From Badge Forgery to Supply Chain: Advanced Penetration

From Badge Forgery to Supply Chain: Advanced Penetration

Speakers: Satoki Tsuji (Ricerca Security, Inc.); Yuma Kurogome (Ricerca Security, Inc.)

Conference: DefCamp

YouTube: https://www.youtube.com/watch?v=G2MOiZc9pNA

Overview

In an era where cyber threats continually evolve, the lines between physical and digital security are increasingly blurred. This talk, "From Badge Forgery to Supply Chain: Advanced Penetration," delivered by Satoki Tsuji and Yuma Kurogome of Ricerca Security, Inc., at DefCamp, sheds light on sophisticated attack methodologies that pivot seamlessly between the physical and cyber domains. The presentation outlines a comprehensive advanced penetration testing approach designed to mimic the persistence, resourcefulness, and flexibility of real-world Advanced Persistent Threat (APT) groups.

The speakers dissect a hypothetical yet highly realistic attack scenario, starting with physical intrusion via badge forgery and escalating to a full-blown supply chain compromise and data exfiltration. This multi-faceted strategy emphasizes the critical need for organizations to look beyond conventional penetration testing scopes, which often neglect physical security and the complex interplay between different attack vectors. By demonstrating how adversaries exploit human behavior, physical vulnerabilities, and digital weaknesses in concert, Tsuji and Kurogome provide invaluable insights for organizations seeking to fortify their defenses against truly advanced threats.

The core message underscores that effective security assessments must simulate the holistic thinking of sophisticated attackers, who do not confine their operations to a single domain. This presentation serves as a stark reminder that an organization's attack surface extends far beyond its IT infrastructure, encompassing its physical premises, employees, and supply chain, all of which can be leveraged for strategic compromise.

Background

▶ Watch: Introduction & Advanced Attack Scenario (0:00)

The threat landscape in Japan, as highlighted by the speakers, is a microcosm of global challenges, characterized by sophisticated APTs continuously targeting critical infrastructure and financial institutions. Two representative incidents illustrate the severity: the Asahi Group ransomware attack, which exploited VPN credentials, led to factory shutdowns, supply chain disruptions, and even affected the availability of Japan’s famous Asahi Super Dry beer. The second, the DM Bitcoin cryptocurrency theft, involved TraderTraitor (a Lazarus Group sub-entity) contacting an employee via LinkedIn, tricking them into running a malicious Python script, stealing session cookies, and ultimately exfiltrating 48.2 billion yen in cryptocurrency. These cases underscore the blend of social engineering, technical exploitation, and profound real-world consequences.

The speakers classify the primary APT groups targeting Japan into three categories:

• Panda (Chinese APTs): Known for discovering and exploiting zero-day vulnerabilities in IT asset management and EDR tools widely used in Japan. Their organized vulnerability research often leads to compromising the very security tools organizations rely on.
• Bear (Russian APTs): Distinguished by their heavy use of "living off the land" binaries (LOLBins) like PowerShell and WMI, allowing them to execute attacks without deploying external malware, thus evading traditional detection mechanisms. They also engage in hybrid warfare, blending cyber attacks with misinformation campaigns across physical, cyber, and social domains.
• Lazarus (DPRK APTs): Primarily targeting financial institutions and cryptocurrency exchanges to fund the North Korean regime. A recent characteristic is their focus on advanced social engineering, including hiring fake IT workers who load malware upon receiving company workstations. They also specifically target security researchers, highlighting the increasing sophistication and audacity of these groups.

Despite these escalating threats, traditional penetration testing often operates with narrowly defined scopes. Common engagements focus on external intrusion into internal networks via website vulnerabilities, internal network assessments assuming an initial endpoint compromise, or insider threat simulations targeting data exfiltration. While valuable, these approaches frequently overlook crucial attack vectors such as physical intrusion, attacks on test/staging environments, and the complex interplay between physical and cyber domains. This gap in assessment leaves organizations vulnerable to adversaries who seamlessly cross these boundaries, necessitating a more advanced, holistic approach to security testing.

Key Findings

▶ Watch: Advanced Penetration Testing Methodology Introduction (11:59)

The central finding of this presentation is the critical need for an advanced penetration testing methodology that accurately simulates the resources, persistence, and flexibility of real-world adversaries. This methodology explicitly incorporates physical-to-cyber pivots and cyber-to-physical pivots, allowing for more realistic assessments that anticipate actual threats. The speakers propose a structured workflow, from pre-engagement to attack execution, emphasizing the design of scenarios that bridge these domains.

A key contribution is the detailed timeline of a model attack exercise, demonstrating a progressive advancement from initial physical intrusion to a full supply chain compromise over approximately 25 days:

1. Day 1-2: Badge Forgery – Achieves physical entry.
2. Day 3-5: Malicious Hardware Deployment – Establishes an initial foothold.
3. Day 6-15: Command and Control (C2) Establishment – Enables internal reconnaissance.
4. Post C2: Repository Compromise – Leads to a supply chain attack.
5. Final Stage: Data Exfiltration – Achieves the primary objective.

Throughout this timeline, the red team consistently evaded detection, highlighting the efficacy of their approach. This success was attributed to multiple parallel attack paths and the mutual pivoting between physical and cyber domains. From these cases, three core principles for scenario design are derived:

1. Simulate Adversary Thinking: Emphasize understanding the decision-making process of attackers, focusing on what is "allowed" or "normal" to avoid suspicion and find paths of least resistance.
2. Physical and Cyber Mutual Pivots: Recognize that each boundary crossing reveals new attack surfaces, making flexible transitions between domains more effective than sticking to a single vector.
3. Identify Critical Points and Implement Redundancy: Design scenarios where the failure of one attack chain does not halt the entire operation, ensuring objectives can still be met through alternative routes.

These findings collectively advocate for a paradigm shift in penetration testing, moving beyond isolated technical assessments to comprehensive simulations that reflect the complex, adaptive strategies of modern APTs.

Technical Deep Dive

▶ Watch: Malicious Hardware for Initial Foothold (18:00)

The talk provides a granular look at the Tactics, Techniques, and Procedures (TTPs) employed in both on-site and remote operations, emphasizing deviations from well-known methods to enhance stealth and effectiveness.

On-site Operations: Physical Intrusion and Initial Foothold

The initial phase focuses on reconnaissance to blend in and mimic employees. This involves observing dress codes, typical arrival/departure times, device types, and how IDs are handled at restaurants and within the office building. Crucially, publicly available information, such as interview photos on LinkedIn, is used to verify employee ID details, including design, material, color, and seam count, enabling the creation of sophisticated forged badges.

Entrance access control surveys assess the feasibility of physical intrusion. This includes identifying the type of access control (proximity, IC, smart card, biometrics), security guard locations, CCTV coverage, passback mechanisms, turnstile sizes, and employee entry/exit patterns. Observing behaviors like employees holding doors open for others or looking behind before entering can reveal crucial opportunities for tailgating.

For the actual intrusion, the speakers recommend using Flipper Zero to read, copy, and emulate RFID and NFC tags. Smoking areas and employee hangouts are identified as prime targets for ID card copying, as individuals from outside the target company are less likely to be suspected in these areas, and targets remain stationary for longer periods.

Malicious Hardware Deployment

After physical entry, a range of specialized malicious hardware is deployed to establish an initial foothold:

• O.MG Cable: A USB cable functioning as a keylogger or USB implant. These are designed to replace legitimate cables at office desks, often disguised with fake equipment management stickers or markings visible only under blacklight for later retrieval.
• Screen Crab: A device that relays HDMI signals while simultaneously capturing video. Inserted between a conference room monitor and its HDMI cable, it's essentially an Android device running screenapk. To automate file synchronization, Termux, rsync, and Chrome are integrated, allowing for real-time monitoring when connected to a Raspberry Pi.
• Packet Squirrel Mark 2: An Ethernet Man-in-the-Middle (MiTM) device inserted between critical terminals or multifunction printers and their Ethernet cables. It requires pre-configuration to capture only specific protocols to avoid network heavy loads and has a maximum throughput of 100 Mbps, even on 1000Base-T connections.
• Panda Bug: A small, inexpensive Ethernet sniffing device, also inserted between Ethernet cables in server rooms and connecting to a Raspberry Pi for real-time packet capture. Similar to Packet Squirrel, it struggles with large-scale traffic and can introduce network delays.
• Key Croc: A keystroke logging and injection device. Inserted between unattended wired keyboards and PCs, it can be used for typo squatting attacks by injecting typos into package names. However, the speakers recommend primarily using it for logging to minimize detection risk.
• Q70: An ultra-compact voice recorder with voice-activated recording capabilities. Installed discreetly under desks or behind monitors using magnets or double-sided tape, it's undetectable by RF bug detectors as it emits no radio signals, offering approximately 450 hours of recording on a full charge.
• GPI (4G LTE Communication Module): For Raspberry Pi, this module aggregates data from other Raspberry Pi devices and exfiltrates it via LTE. This method of exfiltration is difficult to detect, as it appears indistinguishable from employees using smartphones. Careful configuration of the AP SSID to appear natural and legitimate is crucial.

Preparation to avoid detection during physical intrusion includes reporting the red team exercise to local police, establishing a support team for the operator, maintaining constant communication (e.g., via Bluetooth headsets or Telegram), and preparing a response flow with documentation in case of restraint.

Remote Operations: C2, Lateral Movement, and Supply Chain Attack

Once an initial foothold is established, remote operations commence. This involves analyzing testing wrappers (pre-configured terminals distributed to target users) to investigate local attack vectors, a technique also employed by APT groups. Investigation includes assessing whether physical exfiltration (via USB, SD, HDD, MTP, optical media, Bluetooth) and online exfiltration (e.g., encoding data into ICMP or DNS queries) are prevented by existing security measures. The speakers note that some products restrict USB exfiltration but fail to block Bluetooth.

For malware execution on laptops, script engines like Python and Node.js are favored, as they are used by groups like Panda and Lazarus. Python malware can be obfuscated with PyArmor or PyInstaller for execution. Node.js malware can leverage V8 bytecode for stealth. A critical evasion technique is using portable versions of these script engines, which don't require installation, thus avoiding EDR detection events and executing as legitimate binaries.

Command and Control (C2) servers are designed to blend in with legitimate traffic. Instead of suspicious external servers, the speakers recommend utilizing legitimate cloud instances (AWS, GCP, Azure) or messenger apps (Slack, Discord) used by the target organization. Commands and execution results can be embedded in regularly transmitted information, such as "daily report" text, making detection difficult.

Lateral movement emphasizes compromising source code repositories. Attackers obtain SSH keys from production endpoints to access organizational repositories, extract usernames, and recursively collect all valid repositories. GitHub repositories are particularly attractive targets, containing internal platform documentation, CI/CD configurations, and internal source code.

For backdoor placement in GitHub, techniques are employed to evade detection:

• Disguised commits: Creating commit logs that appear to be from other users.
• Disabling diff display: Adding malicious code within a large commit that also deletes multiple unrelated files, disguised as a "human error." This creates a large diff that GitHub may not fully display, effectively hiding the backdoor code.
• Detection bypass: Using special root characters or homograph attacks (visually similar characters like Latin 'p' for existing variables) to evade text-based searches for malicious code.

These sophisticated techniques allow attackers to embed backdoors, ultimately leading to supply chain attacks by compromising the integrity of trusted codebases.

Demo / Proof of Concept

▶ Watch: Lateral Movement & GitHub Backdoor Placement (28:00)

While the presentation did not feature a live, interactive demonstration, the speakers meticulously detailed a model case that serves as a robust proof of concept for their advanced penetration testing methodology. This simulated exercise, spanning approximately 25 days, provided a step-by-step walkthrough of the attack timeline and the specific TTPs employed to achieve objectives without detection.

The model case began with badge forgery on Days 1-2, leveraging reconnaissance of employee behaviors and ID card details to gain physical entry. This was followed by the deployment of various malicious hardware such as the O.MG Cable, Screen Crab, Packet Squirrel Mark 2, Panda Bug, Key Croc, Q70 voice recorder, and GPI 4G LTE modules during Days 3-5. These devices, described in detail, demonstrated how initial physical access could establish persistent footholds and exfiltration channels, including real-time monitoring of conference rooms and keystroke logging.

The subsequent phase, from Day 6 to Day 15, focused on establishing Command and Control (C2) and conducting internal reconnaissance. The speakers explained how portable script engines and C2 channels disguised within legitimate cloud services or messenger apps were used to maintain stealth. The culmination of the technical demonstration was the repository compromise leading to a supply chain attack, where SSH keys were leveraged to gain access to GitHub repositories, and backdoors were subtly introduced using techniques like disguised commits and diff display bypass. This comprehensive walkthrough, featuring specific tool names, operational details, and evasion tactics, effectively served as a practical illustration of how physical and cyber pivots enable advanced, undetectable intrusions from initial badge forgery to a full supply chain compromise.

Defensive Implications

▶ Watch: Defender's Perspective: Discovering and Ending the Test (37:00)

The advanced penetration testing methodology presented by Ricerca Security offers critical insights for defenders, highlighting significant gaps in traditional security postures. The primary takeaway is the need to bridge the gap between security policies and their actual operational enforcement. Many organizations have policies prohibiting unauthorized devices or requiring asset tagging, but attackers exploit inconsistencies in their implementation.

Defenders must significantly enhance physical security awareness and controls. This includes:

• Vigilance against social engineering: Employees must be educated on the risks of holding doors open (tailgating) or not challenging unknown individuals in restricted areas.
• Enhanced access control: Regular audits of access control systems, including CCTV coverage and passback mechanisms, are crucial.
• Awareness in public/semi-public spaces: Employees should be aware that areas like smoking zones, restaurants, and conference rooms within multi-tenant buildings are prime targets for reconnaissance and malicious hardware deployment.
• Regular physical sweeps: Implementing routine, discreet checks for unauthorized hardware (e.g., O.MG Cables, Screen Crabs, Key Crocs, Q70 recorders) in offices, conference rooms, and server rooms. The Q70's undetectability by RF bug detectors underscores the need for physical inspection.

Endpoint and network security also require re-evaluation:

• Portable application detection: EDR and endpoint protection solutions must evolve to detect the execution of portable versions of script engines (Python, Node.js) that bypass installation events.
• C2 over legitimate services: Organizations need advanced analytics to detect anomalous command and control traffic disguised within legitimate cloud services (AWS, GCP, Azure) or messenger applications (Slack, Discord). This requires deep packet inspection, behavioral analysis, and baselining of normal traffic patterns.
• Exfiltration monitoring: Beyond USB and traditional network channels, monitoring for data exfiltration via less common methods like Bluetooth, ICMP tunneling, or DNS exfiltration is essential.
• Supply chain security: Implement rigorous code review processes, enforce multi-factor authentication for repository access, and monitor for suspicious commits, especially those with large deletions or unusual character sets that might indicate homograph attacks or diff display bypass techniques. Automated tools should scan for common obfuscation methods.
• Redundant defenses: Adopt a "assume breach" mindset. Since attackers use parallel attack paths and mutual pivots, defenders must implement layered security controls at every stage—physical, network, endpoint, and application—ensuring that if one control fails, another can detect or mitigate the threat.

Ultimately, defenders must adopt the adversary's mindset, constantly asking "what would be allowed?" or "what is the path of least resistance?" This proactive, holistic approach, integrating physical, cyber, and human elements, is vital for building truly resilient security.

Key Takeaways

• Advanced pentesting transcends traditional scopes: Effective security assessments must simulate real-world APTs by seamlessly pivoting between physical, cyber, and social domains, rather than focusing on isolated technical vulnerabilities.
• Physical security is a critical attack vector: Initial compromise often begins with physical reconnaissance, badge forgery using tools like Flipper Zero, and the discreet deployment of malicious hardware (e.g., O.MG Cable, Screen Crab, Key Croc) within the target's premises.
• Stealth relies on legitimate channels and evasion: Attackers leverage portable script engines, disguise C2 traffic within legitimate cloud services or messenger apps, and employ sophisticated GitHub tampering techniques (disguised commits, diff display bypass, homograph attacks) to remain undetected.
• Supply chain compromise via repositories is a significant threat: Gaining access to source code repositories through stolen SSH keys enables attackers to embed backdoors directly into an organization's development pipeline, leading to widespread and difficult-to-detect compromises.
• Defenders must bridge policy and operation: A critical weakness is the gap between security policies (e.g., device restrictions, asset tagging) and their actual enforcement. Defenders must ensure operational rigor and educate employees on social engineering tactics.
• Redundancy and adversary thinking are paramount: Security strategies should incorporate redundant controls across all attack surfaces, and defenders must continuously think like an attacker to identify and fortify potential paths of least resistance.

About the Speaker(s)

Satoki Tsuji is a distinguished security professional from Ricerca Security, Inc. Hailing from Japan, he is recognized as one of Japan's leading Capture The Flag (CTF) players, having participated in the prestigious Defcon CTF finals for four consecutive years. His expertise is further acknowledged by his inclusion in the Google Bug Hunters Hall of Fame, underscoring his deep understanding of vulnerabilities and offensive security techniques.

Yuma Kurogome is the Chief Technology Officer (CTO) at Ricerca Security, Inc. In his role, Yuma oversees the company's offensive security operations, including its advanced penetration testing services. His practical experience in designing and executing complex attack scenarios, as demonstrated in this talk, is central to Ricerca Security's mission of providing comprehensive security assessments based on real-world threat intelligence.