Initial Onsite Reconnaissance

With any reconnaissance, it is essential to have an idea of what to look for. There are several things that you should keep an eye out for on any onsite reconnaissance mission. Be sure to determine the number of guards if possible. This may require some inference, as for every guard that is visible from the perimeter, there are likely several more in other locations. Once the frequencies used by the guard radios are discovered monitoring the guards’ radio traffic is another way to verify the number of guards onsite. Most online map services offer aerial views which are a great starting point when you need a sketch of the target site. A sketch of the target facility will be helpful to mark locations of guards, antennas, cameras, and any other useful information. Pay attention to any antenna seen on the property or attached to the building. Note the type of antenna and size to try to determine the frequency range it operates on. Also look for cameras, and see if they appear to be wireless, most wireless cameras have an antenna on them or are attached to a transmitter box with an antenna coming out of it.

The Guard Force

If there are security guards, it is essential to learn as much about them as possible while profiling. This can easily mean the difference between a successful and an unsuccessful penetration test. Security Guard uniforms hold a great deal of information. Contracted guards will often wear the uniform of the contracting company, and knowing the name of the guard company allows you to use the techniques in the offsite profiling chapter to search for the frequencies they use. It is also common that there will be a mix of contracted guards and guards employed by the target organization. This is common in both the government and private sectors, and it is likely that in this situation the contracted and employee guards will be dressed differently. The contracted guards will generally wear standard guard uniforms, and the employee guards will often wear ties and blazers or suits. The employee guards are usually in locations where they interact with other employees, such as at the reception desk or assigned to executive protection while the contract guards will generally be found patrolling the perimeter or guarding remote locations. If contract guards are present, it can take a week or more of observation to determine their shift rotation. Also note if the guards are the same each day. While it is uncommon, as a company is usually assigned a specific set of contract guards, if there is high turnover with the contractors it will likely make it easier to impersonate a guard and gain access. Discovering guard names, whether from nametags, badges, or desk placards can also prove valuable. Remember, the more you know about the target environment, the better the chance of a successful penetration assessment.

Using a Frequency Counter

A portable frequency counter (Figure 5.2) is one of the most valuable pieces of equipment for onsite profiling. They work by counting the number of beats, or oscillations in the airwaves of a set period of time, giving the frequency of those oscillations and thus the transmission frequency. An important caveat is that if there are multiple transmission frequencies in the vicinity, the frequency counter will give false data as it will likely combine the oscillations and give an inaccurate frequency count. Frequency counters work best at counting a single signal in a low noise environment, as they need a signal that is high enough over the noise floor that the counter can separate that signal from the background noise and only count that waveform. The frequency counter will display the closest “near field” signal, which must be approximately 10–15 times as strong as other signals in the area, and the closer the frequency counter is physically to the signal, the better the chance that the frequency counter will be effective. It is becoming more and more difficult to find a place where there is single signal in a low noise area, as today’s world is an extremely RF-rich environment. With the proliferation of wireless phones and the wireless network towers, it can be a challenge for the frequency counter to lock onto a signal. This is especially difficult when in a signal rich urban area or when there are multiple transmitters in a single tower. Additionally, commercial radio, pager, television, and emergency dispatch towers can cause havoc for the frequency counter. This makes sense, as radio, television, and emergency dispatch towers must have the power to broadcast over a geographically large area, while the two-way radio transmitters used by many organizations must only blanket a comparatively small area. The law of inverse squares means that the closer you are to a signal, the stronger the signal will be. It should, of course, be obvious that a handheld frequency counter will generally allow you to get fairly close to the signal source. This is especially true when you have access to the interior of the facility that is being targeted.

For penetration testers we recommend an Optoelectronic Scout frequency counter (Figure 5.4). The Scout has many advantages over a normal frequency counter, and the extra features are very useful for a penetration tester. The Scout can hold multiple frequencies as well as multiple hits per frequency, and the frequencies can be downloaded to a computer for easy analysis. This can be a huge time-saver, as reading frequencies from a frequency counter screen and entering them into a computer can be a real headache. The Scout also offers reaction tuning, which means that it can automatically tune a compatible scanner to a frequency seen by the Scout. While this has limited usefulness, we have found that in some situations it can be helpful and save time. For example, if once onsite there is not enough time for proper profiling, and reaction tuning may allow you to quickly monitor signals in the area. While this is no substitute for proper profiling, it is a good hack if needed. Additionally, if the budget allows it, an extra scanner doing reaction tuning during an assessment can be a great way to catch frequencies missing during the onsite and offsite profiling.

What is most useful as far as the Scout, however, is its small size and portability. The Scout can be kept in a backpack or worn on a belt under a coat, which is helpful in situations where discretion is necessary. Being seen removing and replacing a frequency counter from a backpack or coat pocket is suspicious and can draw unwanted attention during a penetration assessment.

The Optoelectronic Scout comes in both analog (Figure 5.4) and digital (Figure 5.5) versions. The digital version, as you may suspect, is designed to find the frequencies of a radio operating in a digital mode, which we have found to be of limited use during penetration assessments. Additionally, the digital mode tends to be finicky outside of a lab environment. The analog version, however, is a great piece of equipment and we highly recommend it.

If you choose to get a frequency counter other than the Scout, be sure to get one with a hold function which will continue to display the frequency after the counter is out of range of the frequency. The hold function will save in its memory the first frequency the counter locks onto, which saves you from having to write down the frequency with pen and paper. Of course, there is a caveat that even with a hold feature, the benefit is limited as there is generally a good chance that there will be a lot of trial and error as the frequency counter will lock onto the first strong signal it detects in the area which may not be the signal you are ultimately looking for. This is another reason to use a Scout, as it will also capture unwanted signals, however it will hopefully also capture the signal that you are looking for. All models of the Scout also include reaction tuning. This means that if you connect the Scout to a compatible scanner (a list of compatible scanners is available on the optoelectronics web site), the scanner will tune to the frequencies that the Scout counted.

If you are new to radio reconnaissance, and don’t want to make the investment in a new Scout, a used one may be a viable option. There are, however, issues with buying any used piece of equipment in general, and issues specific to buying a used Scout. It is almost certain that in a well-used Scout that the battery will be beyond its prime and likely close to the end of its useful life. If you are comfortable working with electronic devices, and soldering in particular, replacing the battery can be a fairly simple job. Hackers tend to be tinkerers at heart, so when replacing the battery, it may make sense to install a replacement battery that will hold its charge longer than the OEM battery. If doing this upgrade, make sure that the replacement battery is compatible with the Scout’s charging circuit.

Another common issue with a used Scout is a blown front end, the initial receive circuitry just after the antenna, an essential part of the receive portion of any radio. This happens when the Scout has been exposed to an unusually strong signal. Optoelectronics offers repairs, however at the time of this writing the minimum repair fee is $100, which is about one third of the cost of a brand new Scout.

Certain models of scanners have frequency finding features. Band scope is one such feature, however it has limited usefulness in reconnaissance unless it has a fast scan rate. Additional information is available in Chapter 7. Frequency grabbing features on scanners can be useful, and on higher end equipment there is often an option to automatically store detected frequencies. Keep in mind that the frequency grabbing features on these scanners function similarly to other frequency counters, and have short-range capabilities and lock onto strong signals. Multiple manufactures use different trade names for this capability, and a few of them are described in the sidebar.

When using a signal counter, or the signal counting capabilities of a scanner, there are several tips that will make success more likely. Although it may seem counter intuitive, the signal strength does not always get stronger as you move toward the transmitting antennas. In fact, the base of the antenna tower is one of the worst places to measure a signal, as radio waves form a donut shape when leaving omni-directional antenna, with the antenna in the middle of the donut hole (Figure 5.6). This center of the donut hole is essentially leaving a “cone of silence” around the tower.

Visual Recon

As with other types of reconnaissance, a sharp eye is an essential tool in radio profiling. Being able to examine a radio used by the organization, whether from a distance or up close, can provide a wealth of information. Often, organizations will place stickers on the radios listing the channel assignments, for example channel one is security while channel 2 is maintenance. It is also common that these channel listings will be posted in guard stations or behind the reception desk, so be sure to look around.

Identifying the model of radios in use by the target organization is invaluable. Many radios have the manufacturer name prominently displayed on the outer housing, and some will even have the model or series number. This is another place where having a camera can be helpful. A quick snapshot will allow you to take all the time you need to research and determine the radio make and model once you are offsite.

Once you have determined the type of radio in use by the target organization, there are a wealth of resources to enable you to gather a large amount of information. Internet search engines and web sites (Figure 5.7) are an obvious choice, however there are also people who will likely be willing to help you. Developing a positive relationship with local radio equipment dealers and Ham radio operators will provide experienced input. We may be biased, however we have found that people in the radio community tend to be friendly and generous with their time and knowledge. As you gain experience with radios, you will be able to quickly determine at least the manufacturer of a device with a quick glance.

Search Common Frequency Ranges

Searching common frequency ranges is labor intensive and time consuming, however if signal counting and the methods described in the {cross ref offsite profiling chapter, with page number} prove unsuccessful, this may be the only option. The concept is fairly simple, listen on commonly used frequencies and look for traffic from the target. The good news is that if you are able to view the radios in use, you can generally narrow down the number of possible frequencies and save significant time. The following describes the common frequencies in use.

Common Ranges

Not every target will broadcast on a common frequency, however they will generally broadcast in a common range. Some scanner models will have search bands preprogrammed for businesses, police, fire, and other channels, which may be useful. If you are using a scanner which supports custom band scans, enter the common ranges prior to going onsite so you can quickly scan the common ranges. With any penetration test, the more work you can do offsite, the quicker the onsite portion, and the lower the likelihood of being detected. Manually searching ranges can be a very time-intensive process. You can often narrow down the ranges to be searched by using information gathered earlier in the onsite profiling such as the types of radios used and antennas on the radios. For example, if the radios used by the guard force only support frequencies between 450 MHz and 470 MHz that would be the range you would want to search first.

Scanner Tips

Prior to going onsite, it is helpful to enter the FRS, GMRS, MURS, Dot frequencies, and cordless phone and headset ranges into banks on your scanner to make it easier to scan the channels. If the scanner supports banks of multiple sizes, each service can be given its own bank. When a frequency range is common, we will often put them in the higher banks, and use the lower banks for frequencies specific to the target.

Finding Trunked Systems

Trunked systems present a unique set of challenges, however they are generally only used by Government entities (Local, State, and Federal), Utilities, educational institutions, and other large organizations and corporations. In larger cities, we will also likely encounter companies that lease a talk group on a trunk system run by a third party in the area. In the best case scenario, we discovered the trunking information during the offsite reconnaissance, as manually finding and mapping trunked systems can be extremely time consuming and very challenging. This, however, does not mean that it is not possible. Some trunked systems will only require you find the control frequency to be able to monitor traffic, while other systems will require you to map out all frequencies in the system. If you are using a scanner that supports Control Channel Only trunking and are targeting a compatible trunked system, you will only need to program the control channel into the scanner to monitor the trunked system. Unfortunately for the penetration tester, only select Motorola trunked systems support this.

Regardless of the type of trunked system you are targeting, it will be necessary to come up with a talk group mapping so you can separate the different channels. The talk group mapping will allow you to determine which talk groups are used by, for example, the maintenance department and which are used by security. While time consuming, talk group mapping is not complicated, and depending on the chatter on the frequencies, it can be interesting.

Case Study: Onsite Profiling

Internal penetration test at a large insurance company located in a downtown of a large city.

The following story is, well, mostly true. Because we are professional security people, we cannot disclose details of our clients’ systems nor their names. All the events in this case study happened, however we drew from events from multiple penetration assessments to create this scenario.

Initially, our scope included only the internal network, we were looking at attack vectors coming from someone who had already gained physical access to the building, or a rogue employee. During a walkthrough of the building, we noticed that employees on the phone were using wireless headsets (Figure 5.9). People often assume wireless headsets have a very short range and can’t be monitored outside the building. We talked to the Client to see if we could expand the penetration test to include monitoring the headsets. The Client agreed to include the headsets, so we worked on changing the rules of engagement to include them. For this, we needed to engage our lawyer, the Client’s legal staff, and Human Resources, to make sure this was done in a way that did not violate any laws or internal company policies.

We started the penetration test by gathering information. Using Yaesu VX-5r (Figure 5.10) and Uniden Bearcat BCD396XT (Figure 5.11) scanners we search for signals in the frequency ranges commonly used by wireless headsets, reference the Common Cordless Phone and Headset Ranges section earlier in this chapter.

Our scans detected a number of signals of interest in the 900 MHz range. After completing the initial survey to see what signals we could detect, we needed to verify which ones were inside the target building. This was an important step for legal liability, because we needed to ensure we did not monitor any headset, and therefore phone calls, from other business in the area.

To accomplish this, we switched to directional antennas, and, using them from several locations, determined which signals originated from inside the target building. Once we had identified which signals originated from within the Client site, we started monitoring these signals.

This lead to our first critical discovery. It turned out that one of the groups that used wireless headsets was the helpdesk. The helpdesk group handles password resets. By monitoring their headsets, we could listen in on password reset conversations taking place. Once a password reset took place it was a race to login with the new password before the user did. If we won the race, we were in and had access to whatever that user account has permissions to.

Once we logged in, we did need to set a new password. Meanwhile, when the legitimate user tried to reset their password using the temporary password provided to them by the helpdesk, they would find that the temporary password given to them over the phone by the helpdesk didn’t work, and would need to call back to have it reset again. This could have clued someone in that something wasn’t right, but it’s human nature to assume a simpler, less sinister problem—such as the user heard the password incorrectly, or simply to blame the computer. It’s not uncommon for a password to need to be reset a couple of time even when things are working correctly. So this behavior didn’t raise any suspicions.

Once we logged in and got a valid Windows authentication token, it didn’t matter if the password was reset again. Windows authentication tokens are good for a number of hours. So we could use the login as a beach head to attack the rest of the network. Next we used local privilege escalation exploits to gain administrative access over the system. Once we had administrative access to the system we searched for the token of a domain administrator who had recently logged into the system and used them to gain control of the corporate domain.

If we could gain access to a list of user accounts, somehow, such as by sniffing network traffic, or finding a hard copy posted on a bulletin board or left on a desk, we could have targeted a specific user account by attempting a number of failed login until the account became locked, and needed to be reset by the helpdesk. Normally a locked account does not need to have the password reset, but if we continued sending bad authentication attempts so that the account keeps getting locked before the user can get in, eventually the user will request a password reset. So instead of waiting around and hoping to hear a reset request, we could trigger one.

By using a DTMF (Dual Tone Multi-Frequency) decoder to translate the audible tones the phone makes when pressing buttons into the corresponding number that it represents, we could decode users’ voicemail passwords when they logged in to check their voicemail over the headset.

Finally, the way these specific headsets in use at the Client worked, they broadcast at all times when powered on—not just while actively on a call. So the headset also acted as a room bug, transmitting surrounding conversations if the headset was left on, which people commonly did. The microphones could pick up conversations beyond just the wearer at times, and we could hear conversations taking place in a small office. We discovered this at another company, and used the “feature” to gain valuable information about an upcoming merger. At that company, the only people authorized to use the headsets were executives and their assistants. In essence, the company not only accidently bugged their most valuable target, they filtered out a great deal of much less interesting chatter for us.

Our Client was also interested in seeing how far away we could monitor the headsets. With the normal antenna, we could listen to the headsets from about 100 ft away, which at this site meant that we could eavesdrop from the parking lot and street around the building. Using antennas tuned for 900 MHz, (the Max Systems 8HH 900 MHz discone antenna, which sadly has been discontinued) we could easily monitor the headsets from two blocks (about 500 ft) away, showing how much performance can be increased by using a good antenna that matches the target frequency.