Demo shows how hackers can unlock office doors

One of the big draws at this year’s Defcon gathering in Las Vegas appeared to be Defcon staffer Zac Franken’s demo on how to thwart security access control systems and cards used for building entrances.

Writer Kim Zetter described it in the Wired Threat Level blog as a hack that exploits a serious security hole in the Wiegand protocol, a plain-text protocol in systems used to lock down office buildings and some airports.

Franken demonstrated how an intruder can trick the system into granting entrance while locking out authorized visitors and collecting authorization data on everyone who has entered that door in the process. Franken says it’s used at Heathrow airport, among other places. Retina scanners, proximity scanners and other access systems all use the Wiegand protocol so the vulnerability isn’t device-specific, he adds.

To trick the locks, Franken used a little homemade device he calls Gecko, which allows him to perform a man-in-the-middle attack on such card readers. The hardware is also cheap at $10 apiece, he says.

This is just another reminder that cybersecurity isn’t limited to Internet-facing computer systems. As I wrote in my “Merging Physical-Cyber Threat” series a couple years ago, the line between physical and online security is quickly disappearing and corporate security plans need to account for that.

Technorati Tags: Defcon, Gecko, home+security