5 ms·

The idea is that by spending a few minutes with your card, someone can now clone it and impersonate you. Yes, they could already steal your card, but you might

by borski 2y ago

The idea is that by spending a few minutes with your card, someone can now clone it and impersonate you. Yes, they could already steal your card, but you might notice that. But if you leave it on your desk for a few minutes in your wallet, or IT “borrows” it to re-encode it, or any thousand of other ways to get a hold of your RFID card… it can be dumped, cloned, and you can be impersonated. That’s the threat vector.

ethbr1 2y ago
Super curious to know how many common access control solutions flag unbalanced entries/exits. E.g. if "John" badges in... and then 10 minutes later "John" badges in again... Will most systems complain?
- 0cf8612b2e1e 2y ago
  That would be a terrible user experience. Most places are not diligent about ensuring each employee separately badges past a barrier. Common to hold the door for Bob while he is juggling a coffee. Boom, missed badge swipe and now things are forever imbalanced.
  - closeparen 2y ago
    If you care about this at all you’d use a turnstile.
    - borski 2y ago
      Because nobody has ever jumped over one of those or triggered the motion sensor on the other side of those paddle gates or gone around the side or underneath...
      - ethbr1 2y ago
        The cases where that's common are lightly-monitored scenarios though: railway or metro. As the saying goes, the wall is only as good as how frequently the guards patrol it.
  - TaylorAlexander 2y ago
    Notably Apple expects each person to badge in. Google does not, and it is pretty easy to follow a group of people in to a building, but you cannot do that at Apple.
- borski 2y ago
  Great question; not to my knowledge. There would be many false positives, especially as people bring in guests. Sometimes guests get a temp badge; at many companies, they get a sticker to put on their shirt and get tapped in by their host, who is responsible for them. Rather than building a SOC to look at logs and flag unbalanced entries or similar (which would be very expensive), companies tend to rely on their employees’ vigilance.
  - nativeit 2y ago
    I suppose the expense, and the risk in relying on employees, is gonna be quite relative to the organization and its priorities. I wouldn’t imagine setting up a log monitor with some basic monitoring should be that expensive. As someone above mentioned, it’s kind of odd that these systems are so utterly disconnected to the broader IT protocols in so many places. I use a few different RMM solutions that could almost certainly handle the log collection, analysis, and real-time monitoring with alerts and I don’t think it’d take much time/effort to set up. The most critical point would simply be maintaining healthy access controls and avoiding the potential for new potential vulnerabilities.
    - borski 2y ago
      > I suppose the expense, and the risk in relying on employees, is gonna be quite relative to the organization and its priorities. Of course. If you work in a SCIF, you're going to have a very different set of rules and experiences than if you work at LiftMaster, if you know what I mean. > I use a few different RMM solutions that could almost certainly handle the log collection, analysis, and real-time monitoring with alerts and I don’t think it’d take much time/effort to set up. Right! But someone's gotta watch it. All day, and all the time. If it's sending alerts, who is it sending them to? The same security guard can't be responsible for both watching security monitors and watching or responding to access log issues. The expense is in the people and maintenance, not in the initial buildout, as is true for many large enterprise initiatives.
    - ethbr1 2y ago
      > As someone above mentioned, it’s kind of odd that these systems are so utterly disconnected to the broader IT protocols in so many places. My greatest realpolitik lesson at uni was being assigned parking in an "odd" building's gated parking lot. It was close to my dorm, but required carrying your permit to them, so they could enter you into their system for access. Cue realization they weren't connected to the main university parking registry. Cue my not buying a parking pass (a substantial cost, as this was an urban campus) for the next few semesters... as my prior auth continued to work on the gate. And why would parking police think to check for unregistered parkers in a gated lot? (As far as I can remember, I still had access ~2 years after graduation, then they finally cleaned up their DB)
- emag 2y ago
  From experience, more places than you'd expect only have you badging in one direction and not both.
  - padthai 2y ago
    Probably fire safety laws
    - dingnuts 2y ago
      Yes, locking people into buildings (which is what you are doing if you need a key to get out, whether it's an RFID badge or a skeleton key) has been illegal since the Triangle Shirtwaist Factory Fire
      - floren 2y ago
        As I mentioned in a sibling comment, you don't lock them in, you just set off major alarms and send an armed response if the door ever opens without badge activation. This presupposes some things about the facility and the facility operator, though.
      - joecool1029 2y ago
        I guess we're ignoring the existence of prisons.
        DaSHacka 2y ago
        Those and mental hospitals are the exception to the rule(/law)
  - floren 2y ago
    But places that actually take access control seriously do implement bidirectional badging, and just opening the door to leave without badging out will send a group of people bearing guns in your direction right away.
    - 2y ago
- Foobar8568 2y ago
  I used to work on such systems in another life, we could setup antipass back for a gate or area. I believe we could also put a temporal restriction but my memory is a bit fuzzy.
  - borski 2y ago
    I don't think the contention was that the feature or ability doesn't exist, but rather that companies choose not to do it. When you worked on those systems - did you set up anti-passbacks?
    - Foobar8568 2y ago
      Yes, it was in France and related to security, we had to ensure that the area antipass back was working properly, there were several areas where "random" entry was highly prohibited (let's say live shows). Recently I worked for a bank where they had different types of entry airlocks, it was a bit a pain, especially the multiperson ones.
- brk 2y ago
  The term behind enabling prevention for this is ‘anti pass back’. It exists but is not commonly implemented outside of high/very high security areas.
- Sylamore 2y ago
  I know many companies I worked for in CA and CO did that at least for their parking garage gates but NOT for their building control readers, even though it was the same badge.
dave_universetf 2y ago
In the case of this attack, somewhere between 40s and 30min of physical access, depending on how the card was set up. In the case of a hotel, the spicy card to clone would be the cleaning staff's, which conveniently also admits a reasonable explanation for the card going temporarily missing (e.g. abandon it one corridor over, oops must have dropped it while doing the rounds). Depending on the specifics of a deployment, I'm guessing you could also use the card secrets to mint new cards that authenticate correctly to facility readers, but contain different information? But I don't know nearly enough about how these cards get used to know how much flexibility you get there.
- Nextgrid 2y ago
  > But I don't know nearly enough about how these cards get used to know how much flexibility you get there. A lot of systems still just use the UID. Physical security/door access control is still completely disconnected from IT security, despite these systems relying on software for the last 20 years. As such, there is generally no knowledge in the buyers of such systems as to the risks and how to test for any vulnerabilities. I bet systems which rely on the UID only (something even the card manufacturer specifically warns against in their datasheet) are still being sold, and lots are definitely still out there. This is trivial to clone and requires only a single read of the card, no cracking needed because the UID isn’t designed to be private to begin with.
  - dfox 2y ago
    I know only one access system that is built on Mifare and does not use UID, and that thing uses a file on the card as a bitfield of what doors it can open.

by borski 2y ago

ethbr1 2y ago

Super curious to know how many common access control solutions flag unbalanced entries/exits. E.g. if "John" badges in... and then 10 minutes later "John" badges in again... Will most systems complain?

0cf8612b2e1e 2y ago
That would be a terrible user experience. Most places are not diligent about ensuring each employee separately badges past a barrier. Common to hold the door for Bob while he is juggling a coffee. Boom, missed badge swipe and now things are forever imbalanced.
- closeparen 2y ago
  If you care about this at all you’d use a turnstile.
  - borski 2y ago
    Because nobody has ever jumped over one of those or triggered the motion sensor on the other side of those paddle gates or gone around the side or underneath...
    - ethbr1 2y ago
      The cases where that's common are lightly-monitored scenarios though: railway or metro. As the saying goes, the wall is only as good as how frequently the guards patrol it.
- TaylorAlexander 2y ago
  Notably Apple expects each person to badge in. Google does not, and it is pretty easy to follow a group of people in to a building, but you cannot do that at Apple.
borski 2y ago
Great question; not to my knowledge. There would be many false positives, especially as people bring in guests. Sometimes guests get a temp badge; at many companies, they get a sticker to put on their shirt and get tapped in by their host, who is responsible for them. Rather than building a SOC to look at logs and flag unbalanced entries or similar (which would be very expensive), companies tend to rely on their employees’ vigilance.
- nativeit 2y ago
  I suppose the expense, and the risk in relying on employees, is gonna be quite relative to the organization and its priorities. I wouldn’t imagine setting up a log monitor with some basic monitoring should be that expensive. As someone above mentioned, it’s kind of odd that these systems are so utterly disconnected to the broader IT protocols in so many places. I use a few different RMM solutions that could almost certainly handle the log collection, analysis, and real-time monitoring with alerts and I don’t think it’d take much time/effort to set up. The most critical point would simply be maintaining healthy access controls and avoiding the potential for new potential vulnerabilities.
  - borski 2y ago
    > I suppose the expense, and the risk in relying on employees, is gonna be quite relative to the organization and its priorities. Of course. If you work in a SCIF, you're going to have a very different set of rules and experiences than if you work at LiftMaster, if you know what I mean. > I use a few different RMM solutions that could almost certainly handle the log collection, analysis, and real-time monitoring with alerts and I don’t think it’d take much time/effort to set up. Right! But someone's gotta watch it. All day, and all the time. If it's sending alerts, who is it sending them to? The same security guard can't be responsible for both watching security monitors and watching or responding to access log issues. The expense is in the people and maintenance, not in the initial buildout, as is true for many large enterprise initiatives.
  - ethbr1 2y ago
    > As someone above mentioned, it’s kind of odd that these systems are so utterly disconnected to the broader IT protocols in so many places. My greatest realpolitik lesson at uni was being assigned parking in an "odd" building's gated parking lot. It was close to my dorm, but required carrying your permit to them, so they could enter you into their system for access. Cue realization they weren't connected to the main university parking registry. Cue my not buying a parking pass (a substantial cost, as this was an urban campus) for the next few semesters... as my prior auth continued to work on the gate. And why would parking police think to check for unregistered parkers in a gated lot? (As far as I can remember, I still had access ~2 years after graduation, then they finally cleaned up their DB)
emag 2y ago
From experience, more places than you'd expect only have you badging in one direction and not both.
- padthai 2y ago
  Probably fire safety laws
  - dingnuts 2y ago
    Yes, locking people into buildings (which is what you are doing if you need a key to get out, whether it's an RFID badge or a skeleton key) has been illegal since the Triangle Shirtwaist Factory Fire
    - floren 2y ago
      As I mentioned in a sibling comment, you don't lock them in, you just set off major alarms and send an armed response if the door ever opens without badge activation. This presupposes some things about the facility and the facility operator, though.
    - joecool1029 2y ago
      I guess we're ignoring the existence of prisons.
      - DaSHacka 2y ago
        Those and mental hospitals are the exception to the rule(/law)
- floren 2y ago
  But places that actually take access control seriously do implement bidirectional badging, and just opening the door to leave without badging out will send a group of people bearing guns in your direction right away.
  - 2y ago
Foobar8568 2y ago
I used to work on such systems in another life, we could setup antipass back for a gate or area. I believe we could also put a temporal restriction but my memory is a bit fuzzy.
- borski 2y ago
  I don't think the contention was that the feature or ability doesn't exist, but rather that companies choose not to do it. When you worked on those systems - did you set up anti-passbacks?
  - Foobar8568 2y ago
    Yes, it was in France and related to security, we had to ensure that the area antipass back was working properly, there were several areas where "random" entry was highly prohibited (let's say live shows). Recently I worked for a bank where they had different types of entry airlocks, it was a bit a pain, especially the multiperson ones.
brk 2y ago
The term behind enabling prevention for this is ‘anti pass back’. It exists but is not commonly implemented outside of high/very high security areas.
Sylamore 2y ago
I know many companies I worked for in CA and CO did that at least for their parking garage gates but NOT for their building control readers, even though it was the same badge.

dave_universetf 2y ago

In the case of this attack, somewhere between 40s and 30min of physical access, depending on how the card was set up. In the case of a hotel, the spicy card to clone would be the cleaning staff's, which conveniently also admits a reasonable explanation for the card going temporarily missing (e.g. abandon it one corridor over, oops must have dropped it while doing the rounds). Depending on the specifics of a deployment, I'm guessing you could also use the card secrets to mint new cards that authenticate correctly to facility readers, but contain different information? But I don't know nearly enough about how these cards get used to know how much flexibility you get there.

Nextgrid 2y ago
> But I don't know nearly enough about how these cards get used to know how much flexibility you get there. A lot of systems still just use the UID. Physical security/door access control is still completely disconnected from IT security, despite these systems relying on software for the last 20 years. As such, there is generally no knowledge in the buyers of such systems as to the risks and how to test for any vulnerabilities. I bet systems which rely on the UID only (something even the card manufacturer specifically warns against in their datasheet) are still being sold, and lots are definitely still out there. This is trivial to clone and requires only a single read of the card, no cracking needed because the UID isn’t designed to be private to begin with.
- dfox 2y ago
  I know only one access system that is built on Mifare and does not use UID, and that thing uses a file on the card as a bitfield of what doors it can open.