[Figure: FiveStudy logo]
FiveStudy
Cybersecurity · Unit 2 · 2.2.a
AP Cybersecurity · Securing Spaces
Common Physical Attacks
They bypass every technical control — and most of them work by exploiting politeness.
key ideaPhysical attacks bypass every technical control. Ask whether the authorized person knew.
How the attack works
[Figure: Three attacks, three different failures. Left, an authorized person opens the door for someone; center, a screen is read over a shoulder; right, an unattended desk. None of them defeats a technical control — they go around it.]
Three attacks, three different failures. Left, an authorized person opens the door for someone; center, a screen is read over a shoulder; right, an unattended desk. None of them defeats a technical control — they go around it.An adversary who reaches a device physically can defeat controls that would stop them entirely over a network. That is why the entry attacks matter so much — and why they rely on politeness and inattention rather than on any technical weakness.
Both get the adversary through the same door. Piggybacking is a social engineering attack; tailgating is a stealth attack — and they need different controls, which is why the CED separates them.| Attack | What the adversary does | Requires | What it yields |
|---|
| piggybacking | manipulates an authorized person into granting access | social engineering | entry, with a witness |
| tailgating | follows closely without the person's awareness | timing and nerve | entry, unnoticed |
| shoulder surfing | watches a user access sensitive information | proximity, sometimes a camera | credentials, PINs, screen content |
| dumpster diving | searches physical trash | access to the bins | documents, notes, discarded media |
| card cloning | copies an authorized access card | brief proximity to the card | all the resources that card opens |
Card cloning is the one that scales: the copy grants everything the original user is authorized for, at any time, without any further interaction.
| Piggybacking tactic | Why it works |
|---|
| carrying something large | holding the door feels like basic courtesy |
| wearing a plausible uniform | authority and familiarity, borrowed |
| engaging someone in conversation | refusing mid-sentence feels rude |
| arriving with a group | consensus — everyone else was admitted |
Every tactic here exploits a norm, not a flaw. The defense has to make refusing feel normal — which is a training and culture problem, not a hardware one.
Indicators
PiggybackingAccess granted by an authorized person who was socially engineered into granting it.
TailgatingAccess taken by following close behind, without the authorized person’s awareness.
Shoulder surfingWatching — or recording — a user access sensitive information, for use later.
Dumpster divingSearching a target's physical trash for anything that advances the adversary's goal.
Card cloningCopying an access card so the clone opens everything the original opens.
what shows up in the record
- An entry event with no matching badge swipe — two people, one credential.
- Someone in a restricted area whose badge nobody has seen.
- The same card used at two places at once — the signature of a clone.
- Sensitive documents in general waste rather than in secure destruction.
Worked analysis
EX 1
Which entry attack is it?
An adversary carrying two coffee cups smiles at an employee, who holds the door open. Name the attack and the control.
1
Ask whether the employee acted knowingly
Yes — they chose to hold the door.
2
Name the attack
Piggybacking: manipulating an authorized person into granting access.
3
Identify the mechanism
Social engineering — full hands make refusal feel unkind.
4
Choose the control
A vestibule or turnstile makes one-swipe-one-person physical rather than optional.
5
Add the human layer
Training that makes challenging normal, so refusing does not feel like an accusation.
EX 2
The card that was never taken
A contractor's badge opens doors at 02:00 while the contractor is at home with their badge in their pocket. Explain.
1
Note what is impossible
The card cannot be in two places, so the physical card was not used.
2
Name the attack
Card cloning — a copy made from brief proximity.
3
State the consequence
The clone opens everything the contractor is authorized for, indefinitely.
4
Give the detection
Impossible-travel and duplicate-use alerts on badge events.
5
Give the mitigation
Cards with cryptographic authentication rather than a static readable identifier.
EX 3
The attack with no entry at all
An adversary sits in a café opposite a bank branch with a long lens, and separately collects the branch's discarded paperwork. Name both attacks.
1
Name the observation attack
Shoulder surfing — watching a user access sensitive information, here with a camera for later analysis.
2
Name the collection attack
Dumpster diving — going through physical trash for useful information.
3
Note what neither required
No entry, no credentials, no technical skill.
4
Give the controls
Privacy screens and positioning for the first; shredding and secure destruction for the second.
5
State the principle
Some physical attacks never cross the threshold. The perimeter is not the only boundary that leaks.
Real incident
physical penetration test · regional bank · two-day engagement
A tester entered a secure floor carrying a ladder and was offered directions
Hired to test physical security, a tester wore a contractor's uniform and carried a ladder. Staff held three separate doors and one employee walked him to the server room. His badge was never checked. He photographed a whiteboard of credentials and left through the front entrance.
Why it matters here: Every door had a working reader. The control was bypassed by people being polite at it — which is why vestibules and a culture where challenging is normal do more here than better locks.
Check yourself
Distinguish piggybacking from tailgating.
Show answer
Piggybacking is done with the authorized person’s knowledge — they are socially engineered into granting access. Tailgating is done without their awareness — the adversary simply follows close behind.
Why is card cloning more serious than a single unauthorized entry?
Show answer
The clone grants everything the authorized user can reach, repeatedly and at any time, with no further contact and no obvious sign the card was ever compromised.
Name two attacks that require no entry to the building.
Show answer
Shoulder surfing — watching or recording a user accessing sensitive information — and dumpster diving — searching physical trash.
Why do physical attacks matter so much to overall security?
Show answer
An adversary with physical access to a device can often bypass technical controls entirely — plugging in hardware, taking the device, or reading what is on the screen.