Flow Like Water - Experiences from Physical Red Teaming

The speaker, a red team operator, presents the physical security side of adversary simulation. Each engagement starts with a target address and about a week to plan. Before any entry attempt, the team studies the site through open sources, such as satellite imagery of access points, cameras and badge readers, and social media posts showing staff badges. They also watch the building on foot and by phone, looking for smoking areas, guest Wi-Fi and crowds where badges are easy to read.

The talk then covers the tooling and pretexts used to get inside. Badge readers come in low- and high-frequency types, which changes the read range and the kit needed to collect credentials. The team uses delivery and maintenance costumes, a fake package carrying a reader, and a rogue reader placed at a bathroom door to harvest badge data. A lost-dog poster was used to find out which reader type a building ran. Modified under-the-door tools open crash bars, and drop boxes are disguised as ordinary hardware. Once inside, the team installs keyloggers and monitoring devices that connect over a mobile hotspot.

The speaker closes with operational lessons: a persona must fit the role and the time it can plausibly spend on site, a blown cover ends the operation, and night-time badge reads are safer than noisy lock picking. The main takeaway for defenders is that badge controls and staff awareness fail together, so both need testing.