20

When doing penetration testing (hired as a security consultant to examine and test a company's security by simulating an attacker), it's necessary to have a document called "Permission to Attack" (PtA) which outlines the scope of your actions and gives you explicit authorization to perform them. The same is true with physical pentesting where the pentester emulates physical attackers (even to the point of picking locks and forging access credentials, assuming it authorized in the scope).

One must have the document with them in case they are "caught" by the organization's security. On the Information Security site, the answer to a question about this suggests that it could be better to first forge the document and, if it is accepted by security, you continue on your way and document security's failure to stop you (since a real criminal could have forged the document as well). If, on the other hand, they don't accept the forged document, then you provide the real document.

The following is from the accepted answer (emphasis in original):

If you don't have your Permission to Attack with you, it's like driving without a driver's license. That said, if you are caught during an engagement, I recommend the following:

  1. Present a forged Permission to Attack. This way, you can see if criminals could possibly trick a security guard to letting them do their thing with a fake Permission to Attack.

  2. Present the real Permission to Attack. If a guard has not bought your fake slip, then it's time to hand in the real slip. If the guard believes you, it's time to pick up and leave the perimeter. A real attacker would have been stopped at this point. If the guard did not believe you, ask them kindly to talk to their supervisor. If they insist on not believing you and calling the police, so be it. You're not a criminal, so don't worry about it.

Are there any circumstances under which this would be illegal?

Improve this question
7
  • 1
    You may want to preface this with a definition on what is 'penetration testing' as used in this question. I had to infer the definition by reading the full post, but from the first sentence I went to at least 3 different potential options at first and none were correct.
    – Pyrotechnical
    Feb 22, 2021 at 17:46
  • A real attacker pretending to be a hired pentester is so meta! I suppose either way, if you get to the stage of needing to present your PtA, the guards have won. The guard should say "I caught you, you're done, go home and write your report (and be sure to mention my name)". I suppose if they buy your fake PtA then you save some jail time, but still didn't steal whatever you were after. The guard shouldn't say "You have a letter, in that case let me unlock the server room for you!"; although I suppose some guards might, which is why it's a good test :P
    – Mike Ounsworth
    Feb 22, 2021 at 23:04
  • 2
    @MikeOunsworth The fact that some guards might is exactly why it's a good test.
    – forest
    Feb 22, 2021 at 23:06
  • @MikeOunsworth One reason I see for the guard to not send the pentester/attacker home right away, is that they might have caught them after they already did something and were exiting or between objectives.
    – Luris
    Feb 23, 2021 at 8:45
  • 1
    Please keep in mind that this community only deals with the question "is it legal". The question "is it good practice to conduct that kind of penetration test" is a question for security.stackexchange.com
    – Philipp
    Feb 23, 2021 at 11:52

1 Answer 1

Reset to default
28

It's legal, because the pentester doesn't have the intent to defraud.

California Penal Code Section 470 governs forging documents, signatures, handwriting, etc. All of its provisions making actions illegal begin with "Every person who, with the intent to defraud..."

Because the company itself is aware of and has authorized their actions, the pentester isn't attempting to defraud the company whose premises they are attempting to enter. They are providing forged documents to the guard (who isn't aware of the test), but a real attacker doing that would be attempting to defraud the company, not the guard.

Of course, as with any otherwise-illegal action taken during a penetration test, this assumes that the agreement with the company granted the pentester permission to take that action (i.e., that it was in scope for the test).

Improve this answer
5
  • 27
    This is true as long as the real PtA and contract are properly scoped to include such deception. You really should have a lawyer reviewing the specific documents rather than relying on a general answer from the internet unless you interest is just the general principle by which this is supposed to go and not covering your own ass for a real pentest.
    – R.. GitHub STOP HELPING ICE
    Feb 22, 2021 at 15:34
  • What about for other states? Are there any where this would be illegal?
    – forest
    Feb 22, 2021 at 22:59
  • 8
    @forest I'd have to check 49 other states' laws to be sure, but I'd be quite surprised if it were illegal in any state to attempt to enter the premises of a company by presenting a forged document to someone working for that company when you have an agreement with the company permitting (specifically paying to you to do so, in fact) you to do so.
    – Ryan M
    Feb 22, 2021 at 23:46
  • So it's legal (if done right). How long are you likely to be in jail for, before a judge reads your document?
    – user253751
    Feb 23, 2021 at 9:31
  • 7
    @user253751 48 hours max, excluding Sundays and holidays (slightly longer if the 48 hours ends when the court isn't in session). But if you can't convince the police to let you go after they talk to your contact and you end up having to wait for a judge, something has gone very wrong.
    – Ryan M
    Feb 23, 2021 at 9:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .