An opportunity has arisen for me to perform a "real hacking attack" on a TV show. The target is to attack the TV headquarters and cause as much chaos as possible. The idea is to show how a business needs to improve their security or "really bad things can happen".
Management will be aware of the attack and all the corresponding legal documents will be signed and approved beforehand. Other employees will have no idea.
There will be a camera recording on the attacked office (hidden, so employees don't become suspicious), and another one recording "the attacker".
Some things can be "faked" for dramatic effect, but we want to show what a real attack looks like. There will be a "pawnage day" where at 12:00 AM the attack will take place
I have 2 months to prepare this. I have had prior experience of penetration testing, mostly web-apps and wi-fi. No direct experience with malware or phishing at all, but I know the theory.
I have thought about what attacks to show and perform:
Prior to "pawnage day":
- Send a phishing campaign with an attached excel document with malware
- Use LinkedIn to find the name of the CEO and send the phishing emails spoofing his email account for credibility
- Use social engineering and infiltrate as a "repairman". Stuck "evil USB's" everywhere. All this while wearing a hidden camera.
During "pawnage day" attack:
- Machines infected with malware from the phishing campaign will lock the screen with a humorous message
- Machines infected with malware from the evil USB's will lock the screen with a different humorous message
- A "mail bomber" will fill the inboxes of everyone
- A "skype bomber" will call everyone in the office at the same time
- Strong DDOS of the website
My questions are as follows:
- Which other attacks can I perform that are "visual" for a TV show?
- Any suggestion on the implementation of the attacks?
- Is it realistic? As professionals and experts, what would you like to see?
Remember that the intention is educational for the broad public, but should not show made up stuff that would alarm seasoned InfoSec professionals.