The setup: the exercise
It was a multi-day, multi-agency exercise simulating the theft and exfiltration of fissile material. It tested whether the layered teams could detect and track the material along its path:
- Day 1, Friday. A simulated breach of Lawrence Livermore: penetrate the perimeter, enter the facility, acquire the material, and get it out to a waiting vehicle.
- Day 2, Saturday, my day. Drive the material to the Port of Oakland, load it onto a small craft, and run it out to a large boat.
- Day 3, Sunday. Stash it aboard the large boat and take it out of the Bay.
The involved parties were the US Air Force, the US Coast Guard, researchers from various national labs and commercial outfits, and state and local law enforcement. I was told they’d be staging on the Treasure Island Coast Guard station. My job was to red-team the event, scored against the cybersecurity CIA triad of Confidentiality, Integrity, and Availability.
What I packed
Not knowing what tech would be in play, I packed broad: a laptop running Kali Linux, a Yagi Wi-Fi antenna, a HackRF software-defined radio, a USB cellular sled with a SIM, a VPN, and my own custom tools.
Net result
I spent the next few hours hanging around, driving some remote-controlled bots, talking with folks, and writing up my findings.
What I learned
- You attack the model, not the box. I never saw their network. From my driveway I pictured how an exercise like this had to be wired, then went straight at the seams. It’s the LEGO move run backwards: build the system in your head, then find the one place reality lets you in.
- The CIA triad fell to fundamentals, not exotics. An unchecked gate, WEP, unpatched/unlicensed Windows, and default credentials on power gear were enough to beat a federal counter-WMD exercise. The scariest attacks are the basics left undone.
- Integrity is often the deadliest of the three. Reading their traffic was bad. Poisoning the trusted channel was worse. When people trust a compromised system, you don’t need to shout. You just nudge.
- Physical access is still the whole game. None of it happens if the gate checks an ID.
Key people
- Craig Schultz brought Paul in.
Technologies / methods
Kali Linux; Yagi directional Wi-Fi; HackRF / Gqrx for the RF survey; USB cellular + VPN; the CIA-triad assessment rubric applied to a live field exercise.