Defcon Lockpickers Open Card-And-Code Government Locks In Seconds

http://blogs.forbes.com/andygreenberg/2011/08/05/defcon-lockpickers-open-card-and-code-government-locks-in-seconds/

by rosser • 15 years ago

125 37 15 years ago

blogs.forbes.com

Cushman5• 15 years ago

It's just possible this is a title which deserves to be editorialized to "Defcon Lockpickers Open Card-And-Code Government Locks In Seconds With a Hammer." Edit: Make that "With a Rubber Mallet."

wglb• 15 years ago

But it is a soft hammer.

Cushman5• 15 years ago

Oh yeah, that was unclear— I don't mean it doesn't count, I mean these locks are ridiculous in a way this title doesn't fully capture.

jonknee3• 15 years ago

... Or a paper clip.

dlsspy• 15 years ago

There were three different security exploits. The first was rapping with a mallet to compress the springs and release the pins (similar concept to bumping).

But don't forget:

"In another bypass, they insert a wire into a silicon cover for an LED light that blinks red when the user enters an invalid code. That wire can ground a contact on the circuit board behind the light that triggers a function intended to allow the door to be opened with a remote button, bypassing all its security measures."

and

"A third attack allows an insider to open the back side of the lock and insert a wire that flips a microswitch intended as an override for power failures. That trick resets the lock’s software, tampering with its audit trail and allowing it to be reprogrammed with different codes. Bluzmanis demonstrated in a video that the more elaborate microswitch attack could be performed in under a minute."

Cushman5• 15 years ago

Yeah, that's what I'm saying— all these exploits are absurd. The security guys are experts, of course, but I just think implying this is "lockpicking" is giving the locks a little too much credit.

jrockway2• 15 years ago

I like how causing the LED to fail causes the microcontroller to decide to open the lock. And it even turns on the green LED when it does so!

Cushman5• 15 years ago

According to the article, they're not shorting the LED itself but poking a different wire which activates the remote-open-without-code system.

Which, hey, that's convenient.

Natsu• 15 years ago

I like how they say they haven't even disclosed the worst of the flaws, because they want the company to have a chance to fix this stuff.

And how the company is trying to tell us that these flaws can only be exploited in the lab. I can just imagine the security bulletins banning rubber mallets from the facility.

Cushman5• 15 years ago

It's kind of frightening to imagine what exploits these locks have are that are quieter and less detectible than sticking it with a paperclip.

It's also funny to imagine the company's security experts who just can't seem to reproduce the stick-it-with-a-paperclip trick outside of a laboratory environment. I'm surprised guys that sharp let the hammer trick slip through!

bennyfreshness• 15 years ago

Cool, but I don't understand $1,300 locks. If somebody can breech a permitter and actually physically get to the door I think maybe you should allocate resources elsewhere.

jonknee3• 15 years ago

These locks are frequently meant to keep out / track people you already pay to be inside a physical perimeter.

shareme• 15 years ago

They are also in some heavy duty data centers in Las Vegas..except that company uses armed guards in combination with the locks.

count2• 15 years ago

Getting into buildings and 'breeching the perimeter' is actually ridiculously easy, even in high security facilities.

Getting into a locked room with no drop ceiling and no faked credentials is pretty damn hard (unless, of course, they're using this lock, heh).

Groxx2• 15 years ago

There seems to be one consistency in all these kinds of stories. The moral, it seems, is: if you want to have security, do not buy what your government does.

potatolicious• 15 years ago

This applies to everything. When you need something, look at what people who actually need it are buying, not what people who just want to cover their ass are doing.

aero142• 15 years ago

My takeaway is that nothing is secure that you can't understand simply. Complexity is almost always insecure.

knowtheory• 15 years ago

Well, it's like jwz's old sig:

Some people, when confronted with a problem, think “I know, I'll use regular expressions.” Now they have two problems.

In the case of these locks, the problem with increased complexity, is that now you have to manage complexity, and deal with the low tech physical intrusion methods.

jpitz2• 15 years ago

Not so true. When the government REALLY wants to secure something, like, say, nukes, no matter what the technical security measures, there are always guys with guns.

Groxx2• 15 years ago

I wonder, though, if that's their reasoning, or if they'd rather have another complicated layer in place instead. It might just be mimicry - people doing illegal things have hired guns, and it seems to work reasonably well for them - without actually understanding why it works when expensive techniques (which they don't fully comprehend) fail.

arethuza• 15 years ago

"For the Minuteman ICBM force, the US Air Force's Strategic Air Command worried that in times of need the codes would not be available, so they quietly decided to set them to 00000000; checking this combination was even present on the launch checklists. This was not changed until 1977.[7]"

http://en.wikipedia.org/wiki/Permissive_Action_Link

mattbot5000• 15 years ago

The article says that certain other techniques weren't demonstrated because they were "too sensitive to show to the Defcon audience before giving Kaba a chance to fix the problems." What is worse than a whack on the top opening it?

jonknee3• 15 years ago

I'd assume ways to fake the access logs. It's bad to allow unauthorized access, but it's really bad to allow unauthorized access that appears to be authorized (a great vector for framing people).

pyre• 15 years ago

What do the logs look like when the door is opened with a mallet though? If the access isn't logged because there was no card swipe, then the last person to access the door could get blamed/framed.

dfc• 15 years ago

Ways to bypass the lock and leave no evidence that the lock was bypassed are much worse.

When an ameteur picks a lock it is very easy to inspect the pins and see if they have been manipulated by something other than the key. I imagine that the rubber mallet technique leaves evidence of malicious manipulation behind.

samstave2• 15 years ago

The sample is on a small demo cutout of a door, thus has a lot of give/spring. I would like to see the Rapping flaw demo'd on a lock on a full size, mounted door which does not have the same resonant spring which would drop the lock.

HN_Addict• 15 years ago

The demo cutout is also resting on carpet, not mounted to a steel frame. It does appear to require a fairly sturdy whack.

samstave2• 15 years ago

>"He argues that Kaba’s locks claim only to be “access control devices, not high security locks,” and says less than 500 have been sold to government customers."

Haha, he justified the vulnerabilities by stating that few have been sold.

It would be interesting to know where the ~500 locks have been deployed, or, rather, what has supposedly been protected with them.

I think these guys are taking the best possible method of working with Kaba on these vulns, but typical security PR from Kaba is as laughable as HBGary.

skhan• 15 years ago

The design was probably outsorced!

Hominem• 15 years ago

A company I worked for once installed a super secure magnetic locking system on a server room door. One day I tripped and fell, knocked into the door and it popped right open. Must have been a pretty weak magnet.

Adaptive• 15 years ago

If I was going to bootstrap a lock company, I'd start by presenting my designs at hacker conferences and offering bounties for exploits, just like an opensource project.

Manufacturers really should embrace this kind of testing.

Defcon Lockpickers Open Card-And-Code Government Locks In Seconds

Related Stories