The typical red teamer is enthusiastic about security to the point of obsession.

“It's the thing that we luckily get paid for because we would be doing this stuff anyway: it's kind of our hobby/passion/mild obsession. And this stuff does not stop at five o'clock,” says Van de Wiele.

However, that does not mean that every member of a red team is the same: quite the opposite. Each team is assembled for a specific target, much like a heist, to cover a diverse range of skills.

“We have to be able to test different companies and organisations and different business sectors and for that reason we have a very, very specialised team,” he explains.

“That means we have people specialising in social engineering. We have – my favourite term – amateur locksmiths who have taught themselves how to open locks. We have people who do window security and access control security, embedded systems – you name it.

“Any kind of profile that we can use to put together a crack team to be able to help companies to protect themselves against organised crime, against the opportunistic attacker, anyone who wants to perform any of the worst-case scenarios for our customers.”

These teams will work together to find any security loopholes they can within a company, from a lack of inter-departmental communication to overlooked ways of accessing a building. And they do so while remaining on the right side of the law and with the permission of the company.

To illustrate how F-Secure’s red team works, Van de Wiele gives the example of what he calls “Operation Money Grab”, a fictional operation that is an amalgamation of several of his real past projects.

“It is an international manufacturer of electronic goods that we have to get into. Their physical location is in three buildings on a campus of some sort and they use a certain application, they told us, [but] I cannot tell you the application because that would give away the customer,” he says.

As with a heist, the team has multiple steps it must achieve in order to complete its goal.

“We have to gain access to the building physically. We have get access to the right department: to the financial department. We have to access that application and we have to transfer money,” he explains.

“The customer says: 'Can you please transfer €5,001 from account X to Y?'. And we are like: ' Yeah, that's fine, but why €5,001? Why not €5,000?' and the customer just smiles, which is fine. Creepy, but fine.”

The first step is to gain as much intelligence on the company’s campus as possible, in order to identify potential security weak points.

“It's three buildings and one campus, so we have to figure out what access control system they are using. When do the guards come? What are they using for garbage disposal? Stuff like that,” he says.

This will often involve what Van de Wiele describes as “open-source intelligence gathering”, where they will purchase blueprints of the buildings from government departments, an option that is available in most European cities.

“For a few euros they will give you the architectural maps and that will show us the entrances, exits, stuff like that, via a courtyard or garden, because maybe it's not apparent from the outside; not even Google Maps has that information.”

Information can also be gleaned through the social media accounts of the company’s employees.

“This guy takes this screenshot of his new work station that's fantastic, but now you're showing me all the applications that you use the most, which allows me to target you. So watch what you put on social media,” he warns.

They will also will look for information from what the company throws away.

“We're going to steal the garbage, which is usually what the juniors get, that's how you start on our team. And anything that is not purple yoghurt or hairy bananas is going to be of use to us. Gossip, mail headers, signatures, stuff like that,” he says. This can prove a surprisingly effective way of getting access.

“[We might come] across an email that says 'hah, after seven months of having this service ticket open we've finally got it through, congratulations to all of you' and then we just call up that person,” explains Van de Wiele. “'Hello, I'm the database administrator, yeah that one transaction of type 123 that didn't go through'. And the person just starts dying on the other end of the line like: 'You have no idea how long we've been working on this thing'. 

“'I know, I know, but it's not going through. It's some kind of four-eyes principle, because it's been lasting for so long. So I just need to verify that your password starts with a P...it does not start with a P? Can you just give me your password so that we can get this sorted'.

“And often they give me the password, and we're done. Stupid? Yes. Does it work? Oh yes.”

Alternatively, information found in the rubbish might tell them what kind of printer the company uses, in which case they will phone up pretending to be from the company in question.

“We ask one of our colleagues with a nice warm female voice to call up the IT manager to say 'yeah there's been this security fix for Canon printers. It happened in the factory so it's on us. When can we send a guy?' and the next day one of our colleagues shows up saying 'Hello I'm here for the printer' and they leave you alone.”

If F-Secure’s red team gets nothing from the garbage, they may try a different approach: applying for a job.

“We have some CVs that will knock your socks off,” he says.

The goal here is not to get the job; in fact the team member in question will work quite hard not to get it once they are inside the building. Instead they are trying to get an interview.

“You're inside the building and you say: 'Look my wife is pregnant, it's the doctor, do you mind if I just stay in the meeting room for five minutes?' And they'll leave you,” he says.

“You log in with the computer that you've brought and then you call your colleagues saying: 'Did you get in?' and they say: 'Yep we have persistent access', because that little boxy thingy connects out to the network and then climbs back in and we're in.”

The team may also resort to a more classic method of gaining network access: the phishing email.

“You will click on my phishing email. Why? Because maybe I determine that you're running Outlook. Maybe I know that you have one of these pop-up notifications on, I know when you're sitting in a meeting, you're presenting your new stuff to your colleagues,” he says.

“You see the pop up coming up saying: 'Thank you so much for subscribing to the adult content newsletter, if you did not sign up for this please click this link', which doesn't go there obviously it goes to my server with a really nasty captcha to start off and you're not gonna get it and by the time you've solved the third attempt at my captcha, my code has finished running and we're done.”

This works because it removes people from a headspace where security is at the top of their minds.

“This hits people emotionally. You've never seen someone in a corporate banking environment click an unsubscribe link that fast.”

And this is just one of a host of phishing emails the team uses to illicit such a reaction.

“LinkedIn updates: ‘Sorry to inform you, you've been removed from the company name group following a complaint. You have 24 hours to rebut the complaint through the link here’. Everyone clicks the link. Even though their LinkedIn may not be associated with the company email address, which it shouldn't. People click: it's emotion.”

Thanks to the widespread use of wireless technologies such as WiFi and Bluetooth, the team also can get into the target network in several ways simply by being in close proximity to the office in question.

Certain widely used wireless keyboards and mice, for example, have a security vulnerability that makes it very simple for a well-equipped attacker to take control of them while standing nearby.

Van de Wiele has a pocket computer for this purpose, which is set up to detect the presence of devices with this vulnerability and take control of them. And once he has control, he can input whatever he likes to the computer they are connected to without even being in the same room.

“I can make it type a small program, and if I can type a small program I can also run that program, for example, as a backdoor,” he says.

And if the company doesn’t have devices with this vulnerability, it’s easy for the team to introduce some.

“You might say, 'Tom we have pretty good control over this because we know exactly what keyboard and mice we're using'. Well guess what? We're going to send you some,” he says. “We once sent a backdoored keyboard to an IT department and the IT department could not agree on who should have the keyboard so they all had it everyday. We heard everything: they changed the keyboard, so we backdoored the whole IT department.”

Then there is the manipulation of WiFi networks. One widely known approach is to create a duplicate of an open WiFi network, such as those found in cafes, and use it to insert malware onto the phones of those that connect to it.

However, the red team takes this a step further by cloning local networks that require a password. This is possible as apps are available that provide users with the WiFi passwords of local businesses, although Van de Wiele does warn that these are generally “complete spyware”.

With this information they will set up a clone of a local network – such of that of a popular local lunch spot – in a battery powered WiFi access point that they leave in the pannier of a bicycle chained up next to the office.

The phones of employees who have previously accessed the network will re-join it, allowing the clone network to insert malicious code into any unencrypted apps they have installed.

Then the phone’s owner will be presented with a false password prompt for any services the red team knows the company uses. And if they are fooled by it and enter their details – which they almost certainly will be – the team will have access to some very sensitive corporate data.

“I'm going to get your passwords and I'm going be able to do some pretty dangerous and nice things with it. For example, accessing your iCloud backups,” he says.

For all the ways in which the red team can get into the corporate network, for this operation they need to get physical access to a specific computer, which means getting into a well-guarded office after hours.

In some rare cases they do this by physically breaking a window, with permission from the company. But in most situations, access is far more straight-forward.

“We get into most buildings using a can of compressed air,” he says.

“Most buildings have motion sensors, which means that if you come from the outside and you want to walk in there's no motion sensor, or it won't trigger, but if you walk for the inside out towards the parking lot the motion sensor sees you and opens the doors.”

So how does the team kid the door into thinking they are on the other side?

“It helps to be tall. You stick a little straw through the window for the thing in the door and you spray the motion sensor and the door opens for you. That's it. These are the embarrassingly low-tech attacks.”

In some cases, a company will instead use a button to open the door. But if there is an unobstructed line of sight to the button, this can easily be circumvented too.

“If the button is right there then I'm going to bring my BB gun. I can shoot the button, which we've done as well, and the door opens.”

In Operation Money Grab, however, the company is using a keycard.

But while it may seem more challenging, it simply requires making use of an easily obtainable device to clone a keycard from a distance. And given how many people wear their keycard on a lanyard round their neck while on their commute, this isn’t hard to pull off.

“If it is inside your pocket you have less chance of losing it and you have less chance of a guy like me trying to clone it,” he says.

Of course, some companies instead use a pin, but there is a tool for this too: a small sensor-like camera that when attached to a phone shows the user heat signatures. Point this at a recently used keypad and you can easily figure out the pin number.

It also helps differentiate fake CCTV cameras from real ones, although Van de Wiele is dismissive of these.

“I don't think you have to be a mastermind to figure out how to disable those,” he says. “This is compliance for you, this is not security and that's kind of why companies like to cut corners.”

Once they’ve got in and found the target computer, they may wish to take it with them. However, if it’s a laptop, it may be tethered to the desk with a security cable.

“How do we get past this? Other than bringing huge bolt cutters? The ultimate of ultimate cyber weapons: a toilet roll,” he says.

“If you look on YouTube, you cut them in half, you roll it up, you stick it in and you turn, and most of them will open.”

Now in possession of the computer, the red team has to actually access it, which is challenging because it is locked.

“Well, your computer has ports, right? Several of them. You might even have one of these PCI express ports still exposed. You might have other things exposed,” he says.

“If you do we can put in a slot that is connected to a different computer and because the actual interface has what's called DMA, direct memory access. Using an interface, using my attack computer, I can write whatever I want in memory.

“I could write to the one condition that says 'computer is locked' and I change that, I press enter, and I don't need your password. I just change the actual value in the memory saying 'you're not locked anymore, it's fine'.”

If the company has been smart enough to lock down these ports, the team can also take measures to override this.

“We go to Ebay, we find a docking station for that laptop and – wahey! – the ports are back,” he says.

If all else fails, they can gain access through the computer’s hardware, by swapping out the module that allows the WiFi chip to interface with the rest of the computer.

“We take it out, we put ours in and now again we're in the memory, where we can write and read and the software won't even see it most of the time.”

The final goal in Operation Money Grab is to transfer €5,001, and it turns out there is a reason the customer was smiling when they gave the team that amount.

“We need to provide a fingerprint for transactions above $5,000. That's why the customer was smiling,” he says.

For this the customer uses a fingerprint scanner, which should in theory be impossible to replicate. However, in reality, most of the tools to do so are present in the customer’s own office.

“People don't always wash their hands and there's residue of oil and fat on your fingers and with that we can lift the print off that. From your mouse, from your keyboard, from a glass. Glass is the easiest,” he says.

Lifting the print is done using a toy detective set, the dust from a printer cartridge and scotch tape.

“Usually it's pretty easy to get off. We lift a print, we invert it, we print it out on paper with a normal inkjet printer,” he explains.

“And we're verified. So we beat this with a piece of paper.

“Now you might say: 'Not my fingerprint readers at work'. Really? Are you sure about that? And can we please see the report where you last tested that? This is usually where we get the awkward pause.”

With the fingerprint bypassed and the money transferred, Operation Money Grab is completed. But that may not be the end of their job with the company.

“We are successful, we're in, the customer is happy. They fix all the stuff, and we come back with even worse attacks until they can actually detect real attacks themselves,” says Van de Wiele.

“Sometimes during the job they call us saying: 'Hah, you attacked us! We saw that' and we're like 'Yeah that's not us', which means it works, right? It means we're teaching them where to look. And that's important.”

Of course, even if a company isn’t at the level of hiring a red team to test their security, there are basic actions they can do to minimise their risk.

“Try to minimise your digital footprint. That means, do you really need to have all your job vacancies on your website indexable by Google? Because that's the first thing that we go for when we want to find out what technology the company is using,” he says.

“Do you really want to share your birthday and all kinds of other stuff on LinkedIn? On your company pages? You want to make a big thing about the CEO's birthday today? That's great, thank you so much, because now we have his birthday.

“You have to be willing to work. Try to keep that at bay. When it comes to wireless emissions make sure we know exactly what hardware you have. When it comes to physical security it doesn't mean you have to remove all those systems, but are those systems protecting what they are supposed to protect?”

Most of all, act on the security knowledge that you have.

“You have the data but you're not acting upon it, and we want to help companies to act upon that data so they make the right decisions.”