Adversaries may gather the physical locations of a victim organization. MITRE lists this under Reconnaissance with platform PRE. Locations can show where key resources and infrastructure are housed, and which legal jurisdiction or authorities the victim operates within.
How attackers use it
MITRE says the information may come from direct elicitation, such as phishing for information, or from data sets such as the victim's own websites and social media.
It can lead to more reconnaissance, to acquiring or developing capabilities, and to initial access through phishing or hardware additions. That last one is the physical angle: a device placed in a location the attacker has identified.
The physical angle is easy to forget in a security program that focuses on networks. A person walking into a branch office with a small device is a different problem from a remote scan, and it needs different checks.
How to detect it
MITRE notes that this activity may have a very high occurrence and false positive rate, and may take place outside your visibility, which makes detection difficult. Its advice is to focus on related stages of the adversary lifecycle, such as initial access.
Physical access attempts are better caught by physical controls: visitor logs, badge records, and checks on unfamiliar devices plugged into the network.
How to reduce the risk
- MITRE says this technique cannot be easily mitigated with preventive controls, because it is based on behaviors performed outside the scope of enterprise defenses and controls. Its guidance is to minimize the amount and sensitivity of data available to external parties.
- Decide which locations need to be public, and avoid naming where sensitive infrastructure is kept.
- Check unused network ports and wall jacks, and use port security or network access control on them.
- Remind staff to challenge unknown visitors and to report unfamiliar devices.
Quick check
Which initial access technique has a physical angle here?
Hardware additions.
Where is location data commonly found?
The victim's own websites and social media.
Sources
- MITRE ATT&CK, Determine Physical Locations (T1591.001): https://attack.mitre.org/techniques/T1591/001
