Full Report
Who needs a working security badge when you know how to talk your way into the records room?
Analysis Summary
# Tool/Technique: Social Engineering (Pretexting) and Network Misconfiguration
## Overview
This report focuses on a real-world Red Team engagement involving **Social Engineering (Pretexting)** to bypass physical security controls and the exploitation of **Network Segmentation (VLAN) failures** to access sensitive Patient Identifiable Information (PII). The primary objective was to demonstrate how human rapport and poor network hygiene can bypass electronic security measures like RFID badges and encryption.
## Technical Details
- **Type:** Technique / Human Element
- **Platform:** Physical Healthcare Facilities, Internal Wired/Wireless Networks
- **Capabilities:** Physical Access, Identity Theft, Data Exfiltration (PII/PHI)
- **First Seen:** Historical (Case study published July 2026)
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566 - Phishing (In-person context/Social Engineering)]
- [T1078 - Valid Accounts (Implicit trust via fake identity)]
- **[TA0009 - Collection]**
- [T1039 - Data from Local System (Physical Files)]
- [T1040 - Network Sniffing (Guest Wi-Fi to VLAN 1)]
- **[TA0007 - Discovery]**
- [T1046 - Network Service Discovery]
## Functionality
### Core Capabilities
- **Pretexting:** Creating a fabricated scenario (new employee struggling with a difficult doctor) to manipulate staff into bypassing security protocols.
- **Physical Impersonation:** Using industry-specific attire (scrubs) and non-functional props (fake security badges) to establish visual legitimacy.
- **Network Scanning:** Utilizing guest access points to map internal infrastructure due to lack of network isolation.
### Advanced Features
- **VLAN Hopping/Flat Network Exploitation:** Leveraging the lack of segmentation (VLAN 1) to access high-value medical devices (MRI machines).
- **Packet Inspection:** Capturing unencrypted PII (Social Security Numbers, DOB) transmitted in cleartext by medical equipment.
## Indicators of Compromise
- **File Hashes:** N/A (Physical theft/Network sniffing)
- **File Names:** Physical medical records/folders.
- **Registry Keys:** N/A
- **Network Indicators:**
- Unexplained high-volume scanning originating from `Guest_WiFi_SSID`
- Traffic from medical imaging devices (MRI) visible on non-clinical subnets.
- **Behavioral Indicators:**
- Individuals "tailgating" or requesting manual overrides for faulty badges.
- Repeated badge-swipe failures at secure ingress points followed by social interaction with staff.
## Associated Threat Actors
- **Red Team/Penetration Testers:** Known use by Dahvid Schloss.
- **Insider Threats:** Disgruntled employees or those coerced via social engineering.
- **Opportunistic Actors:** Individuals exploiting flat networks in public-facing lobbies.
## Detection Methods
- **Behavioral Detection:** Monitoring "Failed Swipe" logs in physical access control systems followed by a "Manual Override" or "Door Forced Open" event.
- **Network Monitoring:** Utilizing IDS/IPS to detect scanning activity (Nmap/Masscan) originating from guest networks.
- **Data Loss Prevention (DLP):** Detecting unencrypted Social Security Numbers and PII being transmitted across the network in cleartext.
## Mitigation Strategies
- **Security Awareness Training:** Implementing "Stop/Challenge" protocols for all employees, regardless of appearance or shared grievances.
- **Network Segmentation:** Moving all medical devices and sensitive databases to isolated VLANs with strict Access Control Lists (ACLs).
- **Physical Security Hardening:** Implementing multi-factor authentication (e.g., biometrics + badge) for high-sensitivity areas like records rooms.
- **Encryption in Transit:** Mandating TLS/SSL for all medical devices communicating on the hospital network to prevent sniffing.
## Related Tools/Techniques
- **Tailgating:** Following an authorized person through a secure door.
- **Badge Cloning:** Electronically duplicating a HID or RFID card.
- **Man-in-the-Middle (MitM):** Intercepting unencrypted traffic between medical devices and servers.