3 ms·

Does an electronic lock of the kind where the keypad is on the insecure side of the door generally contain or not contain the mechanism to open that door? How i

by noja 4y ago

Does an electronic lock of the kind where the keypad is on the insecure side of the door generally contain or not contain the mechanism to open that door? How is that mechanism normally secured? Edit: I mean here it looks like that ripping off the front-panel and powering the solenoid will get you into the safe.

SparkyMcUnicorn 4y ago
LockPickingLawyer actually covers this topic, from an access control system context. https://www.youtube.com/watch?v=0SEHUqkbIjU https://www.youtube.com/watch?v=0SEHUqkbIjU TL;DW Decision making should be on the secure side of the door, and communication should be encrypted.
- perlgeek 4y ago
  Encryption alone doesn't prevent replay attacks, you need something more advanced; for example controller generates a nonce, reader hashes secret + nonce, controller compares to expected value.
  - michaelt 4y ago
    Eh, the article's about a safe with a keypad. An attacker who can intercept and replay the comms between the keypad and the controller, can probably also intercept and replay the signals from the physical buttons into the keypad's microchip. Or perhaps more likely, point a hidden camera at the keypad.
  - msdrigg 4y ago
    I was thinking the same thing. Encryption still wouldn't prevent the replay attack, just the ability to determine the card's number and flash it onto a new card.
convolvatron 4y ago
the article mentions two boards, an inside controller that activates the solenoid and a keypad - which communicate using rs232. which seems right, they just neglected to require you to enter the factory code before setting a new combination.
dosman33 4y ago
A lot of name brand electronic locks can be bypassed with a tool like the Spike Master that lets you manually drive the solenoid, so even from brands that should know better there are issues. Sadly this is an issue of market demand rather than poor engineering. Good security costs more and this is priced into the safe/lock ecosystem - if you want real security buy a commercial safe with a Group 1 lock. Sadly though this leaves consumers at risk who don't understand this. They buy a safe from a brand they recognize and they think they are in good shape. Meanwhile I get shunned on forums by actual safe techs by encouraging muggles to do their own research and buy higher quality commercial safes 2nd hand for less money.

by noja 4y ago

SparkyMcUnicorn 4y ago

LockPickingLawyer actually covers this topic, from an access control system context. https://www.youtube.com/watch?v=0SEHUqkbIjU https://www.youtube.com/watch?v=0SEHUqkbIjU TL;DW Decision making should be on the secure side of the door, and communication should be encrypted.

perlgeek 4y ago
Encryption alone doesn't prevent replay attacks, you need something more advanced; for example controller generates a nonce, reader hashes secret + nonce, controller compares to expected value.
- michaelt 4y ago
  Eh, the article's about a safe with a keypad. An attacker who can intercept and replay the comms between the keypad and the controller, can probably also intercept and replay the signals from the physical buttons into the keypad's microchip. Or perhaps more likely, point a hidden camera at the keypad.
- msdrigg 4y ago
  I was thinking the same thing. Encryption still wouldn't prevent the replay attack, just the ability to determine the card's number and flash it onto a new card.

convolvatron 4y ago

the article mentions two boards, an inside controller that activates the solenoid and a keypad - which communicate using rs232. which seems right, they just neglected to require you to enter the factory code before setting a new combination.

dosman33 4y ago

A lot of name brand electronic locks can be bypassed with a tool like the Spike Master that lets you manually drive the solenoid, so even from brands that should know better there are issues. Sadly this is an issue of market demand rather than poor engineering. Good security costs more and this is priced into the safe/lock ecosystem - if you want real security buy a commercial safe with a Group 1 lock. Sadly though this leaves consumers at risk who don't understand this. They buy a safe from a brand they recognize and they think they are in good shape. Meanwhile I get shunned on forums by actual safe techs by encouraging muggles to do their own research and buy higher quality commercial safes 2nd hand for less money.