4

An opportunity has arisen for me to perform a "real hacking attack" on a TV show. The target is to attack the TV headquarters and cause as much chaos as possible. The idea is to show how a business needs to improve their security or "really bad things can happen".

Management will be aware of the attack and all the corresponding legal documents will be signed and approved beforehand. Other employees will have no idea.

There will be a camera recording on the attacked office (hidden, so employees don't become suspicious), and another one recording "the attacker".

Some things can be "faked" for dramatic effect, but we want to show what a real attack looks like. There will be a "pawnage day" where at 12:00 AM the attack will take place

I have 2 months to prepare this. I have had prior experience of penetration testing, mostly web-apps and wi-fi. No direct experience with malware or phishing at all, but I know the theory.

I have thought about what attacks to show and perform:

Prior to "pawnage day":

  • Send a phishing campaign with an attached excel document with malware
  • Use LinkedIn to find the name of the CEO and send the phishing emails spoofing his email account for credibility
  • Use social engineering and infiltrate as a "repairman". Stuck "evil USB's" everywhere. All this while wearing a hidden camera.

During "pawnage day" attack:

  • Machines infected with malware from the phishing campaign will lock the screen with a humorous message
  • Machines infected with malware from the evil USB's will lock the screen with a different humorous message
  • A "mail bomber" will fill the inboxes of everyone
  • A "skype bomber" will call everyone in the office at the same time
  • Strong DDOS of the website

My questions are as follows:

  • Which other attacks can I perform that are "visual" for a TV show?
  • Any suggestion on the implementation of the attacks?
  • Is it realistic? As professionals and experts, what would you like to see?

Remember that the intention is educational for the broad public, but should not show made up stuff that would alarm seasoned InfoSec professionals.

  • 6
    Hack the coffee machine, this will guarantee their undivided attention. – martinstoeckli Apr 12 '18 at 18:24
  • 2
    Seriously, do things they won't expect. Seeing oneself on the screen recorded by the notebook camera is harmless, but can raise awareness. Use IOT devices if you can, let the printer give out pictures from the observation camera. If there are wireless smart WLAN luminaire use them to make a light show. – martinstoeckli Apr 12 '18 at 18:54
  • 2
    Oh God, I love the idea of creating a light show with some IOT lamps :D Thank you! – Solzhenitsyn's Revenge Apr 12 '18 at 19:13
  • 4
    Note that a DDoS of the website may be illegal because it will affect not only their website, but the hosting provider and backbone which supplies it. ISPs generally do not like being victims of attacks anymore than websites do, and it typically violates their ToS. – forest Apr 13 '18 at 4:54
  • 2
    The following might be an overcaring (and sorry for being such a boring guy), but you haven't specified the country you're in (the profile says it's Spain though). Anyway, my best suggestion is to find a good lawyer, show him all the documents you're going to sign, describe all the scenarios and ask for a legal advice. In some jurisdictions, signing a disclaimer with a customer still in no way protects you from criminal charges for distributing malware. And the proof of your actions will be recorded and broadcasted on TV, which makes it too easy for the law enforcement to collect the evidence. – ximaera Apr 13 '18 at 7:36
2

Searching Linkedin for the CEO email is not needed at all, why not just ask management? If they signed the papers, they will be willing to help you. And you should send mails as the support or HR, the CEO usually don't mail the employees.

Filling mailboxes and locking the computers does the same harm as just locking the computer. No need to do that.

You don't need BadUSB (and should not use it) to lock computers, accessing the Domain Controller as domain admin is enough. And people will be suspicious if they see the "repairman" inserting an USB drive on every computer in the office. In the 2 months, phish an admin and grab the credentials.

DDoS at the website does not look good on TV and is not "real hacking."

Locking the computers, ringing every phone, controling IoT lamps and printing messages will be better on TV.

  • The bit about searching for linkedin and other social networks is to raise awareness about how much info is "freely" given, and how dangerous it can be. DDOS may be out of the scene because as someone noted in the comments, the attack would be out of scope of the contract, as it would be the hosting company the one on the receiving end. I wanted to show some "physical" attack and thats the reason for the badUSB. As I said earlier, no need to literally do it, some things can be faked as long as they are educational, and this would show social engineering. Thanks for your answer – Solzhenitsyn's Revenge Apr 13 '18 at 12:19
  • yeah, don't DDOS the website, but you add a or change content. In the real-world if you had installed a keylogger you would be able to do that, tv-world you can probably rely on behind-the-scenes assistance from their website manager, no need to actually compromise their security. – Jasen Apr 14 '18 at 8:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.