7 ms·

Let Me Get That Door for You: Remote Root Vulnerability in HID Door Controllers

95 points by choult 11y ago

TazeTSchnitzel 11y ago
I can't be the only one who thought HID was Human Interface Device, the category of USB device, at first.
- koolba 11y ago
  I had one of these on a key fob for an apartment building. I thought the exact same thing every time I saw the HID letters embossed on it.
  - rconti 11y ago
    I always think that too, although I can't be the only one who has used HID prox tags in virtually every company I've ever worked for, virtually every datacenter I've ever visited, etc...
- TeMPOraL 11y ago
  It's the same as with the RSA company - another confusing name.
  - rconti 11y ago
    Quit bringing up the Renaissance Society of America!
- wlesieutre 11y ago
  I was thinking High Intensity Discharge, but I do more lighting than progrmaming
jnky 11y ago
I think it's rather ironic that this was published by Trend Micro, a company that has had at least two critical vulnerabilities in their own "security" solution: https://bugs.chromium.org/p/project-zero/issues/detail?id=693 https://bugs.chromium.org/p/project-zero/issues/detail?id=69... https://bugs.chromium.org/p/project-zero/issues/detail?id=773 https://bugs.chromium.org/p/project-zero/issues/detail?id=77... I realize that the two teams are probably unrelated, but maybe it would be worth verifying that their "security" software is indeed, you know, secure.
- dfc 11y ago
  Google has had security vulns too. Do you find it "ironic"[^1] that Tavis would disclose vulns in other companies software? [^1]: You really should look up the definition of this word.
  - jnky 11y ago
    > Google has had security vulns too. Do you find it "ironic"[^1] that Tavis would disclose vulns in other companies software? No, the thing in this instance is that a) Trend Micro is a dedicated "security" company and b) the vulnerabilities in its software were especially negligent. > You really should look up the definition of this word. One definition I found was "happening in the opposite way to what is expected, and typically causing wry amusement because of this". Considering that, I'm quite happy with my usage of the word. That said, English is not my first language and I often see people nitpicking about this particular word. My feeling is that people understood me just fine despite of it.
    - dfc 11y ago
      You expected an antivirus company to write perfect code and not have any vulns? That is hilarious. Look up Fireye vs. ERNW. You will love that one.
      - deleted 11y ago
        [deleted]
      - pilif 11y ago
        > You expected an antivirus company to write perfect code and not have any vulns? no. But I expect them to have their shit together well enough to not be the laughing stock of the internet because of how amateurish their flaws are (come on - unauthenticated remote accessible JS shell with full local machine access? This didn't even happen to microsoft in the 90ies) AV programs are by definition in an utterly exposed spot on your machine: They run in a privileged account and they intercept all reads and writes to the disk. They also unpack every archive, parse every file, check every single byte written. An AV program is opening every mail attachment, practically inspecting and sometimes even partially running every trojan on your machine, even those you blatantly ignore as being spam. For an application in such an exposed point on your machine, I expect them to at least follow current security-best-practices, tough honestly, I would wish they would go far beyond that due to the immense risk they subject themselves to. And then we have trend micro, an AV program, which opens a remote accessible RPC endpoint which can be used by everyone. This is the exact opposite of what I'm expecting them to be doing.
panic 11y ago
The concept of programming by string substitution really needs to die, and operating systems need to stop enabling it with functions like system(). Any time you have to think about "sanitizing" strings, terrible mistakes are going to happen.
- TeMPOraL 11y ago
  That's what we've got from switching from Lisp machines to x86 and C. It's funny how the 'stitching strings together' problem was solved 50 years ago and the modern web still didn't get the memo.
  - LunaSea 11y ago
    I don't think anyone got the memo in any industry. Also if Lisp would be more popular in the industry I'm sure that we would find similar vulnerabilities as well.
    - TeMPOraL 11y ago
      No doubt about vulnerabilities. But I'm not talking about vulnerabilities, but about a particular kind of stupid behaviour that creates an immense class of vulnerabilities. Stitching, parsing and reparsing strings is not the right way to handle structured data. We knew that for almost half the century, we had tools for doing it properly since about the same time, and yet most popular frameworks, tools and even Unix itself are stuck deep in that mistake.
      - nolok 11y ago
        On that note, using powershell for a while really made me wish Unix would move to something beyond mere pipes. I love the Unix command line, but sharing structured data seamlessly is simply better
        TeMPOraL 11y ago
        Yeah, PowerShell is great. It's a bit cumbersome to use for me[0], but passing objects instead of plaintext is a step (back) in the right direction. [0] - Maybe I'm missing some sane config sets? I'm not a very experienced PS user.
lazyjones 11y ago
This is an astonishing level of incompetence for "A worldwide trusted provider of Secure Identity Solutions". Isn't there any competition in that market, or pressure to be scrutinized for certification/suitability for government contracts etc.?
- TeMPOraL 11y ago
  > Isn't there any competition in that market Whether there is or there isn't, it doesn't matter. People buying these systems are usually not competent enough to evaluate security issues, and companies do their best to hide information about such incidents while spending tons of money on marketing. Competition doesn't solve those issues when its the salesmen who control information flow to customer (or in other words, it pretty much never solves those issues).
  - lazyjones 11y ago
    > Competition doesn't solve those issues when its the salesmen who control information flow to customer Wouldn't a competent competitor aim to point out flaws in such products and claim they're doing it better? Unless security is just a buzzword and not a real feature in this market, that is...
    - HeyLaughingBoy 11y ago
      Every salesperson points out flaws in competitive products and claims they're doing it better. I'm willing to bet that HID's sales people can find lots of stuff their competitors do that they are doing better. We just happen to be focused on security here. not a real feature in this market I wouldn't be surprised if this was the case. It's very likely that since security in an access control product is key (heh!), the customer simply assumes everything on the market is secure.
    - superuser2 11y ago
      >not a real feature in this market Entirely possible. I'd guess that most of these systems replace mechanical locks wide open to anyone with the right tools and a few hours of lockpicking training. In retrofits it's common for the mechanical lock to still be there as an override, so bumping/picking may still be the weakest link. Most are probably also deployed next to windows which are vulnerable to rocks, and on doors which wouldn't stand up to a crowbar or boot. Access control is mostly about deterring casual users and bounding/monitoring/revoking the access of legitimate employees. Systems designed to stand up to teams of security experts are something else entirely.
userbinator 11y ago
Discoveryd then builds up a path to /mnt/apps/bin/blink and calls system() to run the blink program with that number as an argument. I have a feeling this is similar to the left-pad debacle... a whole separate binary just to blink an LED? "Blink n times" should be nothing more than a loop with two delays and presumably a write to a GPIO device in the middle. Unwarranted complexity strikes again. Does anyone recognise the architecture? "JSR" and "MOVE.D" brings up some PDP-11(?) docs, which doesn't seem right.
- TeMPOraL 11y ago
  It feels ok for me. It's kind of the Unix way, with all the /bin/true, /bin/false, /dev/zero, etc. That /mnt/apps/bin/blink may just be exactly that "loop with two delays and presumably a write to a GPIO device in the middle", written in C or even hand-written in ASM.
  - dsr_ 11y ago
    The problem isn't 'blink'. The problem is calling it via system() and handing unsanitized user input to system().
    - JdeBP 11y ago
      I wonder why it calls daemon() immediately before calling system().
    - userbinator 11y ago
      That's too narrow in scope. The fact that they decided to make such a trivial function an externally invoked binary is also a large contributing factor, and should not be overlooked. There would otherwise be no need to use system(), "sanitize" user input, etc.
- avian 11y ago
  > Does anyone recognise the architecture? At the first glance, assembly looks a bit like ETRAX CRIS. https://en.wikipedia.org/wiki/ETRAX_CRIS https://en.wikipedia.org/wiki/ETRAX_CRIS
feintruled 11y ago
And I thought that the exploit they used in Mr. Robot to remotely unlock all doors in a building at once was far fetched! This is basically exactly it.
deleted 11y ago
[deleted]
tallanvor 11y ago
It's a really stupid bug, and a somewhat dangerous vulnerability, but hopefully places like airports have IT teams in place that are at least competent enough to put these devices on a separate VLAN and locking it down. On average, my guess is that small businesses are more vulnerable to this, but that's mitigated by them being less likely to be targeted by a hack this sophisticated. That being said, incompetence can be found everywhere, and obviously it's important for the vulnerability to be fixed.
- drzaiusapelord 11y ago
  >IT teams in place that are at least competent enough to put these devices on a separate VLAN and locking it down. The problem here is that the way this stuff has grown through the past 50+ years is that IT does "computers" and facilities does "physical security." These realms of responsibility have been seperate, but now are really IT. Now that everything is tcp/ip, well, everything is "computers" now but many organizations struggle with this. IT departments aren't given these responsibilities and old school bureaucrats and rent-seekers don't want to give this to IT. So a lot of these largely blue collar types just call in some vendor who they can't judge nor can they question in regards to technical topics (yeah networking, PoE devices, IoT, remote connectivity, etc is a bit different than running analog doorbell cable that clicks doors open). I had this fight recently at work. It was a political shitstorm about IT replacing the old school phone system with a proper VOIP system and to take over physical security keycards. This fight only ended when the VP in charge of those things retired. These people don't want to modernize and if they do, they'll do their best not to do it with IT. They'll just call some shit vendor who will take them for a ride and security will absolutely not be a concern. Of course that'll be easy to hack. No one is auditing this, setting up vlans, applying patches, auditing products before buying them, etc. We're in this ugly transition stage where everything is going to be a 'smart' device, but the people who are used to dumb devices are still employed. They can't be retrained and they don't want to be. Until these people retire, expect more stupidly simple physical security exploits. This is going to be at anything government or union run. The protectionism, corruption, incompetence, etc will stymy any attempt at best practices, so no surprise to see airports in this article.
  - 11y ago
bobedybobbob 11y ago
Nearly all door controllers are broken. I hope someone comes out with a secure alternative soon but fear that the cost of installation that comes with these devices will prevent many people from upgrading.
- Avernar 11y ago
  There were secure alternatives available several years ago. Unfortunately the industry is moving from code running on bare metal to having the main panels and now the door controllers run a full embedded OS. The complexity of how everthing interacts now has increased exponentialy so your attack surface is now much larger. All for easier initial development.
droopybuns 11y ago
Trend Micro has such a slimey leadership team that it is hard for me to see anything they do in a positive light. They desperately need to rebrand.
bpchaps 11y ago
At the past two office I've worked at, sliding a belt through the glass door to activate the motion sensor works pretty well for when you leave your badge at your desk. ;)
JdeBP 11y ago
And if you found that interesting, you'll possibly find this slideshow, a 2012 presentation by Brad Antoniewicz of Foundstone, interesting as well. * https://github.com/brad-anton/VertX/blob/master/Attacking%20Proximity%20Card%20Access%20Systems-v0.1.pdf https://github.com/brad-anton/VertX/blob/master/Attacking%20... "Linux on a cris". Passwordless regular user, no shadow passwords, root with a crackable password, and a telnet server enabled.
jrcii 11y ago
Headlines like this just reinforce my feeling that the "Internet of Things" concept is bad/premature. Maybe I'm pessimistic, but it strikes me as "Let's take this network technology that we've yet to make reliably secure or private and put it in everything!"
superuser2 11y ago
Sad as this is, realize that the cheap mechanical locks it replaced weren't much better. The attacks aren't necessarily harder, just different and more familiar to us. Bumping and picking can be pretty trivial to people well-versed in locksmithing just like obvious vulnerabilities are trivial to those of us well-versed in software.

95 points by choult 11y ago

TazeTSchnitzel 11y ago

I can't be the only one who thought HID was Human Interface Device, the category of USB device, at first.

koolba 11y ago
I had one of these on a key fob for an apartment building. I thought the exact same thing every time I saw the HID letters embossed on it.
- rconti 11y ago
  I always think that too, although I can't be the only one who has used HID prox tags in virtually every company I've ever worked for, virtually every datacenter I've ever visited, etc...
TeMPOraL 11y ago
It's the same as with the RSA company - another confusing name.
- rconti 11y ago
  Quit bringing up the Renaissance Society of America!
wlesieutre 11y ago
I was thinking High Intensity Discharge, but I do more lighting than progrmaming

jnky 11y ago

I think it's rather ironic that this was published by Trend Micro, a company that has had at least two critical vulnerabilities in their own "security" solution: https://bugs.chromium.org/p/project-zero/issues/detail?id=693 https://bugs.chromium.org/p/project-zero/issues/detail?id=69... https://bugs.chromium.org/p/project-zero/issues/detail?id=773 https://bugs.chromium.org/p/project-zero/issues/detail?id=77... I realize that the two teams are probably unrelated, but maybe it would be worth verifying that their "security" software is indeed, you know, secure.

dfc 11y ago
Google has had security vulns too. Do you find it "ironic"[^1] that Tavis would disclose vulns in other companies software? [^1]: You really should look up the definition of this word.
- jnky 11y ago
  > Google has had security vulns too. Do you find it "ironic"[^1] that Tavis would disclose vulns in other companies software? No, the thing in this instance is that a) Trend Micro is a dedicated "security" company and b) the vulnerabilities in its software were especially negligent. > You really should look up the definition of this word. One definition I found was "happening in the opposite way to what is expected, and typically causing wry amusement because of this". Considering that, I'm quite happy with my usage of the word. That said, English is not my first language and I often see people nitpicking about this particular word. My feeling is that people understood me just fine despite of it.
  - dfc 11y ago
    You expected an antivirus company to write perfect code and not have any vulns? That is hilarious. Look up Fireye vs. ERNW. You will love that one.
    - deleted 11y ago
      [deleted]
    - pilif 11y ago
      > You expected an antivirus company to write perfect code and not have any vulns? no. But I expect them to have their shit together well enough to not be the laughing stock of the internet because of how amateurish their flaws are (come on - unauthenticated remote accessible JS shell with full local machine access? This didn't even happen to microsoft in the 90ies) AV programs are by definition in an utterly exposed spot on your machine: They run in a privileged account and they intercept all reads and writes to the disk. They also unpack every archive, parse every file, check every single byte written. An AV program is opening every mail attachment, practically inspecting and sometimes even partially running every trojan on your machine, even those you blatantly ignore as being spam. For an application in such an exposed point on your machine, I expect them to at least follow current security-best-practices, tough honestly, I would wish they would go far beyond that due to the immense risk they subject themselves to. And then we have trend micro, an AV program, which opens a remote accessible RPC endpoint which can be used by everyone. This is the exact opposite of what I'm expecting them to be doing.

panic 11y ago

The concept of programming by string substitution really needs to die, and operating systems need to stop enabling it with functions like system(). Any time you have to think about "sanitizing" strings, terrible mistakes are going to happen.

TeMPOraL 11y ago
That's what we've got from switching from Lisp machines to x86 and C. It's funny how the 'stitching strings together' problem was solved 50 years ago and the modern web still didn't get the memo.
- LunaSea 11y ago
  I don't think anyone got the memo in any industry. Also if Lisp would be more popular in the industry I'm sure that we would find similar vulnerabilities as well.
  - TeMPOraL 11y ago
    No doubt about vulnerabilities. But I'm not talking about vulnerabilities, but about a particular kind of stupid behaviour that creates an immense class of vulnerabilities. Stitching, parsing and reparsing strings is not the right way to handle structured data. We knew that for almost half the century, we had tools for doing it properly since about the same time, and yet most popular frameworks, tools and even Unix itself are stuck deep in that mistake.
    - nolok 11y ago
      On that note, using powershell for a while really made me wish Unix would move to something beyond mere pipes. I love the Unix command line, but sharing structured data seamlessly is simply better
      - TeMPOraL 11y ago
        Yeah, PowerShell is great. It's a bit cumbersome to use for me[0], but passing objects instead of plaintext is a step (back) in the right direction. [0] - Maybe I'm missing some sane config sets? I'm not a very experienced PS user.

lazyjones 11y ago

This is an astonishing level of incompetence for "A worldwide trusted provider of Secure Identity Solutions". Isn't there any competition in that market, or pressure to be scrutinized for certification/suitability for government contracts etc.?

TeMPOraL 11y ago
> Isn't there any competition in that market Whether there is or there isn't, it doesn't matter. People buying these systems are usually not competent enough to evaluate security issues, and companies do their best to hide information about such incidents while spending tons of money on marketing. Competition doesn't solve those issues when its the salesmen who control information flow to customer (or in other words, it pretty much never solves those issues).
- lazyjones 11y ago
  > Competition doesn't solve those issues when its the salesmen who control information flow to customer Wouldn't a competent competitor aim to point out flaws in such products and claim they're doing it better? Unless security is just a buzzword and not a real feature in this market, that is...
  - HeyLaughingBoy 11y ago
    Every salesperson points out flaws in competitive products and claims they're doing it better. I'm willing to bet that HID's sales people can find lots of stuff their competitors do that they are doing better. We just happen to be focused on security here. not a real feature in this market I wouldn't be surprised if this was the case. It's very likely that since security in an access control product is key (heh!), the customer simply assumes everything on the market is secure.
  - superuser2 11y ago
    >not a real feature in this market Entirely possible. I'd guess that most of these systems replace mechanical locks wide open to anyone with the right tools and a few hours of lockpicking training. In retrofits it's common for the mechanical lock to still be there as an override, so bumping/picking may still be the weakest link. Most are probably also deployed next to windows which are vulnerable to rocks, and on doors which wouldn't stand up to a crowbar or boot. Access control is mostly about deterring casual users and bounding/monitoring/revoking the access of legitimate employees. Systems designed to stand up to teams of security experts are something else entirely.

userbinator 11y ago

Discoveryd then builds up a path to /mnt/apps/bin/blink and calls system() to run the blink program with that number as an argument. I have a feeling this is similar to the left-pad debacle... a whole separate binary just to blink an LED? "Blink n times" should be nothing more than a loop with two delays and presumably a write to a GPIO device in the middle. Unwarranted complexity strikes again. Does anyone recognise the architecture? "JSR" and "MOVE.D" brings up some PDP-11(?) docs, which doesn't seem right.

TeMPOraL 11y ago
It feels ok for me. It's kind of the Unix way, with all the /bin/true, /bin/false, /dev/zero, etc. That /mnt/apps/bin/blink may just be exactly that "loop with two delays and presumably a write to a GPIO device in the middle", written in C or even hand-written in ASM.
- dsr_ 11y ago
  The problem isn't 'blink'. The problem is calling it via system() and handing unsanitized user input to system().
  - JdeBP 11y ago
    I wonder why it calls daemon() immediately before calling system().
  - userbinator 11y ago
    That's too narrow in scope. The fact that they decided to make such a trivial function an externally invoked binary is also a large contributing factor, and should not be overlooked. There would otherwise be no need to use system(), "sanitize" user input, etc.
avian 11y ago
> Does anyone recognise the architecture? At the first glance, assembly looks a bit like ETRAX CRIS. https://en.wikipedia.org/wiki/ETRAX_CRIS https://en.wikipedia.org/wiki/ETRAX_CRIS

feintruled 11y ago

And I thought that the exploit they used in Mr. Robot to remotely unlock all doors in a building at once was far fetched! This is basically exactly it.

deleted 11y ago

[deleted]

tallanvor 11y ago

It's a really stupid bug, and a somewhat dangerous vulnerability, but hopefully places like airports have IT teams in place that are at least competent enough to put these devices on a separate VLAN and locking it down. On average, my guess is that small businesses are more vulnerable to this, but that's mitigated by them being less likely to be targeted by a hack this sophisticated. That being said, incompetence can be found everywhere, and obviously it's important for the vulnerability to be fixed.

drzaiusapelord 11y ago
>IT teams in place that are at least competent enough to put these devices on a separate VLAN and locking it down. The problem here is that the way this stuff has grown through the past 50+ years is that IT does "computers" and facilities does "physical security." These realms of responsibility have been seperate, but now are really IT. Now that everything is tcp/ip, well, everything is "computers" now but many organizations struggle with this. IT departments aren't given these responsibilities and old school bureaucrats and rent-seekers don't want to give this to IT. So a lot of these largely blue collar types just call in some vendor who they can't judge nor can they question in regards to technical topics (yeah networking, PoE devices, IoT, remote connectivity, etc is a bit different than running analog doorbell cable that clicks doors open). I had this fight recently at work. It was a political shitstorm about IT replacing the old school phone system with a proper VOIP system and to take over physical security keycards. This fight only ended when the VP in charge of those things retired. These people don't want to modernize and if they do, they'll do their best not to do it with IT. They'll just call some shit vendor who will take them for a ride and security will absolutely not be a concern. Of course that'll be easy to hack. No one is auditing this, setting up vlans, applying patches, auditing products before buying them, etc. We're in this ugly transition stage where everything is going to be a 'smart' device, but the people who are used to dumb devices are still employed. They can't be retrained and they don't want to be. Until these people retire, expect more stupidly simple physical security exploits. This is going to be at anything government or union run. The protectionism, corruption, incompetence, etc will stymy any attempt at best practices, so no surprise to see airports in this article.
- 11y ago

bobedybobbob 11y ago

Nearly all door controllers are broken. I hope someone comes out with a secure alternative soon but fear that the cost of installation that comes with these devices will prevent many people from upgrading.

Avernar 11y ago
There were secure alternatives available several years ago. Unfortunately the industry is moving from code running on bare metal to having the main panels and now the door controllers run a full embedded OS. The complexity of how everthing interacts now has increased exponentialy so your attack surface is now much larger. All for easier initial development.

droopybuns 11y ago

Trend Micro has such a slimey leadership team that it is hard for me to see anything they do in a positive light. They desperately need to rebrand.

bpchaps 11y ago

At the past two office I've worked at, sliding a belt through the glass door to activate the motion sensor works pretty well for when you leave your badge at your desk. ;)

JdeBP 11y ago

And if you found that interesting, you'll possibly find this slideshow, a 2012 presentation by Brad Antoniewicz of Foundstone, interesting as well. * https://github.com/brad-anton/VertX/blob/master/Attacking%20Proximity%20Card%20Access%20Systems-v0.1.pdf https://github.com/brad-anton/VertX/blob/master/Attacking%20... "Linux on a cris". Passwordless regular user, no shadow passwords, root with a crackable password, and a telnet server enabled.

jrcii 11y ago

Headlines like this just reinforce my feeling that the "Internet of Things" concept is bad/premature. Maybe I'm pessimistic, but it strikes me as "Let's take this network technology that we've yet to make reliably secure or private and put it in everything!"

superuser2 11y ago

Sad as this is, realize that the cheap mechanical locks it replaced weren't much better. The attacks aren't necessarily harder, just different and more familiar to us. Bumping and picking can be pretty trivial to people well-versed in locksmithing just like obvious vulnerabilities are trivial to those of us well-versed in software.