The_MustardTiger

I wish. God that thing is intriguing. I bet it's full of dick picks drawn in MS Paint.

Nothing too crazy. The most interesting intrusion I've done was at night. I taped the lock of an emergency exit open during the day. Security failed to secure it during the after hours perimeter check because you have to walk through a garden to get to it. It lead to a stairwell. On the second floor is the executive suit. The company that installed the RFID locks cut corners, to put it bluntly. I was able to manually circumvent the lock and gain entry to the executive offices. I actually have a video of this hack. I will need to sanitize it though, I will post it in the morning.

After bypassing the lock I had access to workstations, login credentials (written on post it notes, a big no-no), facility keys, access badges, and sensitive information. I take pictures of all these things and keep and keys or badges I find.

On occasion I will take a laptop back to my hotel, boot it into Backtrack and harvest info such as the SAM file. Next I install remote access software and a keylogger. Then I return the laptop where I found it.

While I'm in the executive suite, I also have access to their subnet of the network. If security controls are lacking, I can harvest credentials, perform vulnerability scans, as well as access network shares and sensitive info by plugging a Raspberry Pi device with custom software into the network. I usually hide this device and access it remotely later. (note: most clients do not like auditors plugging devices into their network. Vulnerability scans will commonly result in DoS'ing medical printing equipment (label makers, etc) 'Noisy' hacking will generally cause havoc on a hospital network. This is why I try to enforce access control such as port security and 802.1x.

I was performing after hours assessment at a business center of a hospital. During the day I unlocked a 1st floor window. That night, at about 1:30am I snuck back in through the window. There was a bank next door and the security guard saw me and called the police. Police called hospital security. I was sitting at a workstation that was left unlocked when they entered. An overweight, overzealous security guard pointed the Taser at me. I calmly said I had a reason to be there and reached in my jacket pocket for the business card of the hospital's chief of security. The guard lunged forward with the Taser. It caught me under the forearm that was reaching in my jacket. It clenched so ferociously that I smacked myself in the face and cartwheeled out of the chair I was sitting in. It stung pretty good, but wasn't as bad as I thought it would be, maybe because I flinched so damn hard. He didn't fire the prongs, thank god.

I just started yelling the Chief of Security's name, over and over, until he got the message. CSO was called. He was annoyed even though he was aware the assessment was taking place. Neither party was in any trouble. The guard apologized but kept saying he was just doing his job. Maybe I shouldn't have reached so fast, but I think he was overeager with the taser.

EDIT: I realize now that I failed to understand the guard's perspective at the time. Although I thought the situation was calm, he did not. It was my fault I got tased. I now always ensure that the Chief of Security informs someone that is on duty during a nighttime assessment.

I am so confused.

Never. It would be unethical and possibly dangerous for me to interfere with patient care.