Passive Reconnaissance: Google Maps

Physical security weaknesses:
1. Tailgating through doors
2. Unsecured server rooms
3. Unlocked networking closets
4. Dumpster diving
5. Social engineering at reception

One physical breach can:
→ Bypass all network security
→ Access internal systems
→ Plant hardware implants
→ Steal physical documents

✓ Building layout and structure
✓ Entry/exit points
✓ Security measures (cameras, fences, guards)
✓ Parking and loading areas
✓ Rooftop infrastructure
✓ Nearby facilities
✓ Vulnerable access points
✓ Escape routes

Ground-level photography
360° panoramic views
Time-travel (historical imagery)

Entry points:
- Main entrance
- Side doors
- Loading docks
- Emergency exits
- Parking garage entrances

Security measures:
- Cameras (type, placement, coverage)
- Security booths
- Gates and fences
- Badge readers
- Reception desk visibility

Signage:
- Company names
- Tenant listings
- Security company signs
- Visitor parking signs
- Restricted area warnings

1. Enter company address
2. Drag "Pegman" (yellow figure) onto map
3. Blue lines = Street View available
4. Drop on blue line
5. Navigate around building

1. In Street View, click clock icon
2. View historical imagery
3. Compare security over time
   - New cameras?
   - Changed fences?
   - Construction/renovations?

Rooftop:
- HVAC systems (roof access)
- Generators (backup power locations)
- Satellite dishes (communications)
- Antennas (wireless infrastructure)
- Solar panels
- Skylights (potential entry)
- Rooftop doors/hatches

Perimeter:
- Fence lines
- Gates (number, locations)
- Guard shacks
- Parking lot layout
- Delivery areas
- Dumpster locations

Surroundings:
- Neighboring buildings (vantage points)
- Open areas (visibility)
- Natural cover (trees, hills)
- Access roads

Google My Business reviews often include:
- Interior photos (uploaded by visitors)
- Lobby layout
- Security desk
- Badge systems visible
- Network infrastructure (sometimes!)
- Employee photos (social engineering targets)

Look for mentions of:
- Security procedures
- Badge requirements
- Visitor check-in process
- Employee behaviors
- Company culture
- Shift changes
- Busy/quiet times

Benefits:
- Understand building height
- Multiple angle viewing
- Terrain analysis
- Roof access difficulty
- Line-of-sight calculations

1. Search location
2. Enable 3D buildings (bottom right)
3. Tilt view (hold Shift + drag)
4. Rotate (Ctrl + drag, or compass)

1. Click clock icon (top left)
2. Slide timeline
3. View construction progress
4. Identify changes:
   - New security measures
   - Renovations
   - Expansion
   - Infrastructure additions

Measurements:
- Building dimensions
- Fence perimeter
- Distance to gate
- Parking lot size
- Distance between cameras

Usage:
1. Tools → Ruler
2. Click start point
3. Click end point
4. Read distance

Analyze:
- Elevation changes
- Natural barriers
- Visibility from road
- Approach vectors
- Drainage (where does water go?)

Physical Security:
☐ Perimeter fencing (type, height, gaps?)
☐ Gates (manually operated, automated?)
☐ Security cameras (count, coverage)
☐ Lighting (well-lit, dark areas?)
☐ Security booth/guard presence
☐ Barriers (bollards, planters)

Access Points:
☐ Main entrance (single, multiple?)
☐ Employee entrance (separate?)
☐ Loading docks (times active?)
☐ Emergency exits (alarmed?)
☐ Parking garage (access control?)

Infrastructure:
☐ Power (visible generators, UPS)
☐ Communications (satellite dishes, antennas)
☐ HVAC (roof units, locations)
☐ Network (external equipment, ISP demarc)
☐ Backup systems (diesel tanks, solar)

Surroundings:
☐ Neighboring businesses
☐ Public access nearby (parks, streets)
☐ Visibility from road
☐ Natural concealment
☐ Escape routes

Target: TechCorp headquarters
Address: 123 Innovation Drive
Goal: Assess physical security for authorized red team engagement

Search: "123 Innovation Drive"
Result: Large office building, parking lot

Front entrance:
- Glass doors (main entrance)
- Security desk visible inside
- Badge readers on doors
- Two cameras covering entrance
- Visitor parking signs

Side entrance:
- Employee entrance (badge required)
- Smoker's area nearby
- Door props open sometimes (review mention)

Loading dock:
- Rear of building
- Roll-up door
- Keypad access
- Active 8am-5pm (delivery hours)

Rooftop:
- 4 large HVAC units
- Small roof access door (north side)
- Satellite dishes (3)
- Antenna tower

Perimeter:
- Chain-link fence (east side only)
- Open parking (west and south)
- Dumpster enclosure (northeast corner)

- Coffee shop across street (vantage point)
- Public park (200m south)
- ISP junction box (visible, southwest corner)
- Cell tower (300m west)

Google reviews mention:
- "Friendly security guards" (guard presence)
- "Forgot my badge, had to call" (strict access)
- "Visitor parking easy" (public can park nearby)
- "Great roof deck!" (roof is accessible, at least to employees)

Google Maps + Street View + Reviews + Photos
= Comprehensive picture

Example:
- Maps: Shows building exists
- Street View: Shows camera at door
- Review: "New cameras this year"
- Photo: Interior shot shows badge readers

ISP demarc:
- Small box on exterior
- Usually labeled (AT&T, Comcast, etc.)
- Wires entering building
- Potential physical attack point

Generators:
- Diesel tanks visible
- Exhaust vents
- Often behind fence
- Power backup = important facility

HVAC:
- Large roof units
- Maintenance access
- Potential roof entry
- May have network connections (IoT)

Visible antennas suggest:
- WiFi access points
- Cellular repeaters
- P2P wireless links
- Microwave backhaul

Note locations for wardriving:
- Where to park for signal access
- Line-of-sight to antenas
- Public areas with good coverage

From maps, identify:
- Smoker's areas (tailgating opportunity)
- Loading docks (delivery disguise)
- Busy entrance times (blend in with crowd)
- Nearby businesses (pretexts: "Wrong building!")
- Coffee shops (where employees might be)

https://www.bing.com/maps

Sometimes different imagery dates
Bird's Eye View (45° angle)
Often higher resolution

Look Around (similar to Street View)
Different imagery
Sometimes more recent
3D flyover in major cities

https://wikimapia.org

User-contributed annotations
Building labels
Area descriptions
Historical info

https://www.openstreetmap.org

Community-driven
Building outlines
Point-of-interest data
API access for automation

1. Google Maps: Physical layout
   ↓
2. Company website: Office locations, hours
   ↓
3. Employee LinkedIn: Office photos, building names
   ↓
4. News articles: Construction, security upgrades
   ↓
5. Job postings: "Security guard needed, Night shift"
   ↓
6. Complete picture of target facility

1. Search your office/school on Google Maps
2. Switch to Street View
3. Document:
   - Visible security measures
   - Entry points
   - Camera locations
   - Any security weaknesses you notice
4. Switch to Satellite View
5. Identify rooftop infrastructure
6. Would this information help an attacker?

1. Find a large corporate campus on Google Earth
2. Use time slider to view historical imagery
3. Note changes over 5-10 years:
   - New buildings?
   - Added security features?
   - Expanded parking?
4. What does this reveal about company growth?

1. Pick a data center (search "data center [city]")
2. Identify on maps
3. Document:
   - Perimeter security
   - Power infrastructure
   - Redundant connections
   - Fiber optic routes (manholes, markers)
4. How well-protected is it?

1. Choose a corporate building
2. Find nearby:
   - Coffee shops
   - Parks
   - Parking garages
   - Other buildings
3. Which locations offer views of target?
4. Which are public and accessible?

✓ Publicly available information
✓ No laws against viewing maps
✓ Authorized penetration testing
✓ Physical security assessment (authorized)
✓ Educational purposes

✗ Don't use for stalking
✗ Don't use for burglary planning
✗ Don't trespass based on info
✗ In pentesting: Get explicit authorization
✗ Document for reporting only (authorized client)

Red Team Engagement:
1. Get written authorization
2. Define scope (physical testing included?)
3. Document findings
4. Report to client
5. Help improve security

Purpose: Improve security, not exploit it

You can't remove from Google Maps, but you can:

1. Be aware of what's visible
   - Review your own facilities
   - Document exposed security
   - Assume attackers see everything

2. Don't rely on obscurity
   - Secure even "hidden" entrances
   - Assume layout is known
   - Plan for informed attackers

3. Layer security
   - Physical + technical controls
   - Defense in depth
   - Monitoring and response

4. Train employees
   - Tailgating awareness
   - Suspicious behavior reporting
   - Photo policy (employees posting pics?)

For documentation:
- Built-in screenshot (Print Screen)
- Snipping Tool (Windows)
- Screenshot (macOS: Cmd+Shift+4)
- Lightshot
- ShareX

Mark up maps:
- Paint/Preview (basic)
- GIMP (free)
- Photoshop (advanced)
- Draw.io (diagrams)

Document findings:
- OneNote
- Evernote
- Obsidian
- Markdown files
- Joplin

Google Maps:
Street View: Drag yellow person to map
Satellite: Button in bottom-left
Historical: Clock icon in Street View
3D: Tilt with Shift+drag (desktop)

Google Earth:
Historical imagery: Clock icon (top toolbar)
Measure: Tools → Ruler
3D buildings: Bottom-right toggle
Tilt/rotate: Shift/Ctrl + drag

Key things to document:
- Security cameras and coverage
- Entry/exit points
- Perimeter security (fences, gates)
- Rooftop infrastructure
- Nearby public areas
- Infrastructure (power, communications)