Mystery visit: From physical access to full domain takeover
In the world of digital security, the focus is often on IT systems and data. Yet physical security is just as important. After all, if someone can easily break into a building, systems and information are still vulnerable. An effective way to test this is a mystery visit. In this blog, you’ll learn what a mystery visit is, what risks it uncovers, and how our subsidiary RedTeam managed to carry out a complete domain takeover for a client.
Mystery visit?
A mystery visit is a penetration test in which a security expert poses as a malicious actor attempting to gain physical access to an organization's premises. The goal is to determine how effective the physical security measures are and what vulnerabilities an attacker could exploit.
Our subsidiary, RedTeam, carried out a scenario like this for a client. What started as a simple mystery visit resulted in the compromise of not only the Dutch main domain but also international branches.
Step by step
Phase 1: Preliminary Reconnaissance
A Red Team tester conducted an initial observation. This involved assessing how the reception desk responded to strangers and how the building was laid out. The receptionist proved to be alert: strangers were approached immediately. However, this created an opportunity for a tactic involving two mystery guests: one to create a distraction, and one who could slip through unnoticed.
Phase 2: The Attack
During the actual attack, it turned out that sending in just one mystery guest was enough. The reception door was ajar, so the receptionist didn’t see the intruder. The tester walked on to a computer lab where several employees were present. Because their presence wasn’t considered suspicious, the mystery guest had free rein.
There, RedTeam discovered critical vulnerabilities:
- Computers without user accounts: Direct access was possible.
- None Network Access Control (NAC): A dropbox could be set up to allow remote access later.
- Ability to set up a tunnel from the computer to a Red Team server.
With this access, vulnerabilities were further exploited. As a result, RedTeam gained domain administrator privileges and were able to read stored login credentials from browsers. This enabled lateral movement to foreign domains. Because these environments were configured identically, the same vulnerabilities could be exploited again—resulting in complete domain takeover.
The physical and digital worlds intertwine
Not addressing strangers in the building may seem like a minor issue, but it can have major consequences—especially when combined with unprotected computers and a lack of network security. In this scenario, it led to complete domain compromise, including international environments.
This shows that physical and digital security are inextricably linked. Regular evaluations and tests—covering both human behavior and technical measures—are crucial to maintaining control over your overall security posture.
Testing Your Physical Security
Curious about what a mystery visit might reveal within your organization? Our subsidiary, RedTeam, conducts realistic in-person penetration tests that provide immediate insight into vulnerabilities and areas for improvement.