The Time A Hacker 'Robbed' The Wrong Bank In Beirut
Jayson E. Street is a professional penetration tester who has uncovered and helped patch security holes in many banks around the world, but even he, a professional mistake-hunter, is prone to some heavy faults.
Street was once hired to perform a security awareness engagement in a bank in Beirut .
A security awareness engagement can be described as a mock physical security breach that has the ultimate goal of improving an establishment's security by educating its staff on existing dangers and how to be ready for them.
How He Does It
"I don't have to bypass your firewall if I can bypass your receptionist."
Jayson E. Street
To understand what Street does and how he does it, we can go back a few years before the botched Beirut bank job.
In 2013, Street successfully completed a bank assignment in Beirut .
He had been challenged to test the security of 3 different branches of the bank and to bring back a user ID, a password, a smartcard, a computer, and network access for the job to be deemed successful.
One of the key techniques that Street used in that job was radiating a sense of validity that would get him to be trusted – or, even, to be completely overlooked – by bank employees, executives, and managers. How?
For instance, when he entered the first of the three branches, with a confident pace, he walked straight toward the manager’s office, past the executives, waited outside the door for a while without actually meeting the manager, then went back to an executive’s office, all while he looked like he knew exactly where he was going.
There, he told the executive that he needed to look at her computer because he was performing an audit, throwing in some technical lingo to add to his legitimacy.
The executive, who automatically associated his arrival from the direction of the manager’s office with validity and legitimacy, allowed him to plug his USB Rubber Ducky (a programmable USB stick typically used as a hack tool; capable of a lot of damage) into her computer.
Although, in this case, Street’s Rubber Ducky was only programmed to open a notepad - since this was not a real robbery - he had just technically compromised the bank’s security. Street was only getting started, though.
From there, having been seen at both the manager’s office (supposedly) and an executive’s office, the hacker only gained more and more validity in the eyes of the staff.
He ended up compromising another executive’s computer and every computer behind the teller line — all within 2 and a half minutes of walking into the bank for the first time in his life.
After having basically robbed the bank, he rallied its staff and told them what he had just done.
Jayson E. Street, right, spinning in an office chair behind the teller line in the bank in Beirut .
Photo credit: Darknet Diaries
He explained how badly they had just been compromised, and then educated them on how they can prevent something similar from happening in the future.
Street then went on to do the same in the remaining 2 branches with similar ease, eventually delivering a user ID, a password, a smartcard, a computer, and proof of network access to the shocked executive who had assigned him the task.
The Time It Went Wrong
A few years later, Street landed in Beirut again and reached the bank that he was supposed to perform a security awareness engagement in. He narrated this story on an episode of Darknet Diaries .
When he arrived, he needed to go to the bathroom. He went to the second floor with the presumption, based on experience, that the bathroom would be there, and it was.
When he was coming back down, he spotted 2 people working in a cube. He went up to them, told them he was with Microsoft, flashed a fake Microsoft badge, and went straight to work.
He plugged his Rubber Ducky into their computers and could have ended the job right there, as hacking into even one computer can be enough to compromise the whole system.
But, he wanted each individual employee to be involved in the experience so that they would learn the lesson more effectively. So, he went on to hack into more computers.
While he was at it, a person came up to him and asked him what he was doing there. Street again said that he was with Microsoft and was performing a USB audit.
He showed the person an email from the CFO of the bank on an iPad he had on him, which was meant to give off, again, a sense of legitimacy. The email did give him the authorization he needed to do what he was doing, but it was actually forged.
The man told Street that he still needed authorization from his supervisor, to whom the friendly hacker went and showed the email on the iPad. However, nothing could have prepared him for what he would hear next.