95: Jon & Brian's Big Adventure

This section explores the profession of physical security testing through the experiences of Jon and Brian, who are professional pentesters. They describe their elaborate preparations, from reconnaissance using mapping tools, social media analysis, to detailed gear packing. The section highlights the high level of planning involved, including the use of specialized equipment such as RFID cloning devices, lock picks, and tools for bypassing security systems. The narrative underscores the unpredictability and complexity of penetrating highly secure facilities, illustrating that despite meticulous planning, things can go wrong, which adds to the realism and challenge of red teaming.

Jon and Brian emphasize the importance of thorough reconnaissance before attempting physical breaches. They utilize Google Maps, social media, and publicly available resources to understand security layouts and personnel routines. Their initial in-person scouting at night reveals the limitations of online information and the need for actual on-site observation. Unexpectedly, their covert operations are nearly exposed due to a security guard noticing their circling rental car, leading them to quickly adapt by changing vehicles and disguising their appearance. The detailed preparations and real-time adaptations showcase the critical role of reconnaissance and flexibility in physical security testing.

This part discusses specific tactics and tools employed by the pen testers during their missions. These include RFID cloning devices, lockpicks, door bypass tools, ladders, and disguise gear. They describe their techniques for bypassing various security measures such as fences, doors, and sensors, often combining technical skills with physical agility. The account provides insight into the detailed planning for entry, including crafting disguises, using tools to manipulate security hardware, and timing operations during low-activity periods like late at night or shift changes, highlighting both the technical and physical demands of their craft.

Despite careful planning, Jon and Brian recount several moments where their plans faltered. These include being spotted by security cameras, triggering alarms, and a fall from a shed which injured Brian’s heels. They also encounter unexpected security infrastructure, such as newly installed fences or better-than-anticipated camera coverage, requiring immediate rethinking and improvisation. These incidents reflect the unpredictable nature of physical security breaches, emphasizing the importance of adaptability, quick thinking, and resilience in the face of real-world obstacles.

The narrative touches upon the importance of coordinating with clients and law enforcement beforehand to ensure safety and legality during these simulated attacks. Jon and Brian mention informing security teams and police to prevent misunderstandings. They also discuss the physical and emotional toll of their work, acknowledging the risks involved, including injuries. The episode underscores that professional penetration testers operate within a framework that emphasizes safety, permission, and responsibility to avoid real harm or legal issues, while still pushing the boundaries of security defenses.