134: Deviant

Episode Summary

Executive Summary: This Darknet Diaries episode explores physical penetration testing through three stories from Deviant Ollam: an Antwerp vault robbery showing wall-bypassing, his career origin in office door shimming, and detailed assessments of elevator, badge, and gate weaknesses. The central lesson is that organizations often overinvest in visible defenses while leaving physical access, social engineering, and operational gaps exploitable.

Main Topics: Antwerp vault robbery and wall bypassing (Priority: 5/5): The episode opens with a 2019 Antwerp diamond-district bank robbery where thieves drilled through a thick concrete vault wall over a weekend, bypassing the heavily protected vault door and sensors. How Deviant Ollam became a physical penetration specialist (Priority: 5/5): Deviant describes moving from network work and hobbyist lockpicking into physical security consulting after an office door shimming demo exposed major access-control flaws and led to his first real client work. Elevator hacking and hidden physical controls (Priority: 4/5): A long anecdote explains how elevator systems can be manipulated with common keys and access to service modes, showing that elevators are security-relevant endpoints rather than opaque infrastructure. Social engineering and trust-based bypasses (Priority: 5/5): Several stories show how Deviant uses believable roles, technician language, badges, uniforms, and calm demeanor to get guards and staff to cooperate rather than resist. Multi-layer campus assessment at a factory/utility site (Priority: 5/5): The third and longest story details a large coordinated operation involving surveillance, badge cloning, tailgating, trunk concealment, fence testing, and deliberate escalation to demonstrate real security gaps. Ethics and goals of physical penetration testing (Priority: 4/5): Deviant emphasizes that the point is to produce actionable findings, help clients improve, and avoid harm; being 'caught' can be a successful outcome if it shows employees are attentive.

Key Arguments: Physical security often concentrates on the most obvious control point, such as a vault door, while leaving walls, hinges, gaps, or side entrances less protected. A good physical penetration test is not just about getting inside; it is about understanding detection, response, and whether staff challenge suspicious behavior. Social engineering works because people respond to confidence, role cues, and plausible technical language, especially when the tester behaves like a legitimate contractor or technician. Elevators, badge systems, and gate controls are attack surfaces that should be tested like doors and networks, because they frequently rely on simple mechanisms or reusable credentials. Defense in depth matters: strong perimeter security is not enough if interior doors, access readers, or human procedures are weak. A successful test can involve being detected or stopped, because that reveals that employees are engaged and the client’s security culture is functioning. The strongest security improvements come from combining physical controls, electronics, and informed staff who are empowered to challenge anomalies.

Data Points: Robbery year: 2019 - The Antwerp diamond-district bank robbery discussed at the start of the episode. Vault wall thickness: Six to eight feet - The concrete wall drilled through to access the vault. Borehole diameter: About 12 inches - Three overlapping holes were drilled through the wall to reach the vault. Training/talk count: 300 to 400 talks - Deviant says he has given hundreds of physical security talks over the years. Elevator talk timing: Sunday / last talk of the last day - DEF CON scheduled the elevator hacking talk late to reduce risk of misuse in Las Vegas. Weekend intrusion window: All weekend - The Antwerp thieves used the bank closure period to drill without being caught. Team size for the large facility job: Multiple teams across at least 6+ people - The final assessment involved several specialists, interns, and overlapping teams. Recon duration: Almost a week - The utility/critical infrastructure target was surveilled for nearly a week before action. Gate dwell time: About 20 seconds - The vehicle gate at the large facility remained open long enough for tailgating. Caught status: First and only time described as fully caught - Deviant says the factory/utility engagement was the only time he had to produce authorization and be fully challenged.

Pivotal Quotes: "We've never not gotten in." — Deviant Ollam: He explains that success in physical assessments is measured more by detection and response than by whether entry is possible. "You don't have to live in fear, you just live in awareness." — Deviant Ollam: His closing philosophy on physical security and teaching people to notice weaknesses without panic. "The dark isn't that scary because it's dark. It's just because you didn't know what was in there." — Deviant Ollam: He describes why he likes showing people how physical security failures work.

Implications: Listeners should see physical security as layered, human, and testable. Organizations need defense in depth, trained staff, and regular assessments of doors, badges, elevators, gates, and procedures—not just obvious barriers.