Vrftsjtryk

Following people into a large RFID protected residential building is ridiculously easy, as not everyone knows everyone else. Just the other day I was let in with a rifle (an airgun, but how could have they known).

But standing helplessly in front of the door, looking in sorrow at the lock, is not the best role to play as it attracts questions like "who are you" or "who are you visiting".

What is a more appropriate behavior when waiting around for someone to enter?

There are some basic social engineering approaches to use that work in most situations, not just tailgating:

• urgency


• authority


• curiosity


• pretexting

Urgency

Be someone with a specific task to perform that needs to be done right now. The classics are a delivery person with full arms and someone looking to pick someone else up. A family member needing to check on an elderly resident. People want to be helpful and they don't think that you will be around long enough to be a threat.

Authority

Be someone who the gatekeeper has no right or reason to refuse. Fire marshal, utilities inspector, law enforcement, building security, process server. Lots of studies of people being let in with a just clipboard and a high-visibility vest.

Curiosity

To get close to someone, be very interesting in such a way that they want to know more. Dress up as a clown to deliver a telegram.

Pretexting

Establish a shallow relationship that appears to be deeper. Smoking with people outside on their break is classic. The smokers will assume you are also an employee (why else would you be there?)

Combinations

But these work even better in combination. A fire marshal in an awful rush. A clown who claims he was at the last company party (and knows a few important names). The more combinations you can combine, the more effective the process is: an authority figure, in a rush, to do something interesting, who claims to have a pre-existing relationship. If you go over the top or try to hard, it will backfire, though.

Just stand outside the door at some distance talking on your phone. Don't look at the door, don't look at the person coming to open it, don't look like you want to get in. Don't ask to be let in. Don't engage in conversation. Just let the person open the door and go through. Then in the last second before it closes and lock, you walk through still talking on your phone.

Wearing a costume or high-vis will make you... well, highly visible. In some places you might need the costume and the excuse to get in. But in a lot of places, just blending in like an unmemorable nobody is quite enough. Dress like you belong, don't ask, just walk.

As a disclaimer I should note that I have no professional experience with this. But I do use it all the time to get into my office when I forget my RFID tag.

The main element, as you've said, is to not look like you're waiting for your mark to arrive. What you need is a prop that gives a visual indication why you're standing outside the door.

Useful props (that would explain your presence) would include:

• Cigarette or e-Cig.


• Lunch-bag(s).


• Coffee(s) from a local distributor.


• Box of doughnuts.

Having a bulky item or two of something (one in each hand) is especially useful because it would explain why you can't reach for a pass.

Story-time. I was working for a company that had access passes. A local hoodlum bought himself a cheap suit and tried to tailgate into the side-entrance. He was stopped by a member of staff as per the company policy. The hoodlum brazened it out by asking him "was it because he was black?" and the member of staff immediately apologised. The hoodlum demanded his manager's name (so he could make a complaint) and received even more profuse apologies.

The 'mark' then helped him to take laptops out of the conference suite and load them into the back of an unmarked van.

Moral of the story? Social engineering simply requires confidence