Slashdot Mirror
New Controversy over Black Hat Presentation
uniquebydegrees writes "InfoWorld is reporting about a new controversy swirling around a planned presentation at Black Hat Federal in Washington D.C. this week. Security researcher Chris Paget of IOActive will demo an RFID hacking tool that can crack HID brand door access cards. HID Corp., which makes the cards, is miffed and is accusing IOActive of patent infringement over the presentation, recalling the legal wrangling over Michael Lynn's presentation of a Cisco IOS hole at Black Hat in 2005. Black Hat's Jeff Moss says they're standing by their speaker. A news conference is scheduled for tomorrow AM." Update: 02/27 20:10 GMT by Z :InfoWorldMike wrote with a link to story saying that the presentation has been pulled from the slate for Black Hat, as a result of this pressure.
Aren't HID cards passive? Last I checked, they just reported a serial number.
So what is this "hack"? Recording and replaying the serial is nothing new.
The comment "For someone to be able to surreptitiously read a card, they'd have to get within two or three inches and get into the same plane as the card," by Kathleen Carroll, a spokeswoman for HID's Government Relations. Thats not hard to do at all in the federal world. Ride the metro around 7:30 on a weekday and almost every person on it has a proximity badge around their neck or on the belt along with their ID badge. Its like showing the world your cool that you work at the agriculture department or something. But I've seen everything from State Department badges, treasury, and justice department badges on full display on super crowded metro trains.
Nearly every HID card out there is passive and will give anyone that passes the right kind of reader in front of it the numbers on the card. I'm not sure why this warrants its own talk or is viewed as a "breakthrough" of any kind.
I'm not smart enough to do it, but a very interesting project for those with the talent would be building a hardware device to spoof cards and brute force access control systems like most parking structures and numerous physical building access control systems. I'm not aware of any brute force detectors in those access control systems.
This is the tip of the proverbial iceberg for HID's (in)security. Though, most people who bought the systems had more secure options, they chose the least secure. It's hard to blame HID.
What amazes me is someone at HID has to pretend this is some kind of serious compromise. They probably sleep just fine after spending their workday spreading lies too. Sometimes I wish I could do that. I could make a heck of a lot more money lying.
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
Risibility? Wow, that looks like a pretty obscure word. I don't think I've seen it before, I had to look it up.
countermeasures: use longer ident numbers when programming the things.
Or do what the devices already do: have at least a second's worth of delay between them, log invalid access attempts, and have the reader beep each time a card's signal is detected.
Slashdotters tend to be very arrogant about this sort of stuff. Did it occur to you that most of these concerns are obvious, and are both understood by security professionals and have been addressed to some degree?
Example: even if you can clone the card, at most datacenters (for example) you need a keycard AND either a biometric scan or keycode.
Keycards aren't the ultimate security control and never were. Hell, I don't even need a keycard to get to my desk at work; I just walk by with everyone else from the shuttle bus, hop in the elevator at the same time, etc. You don't need to clone cards when you can piggyback off people who have 'em. Of course, I'm recorded on at least 2-3 security cameras entering the building, so if I were not supposed to be there, they'd be able to prove it was me.
Please help metamoderate.
It's not the same thing. With Internet-connected servers, anyone who has access to the Internet is a potential attacker, knowledge of a vulnerability (i.e. automated exploit software) can spread extremely quickly, and it's easy to hide behind surrogates (i.e. proxies, botnets, etc). With door locks, the pool of potential attackers is a lot smaller, and the personal risk for an attacker is much greater.
http://outcampaign.org/
which is why my outfit is always cautioning workers to avoid "riders," don't let anybody pretend to be your shadow flitting by as the door closes... unless you see their badge.
"hey, pard, where's your badge today?" costs nothing. adds 60,000 security persons to the force. even if half of them are just going through the motions day in and day out, it can stop a lot of riders.
if this is supposed to be a new economy, how come they still want my old fashioned money?
i dont know why these companies incorporate in the first place if they are worried about being sued. you incorporate a company for each event with $1 assets and liquidate after each show. big deal. only way to get presentations pulled then is through injunction before the event. Dean