentials helped them attach a transparent bridge to a printer's network port and get past network access control. Their presence triggered an alarm and they had to leave. Other cases covered tailgating at a revolving door that failed, a smoke-break story that got a visitor inside, voice phishing with spoofed caller ID, and badge cloning of MIFARE Classic cards that still used default keys.

The takeaways are aimed at both staff and red teamers. Staff should verify visitors and any phone contact through known channels before acting, and should be willing to challenge unusual requests. Red teamers should prepare backup pretexts, avoid overplaying a story, and know when to step back.