AI
Hollywood Myths and the Reality of Physical Entry
During a Super Bowl engagement, White and Roberts booked a hotel room adjacent to their target building. Their window opened onto the roof. No parkour, no Blackhawk helicopter. A socially engineered room request got them flush with the target. On lockpicking, the same pragmatism applies. A Medeco or ASSA core on an exterior door signals move on. If a padlock has exposed hinge screws, that’s faster than picking the lock. Know what you can open and what you cannot.
Alarm Systems: The Compensating Controls Assessors Miss
Popping a weak lock without checking for door-force sensors is a common mistake. A silent alarm alerts security before you’re 10 feet in. When using a crash bar tool, a motion sensor tied to the alarm system means you need two people: one to pull the door, one to trip the sensor with canned air so the system reads an exit. Badge reader panels from Linear and DoorKing carry tamper switches inside. Opening one with a default liner key triggers an alert even if you hear nothing.
Social Engineering: Regional Psychology and Building Guard Rapport
Social engineering is not improvisation plus confidence. Regional psychology matters. In the Midwest and South, people want to help and avoid conflict. The Northeast and far West Coast run cooler. Roberts and White built enough rapport with one security guard that he handed over his keys and told them to bring them back when done. Getting there requires understanding what the target values, what role they hold, and what request puts them at ease. Lying fast gets you a door. Psychology gets you the keys.
Badge Cloning: Concealable Readers and the Proximity Problem
White built a Proxmark III into a Starbucks coffee cup. He stood at a smoke break area, started chatting about a SANS lanyard, and cloned the employee’s badge during the conversation. The clipboard version went further: a Proxmark III with four antennas hidden inside, plus a badge card behind Velcro that writes the clone. It alerts your phone when it captures a badge and lets you pull out the cloned card immediately. White once badged through a reader using a muffin bag while a security guard played on his phone 3 feet away.
Guard Encounters: Compliance First, Conversation Second
When a security guard approaches at night and you have a shove knife in your hand and a backpack of tools, arrogance ends the engagement. Comply. Roberts told a guard he was a NIST auditor with a letter in his pocket. The fake authorization letter named Bruce Wayne as the point of contact, listed Fish Nugget Security as the firm, and included a phone number that rang White’s cell. The guard skimmed it, said he was with security too, and Roberts asked him to brief the other guards. He rode that rapport the entire week.
Reporting Ethics: Never Name the Individual
White watched a security guard get fired because he was named in a report. He hasn’t put a name in a report since. When someone fails a physical security test, they become an asset. Their firsthand experience converts into security culture faster than any training checkbox. Roberts and White tell clients: this person knows now. They’ll be your best internal advocate. The reframe shifts the finding from employee failure to training gap, and it preserves a job while producing a better security outcome than termination.
Q&A
What legally counts as impersonating law enforcement? Intent and claim determine it; verbally asserting you’re a police officer while wearing a costume crosses the line, but implying a role without stating it falls in grayer territory. ▶ 16:41
How often do clients authorize ESP key implants into badge readers? Government clients are more open to it; commercial engagements depend largely on building ownership, and over hundreds of assessments the answer has been roughly equally yes and no. ▶ 37:05
If only one person could have triggered a finding, how do you keep them from getting fired? Frame it as an organizational training gap, not individual failure; someone who experienced the test firsthand becomes a more effective security advocate than annual awareness training ever will. ▶ 47:17
Notable Quotes
They hold the keys of the kingdom. Brent White · ▶ 13:43
I think Oh, it said it was fishnugget security. Brent White · ▶ 45:40
It would wrecked me, guys. Tim Roberts · ▶ 48:08
Key Takeaways
- Simple tailgating and social engineering succeed 90% of the time; badge cloners are secondary.
- Security guards are assets, not obstacles. Building genuine rapport gets you keys, not just access.
- Never name individuals in reports. Someone who failed a test becomes your client’s best security advocate.
About the Speakers
Brent White is a Sr. Principal Security Consultant and Covert Entry Specialist with Dark Wolf Solutions, specializing in social engineering and red team security assessments for commercial and Department of Defense clients. He contributed to the Defense Innovation Unit’s drone hacking methodology for the Blue sUAS initiative and served as a trusted adviser for the Tennessee Department of Safety and Homeland Security. His work has been featured on Hak5, Security Weekly, BBC News, and Microsoft’s Roadtrip Nation. He has spoken at DEF CON, Black Hat, DerbyCon, and numerous B-Sides and ISSA events.
Tim Roberts is a Sr. Principal Penetration Tester and Covert Entry Specialist with Dark Wolf Solutions, and the founding member of the Lexington DEF CON group DC859. With over 15 years of professional security experience across healthcare, finance, and government, his work spans red team, network, wireless, application, physical security, and social engineering assessments. He has been featured in IDG Enterprise’s CSO Online, interviewed at Black Hat by HelpNetSecurity, and has presented at DEF CON, DerbyCon, NolaCon, CircleCityCon, SaintCon, and many more.