start	end	text
0	8200	Hello everyone, welcome to Lock Bypass Village and welcome to my talk all about alarms and access control systems and how to hack them.
8280	16160	This talk is going to be fairly high level, so we'll talk about the full range of hardware that is common to experience in the wild,
16160	20000	as well as the general attack methodologies that we can use against them.
20000	26760	We won't go too much into the weeds about specific makes and manufacturers and specific attacks that can be used,
26760	32300	but that is generally quite inferable from what we'll be talking about today.
32700	40000	So, let's start by considering a simple door, purely mechanical, and this is what all of the rest of Lock Bypass Village is about,
40000	43180	various ways that we can get through this door if it is locked.
43300	50200	So, you might be able to pick the lock, use an under-the-door tool on the handle, you might be able to remove the hinges, etc.
50700	54820	What happens if we want to make this an access-controlled door?
55480	59980	At the bare minimum, we'll need to add some sort of credential reader,
59980	67860	and some sort of electronically-controlled actuator that will lock and unlock the door,
67860	74420	and some sort of controller that will determine if the credential is valid, and if so, go ahead and unlock that door.
74420	85340	At this point, it's very easy to add a little bit of sensing to sense anomalies, such as brute force entry or bypassing being done,
85340	89300	and that can be done quite cheaply by adding a magnetic read switch.
89300	97240	So, this bottom unit here is a simple magnet, and in the top, there is a wire that's going to be balanced within a magnetic field,
97240	106460	and if the field becomes too strong or too weak, it will break or make an electrical contact, letting the controller know that the magnet has moved.
106460	110080	The purpose of this is to detect when the door has opened.
111000	116640	So, one problem with doing that is if someone's trying to exit the door.
116640	123080	If they're trying to enter, they're going to swipe the credential, the controller will unlock the door, it detects an open, that's okay.
123080	130580	If they're trying to exit, it's now going to trip this type of sensor here, which is a request-to-exit sensor, is the general term,
130580	136260	and very frequently what we see with these is passive infrared technology being used.
136260	144360	So, it will detect the black-body emission spectrum of the human body on the secure side of the door, meaning someone's trying to exit,
144360	152000	and if that's the case, if it detects that, and then it detects that the door opens, that is okay, that's a valid exit sequence of events.
152000	161440	If, however, it detects that the door has opened, there was no valid credential swiped, and no one was standing on the secure side of the door waiting to exit,
161440	167660	that is an alarm condition, and that indicates that the door might have been forced open, might have been bypassed open, etc.
167660	171260	But it will send that alarm to the access controller.
171400	175420	We're missing one more component that we need if that happens,
175420	182240	which is that the access controller needs some way to communicate to the outside world that there's an alarm that needs to be investigated.
182260	186640	So there's going to be some line out from the access controller to do that.
186640	189400	There's usually going to be a line in as well.
189400	194520	So this way we can, say, set what the public building hours are so that the door will be open.
194520	200320	This way we can set who is allowed to access it, we can revoke credentials as necessary, etc.
201000	206700	So let's look at some of the technologies that are available for these various parts of the system.
206700	214460	For the credential reader itself, we have RFID-based, which is the most modern and generally the most secure.
214860	223360	We have MagStripe, so cards that are encoded with a number in magnetic polarities along the card.
223360	227200	We can use a biometric reader, such as a fingerprint scanner here.
227300	238520	A key code entry system, so instead of being something that the user has or something that the user is, it's something the user knows, so the code.
238720	251080	And we can also have a camera, where some human on the other end of that line is going to look in the camera, see who it is, and make the go or no-go decision of is this person authorized to enter this facility.
251640	261080	In terms of technologies available for the actuator, so this one that is the most common by far is a MagStrike, or magnetic door strike.
261120	272980	This plate here is going to be loose and allowed to swing open when the door is supposed to be unlocked, and it will seize up and not move and prevent the door from opening when the door is supposed to be locked.
272980	280020	Over here we have a MagLock, so this larger unit will be mounted to the frame, and this smaller one onto the door.
280020	289080	These will magnetically couple and hold very, very tightly, with generally 2,000 pounds or more of holding force, when the door is supposed to be locked.
289080	294100	And then the system will let them separate when the door is supposed to be unlocked.
294100	305000	We might have an electronically controlled set of handle hardware, so just like how the key can be used to lock and unlock the door, we just have an electronic actuator inside that does the same.
305000	315120	In higher security applications, we might see a turnstile-based system here, so a very good system to prevent piggybacking in after someone. It only lets one person in at a time.
315120	319520	And we might also see various vehicle control systems as well.
320320	325760	In terms of the sensor, ultimately the goal of this is to detect is the door open or not.
325760	333880	Most commonly we see magnetic-based sensors, so these two are mounted on the frame of the door, on the inside or outside of the frame.
334000	342100	They should be mounted on the secure side. If they're mounted on the insecure side, that then opens up a whole host of attacks that we can use.
342140	348960	We also have magnetic sensors that are mounted within the frame, so drilling a hole in the frame and at the top of the door.
348960	352140	To mount both the sensor and the magnet that goes with it.
352300	359200	We can use optical-based sensors, so detecting light or dark where the door is supposed to be.
359200	365720	Some hinges are capable of sensing what their position is and reporting that back.
365720	371420	And as well we have some mechanical-based sensors, so this arm getting tripped when the door is in the correct position.
372200	378380	In terms of the request-to-exit sensor, that is often done with a passive infrared sensor like these two here.
378380	384560	Sometimes it's a button that the user pushes to cause that door to unlock and allow egress.
384600	391960	It might also be the exit hardware itself, so pushing a push bar there that will mechanically unlatch,
391960	397980	will also tell the controller that someone is trying to exit and this is not an alarm situation.
397980	402900	And finally, in very high security environments, we might see another credential reader.
402900	410920	So you actually have to swipe your credential to say that yes, I am an authorized user and I am exiting this facility normally.
410920	416080	In an emergency situation, there of course do need to be overrides, but that could cause an alarm.
416740	419960	So this is what these tend to look like in the field.
419960	428900	You'll see your request-to-exit sensor mounted here, and then at the bottom we have our in-frame type magnetic contact sensor.
428900	432900	On the door side, here is the magnet that goes along with it.
434580	441600	So this is the general setup that we need, at a bare minimum, for an access control and alarm system.
441620	449360	We can add a few peripherals, such as there might be a mechanical key switch that can be used to turn the door on and off,
449360	453920	so to lock the door or unlock it, say for public building access hours.
453920	465580	This might be used by a security guard. It allows someone with much less training and much less complexity of integration to the network controller to actually lock and unlock the system.
465920	472140	We might also see accessibility features, such as buttons that will trigger an automatic door opener.
472140	484960	Generally, the button on the outside, or the unsecure side of the door, will only open this door if a credential has been swiped validly, or if the door is supposed to be unlocked, such as during building public open hours.
484960	496680	On the inside, that's generally not required, and the mere act of pressing this button will cause the mag strike to unlock, and the door to then automatically open.
496680	509240	And finally, we also see it tied into the fire system in a lot of cases, because if we're using a mag lock, there is no mechanical override to cause that to unlock.
509240	516160	If it's a mag lock, the access controller must unlock it for us. If it doesn't do that, that door will stay locked.
516160	520660	That can be a fire hazard if someone needs to exit in an emergency situation.
520660	528980	So the way that that is done is, by code, there must be a fire alarm pull near any mag locked door that is a fire exit.
529200	536400	And if the fire alarm is triggered, that mag lock is then going to open and allow egress from the building.
536560	540780	Because of that, there needs to be a tie-in from the fire alarm system.
541680	549080	All of these aspects require power. So sometimes there's separate power required for credential readers.
549080	559720	There always is for the access controller, and the fire controller, and large power draw components, such as a door opener here.
559720	572120	We can disable the alarm, or breach the door entirely, causing it to open, by attacking any of the hardware, power, or comms lines in this relatively complicated system.
572120	574680	So let's talk about how we can do that.
574760	585800	Starting with the power. We can cut power to the access controller, and when that happens, by code, things like mag locks need to fail open.
585800	591580	We can likewise cut power to the fire controller. That, of course, has life safety implications.
591740	605220	But it will also cause the mag lock to open, because if the fire controller goes offline, then there's no way to effectively cause egress if that becomes necessary in an emergency.
605360	611000	Incidentally, it is very, very difficult to kill power to this. It has all sorts of backups available.
611000	622300	And then we can also kill power directly to the mag lock, and to other peripherals of the system that might be able to cause us entry, or disable the alarm.
623000	629360	We can attack the door contact sensor, so if it doesn't sense that that door opens, it will not trigger an alarm.
629740	632240	And we'll talk about a number of ways to do that.
632820	640480	We can attack the request to exit sensor, so if it thinks someone's trying to exit, then even if it does detect the door opens, it will not trigger an alarm.
640480	645700	We can attack the mag strike, so to cause the door to open up.
646300	653440	We can attack the credential reader, to cause it to think that a valid credential has been swiped, or to clone a credential, etc.
653900	658560	We can attack the inside, the secure side, accessibility button.
658560	669940	So if that gets pressed, or the controller thinks it's been pressed, it's going to unlock the door, open the door, and disable any alarm that might come along with that otherwise.
669940	674960	We can attack this key switch, make the controller think that the door is supposed to be open.
675340	682480	We can attack the fire system, make it think that we are in an alarmed state, and so the mag locks need to open.
682640	693840	We can attack the line out, so most simply by blocking any attempted communication of an alarm from getting out to an external control center.
693840	701140	We can attack the line in, so by telling the controller that my credential is a valid one and you should let it in.
701140	709140	Or by, say, telling the controller that the building public hours are 9-5, as well as 2-2.01am on Friday nights.
709140	713360	And then we can come back at that specific time, and it will just let us in.
713360	726240	We can attack the controller itself, so it is, of course, a fairly complicated piece of ICS equipment, and is vulnerable to all sorts of cyber attacks that are the subject of all the other DEFCON villages.
727540	735840	We can also attack all of the comms lines, everywhere throughout this, and that's something that we'll talk about fairly extensively in the rest of this talk.
735840	741700	And there's one more attack factor that we can take in this overall system.
741700	745040	Take a stare at it and see if you can figure out what it is.
745080	749060	The answer is... the door itself.
749060	760280	If we can cause some way to mechanically get ourselves through this door, without interacting with all of this other equipment, then we've effectively disabled the alarm.
760420	764700	So, one very brute force way is to saw a hole in the middle of the door.
764700	766600	There are other options as well.
766600	770340	So, many doors have these vent louvres in them.
771040	776080	Frequently, we see these with the screws facing the outside, which is a terrible security decision.
776080	779460	You can just unscrew that, and then slide on through.
779760	783280	Doors with windows in them, as well, can be attacked.
783340	786440	And so you can go through the window to achieve a similar effect.
786440	789500	And this is something that is seen on occasion.
789700	792220	So here's an example of a residential burglary.
792220	796340	These burglars have seen the contact sensors on the doors.
796340	799460	They know that they can't actually cause these doors to open.
799720	802080	So what they're going to do instead is break the window.
802080	808500	And rather than reaching through and depressing the handle, they're just going to climb through these wide open windows.
808540	810500	And so we see them doing that now.
810560	817280	Incidentally, those very wide open windows make this particular house more vulnerable to burglaries.
817280	824640	Because they can see all of the valuables that are inside, where they are, what the alarm system is like, etc.
824640	827740	It's a much less risky endeavor for them.
828060	830200	And so the burglars are just reaming that out.
830200	833020	And we'll see them crawl through in a minute.
837910	842990	And just like that, they are in, bypassing the alarm system.
844950	847930	So let's talk about the communications lines.
847930	855170	Every aspect on the system has communications lines going into it or coming out saying, should I be enabled or not?
855170	856850	And we can attack those.
856850	865010	We'll focus on the magnetic contact sensor because it's the one that's sort of most readily attackable.
865010	867970	But this applies to all the others as well.
868410	874090	So in the case of the contact sensor, we have a normally closed situation.
874090	877270	That's normally what we see for security alarms.
877270	881670	And that is that in the secure state, the door is closed.
881670	883650	That means that the circuit is closed as well.
883650	885530	So it's a short circuit.
885530	887370	We have power flowing.
887470	890970	And if that gets interrupted, we know it's an alarm state.
890970	893930	So if the switch opens up, that becomes an alarm.
894090	897770	And what we can do is jumper the line from one to the other.
897770	901730	And that way, if that switch opens up, it will not send an alarm.
902970	906670	In the normally open state, we have the line is broken.
906670	909890	So the switch is open and there's no power flowing.
909890	911630	And that's the normal situation.
911730	914130	When we open the door, the switch closes.
914150	917310	And then the controller sees low impedance and sends an alarm.
917310	919250	We can just then cut that line.
919250	923630	And at that point, it simulates the switch being open and the door being closed.
923790	927050	No matter what we do at the switch end.
927490	929670	What can we do to defend against these?
929670	935230	Most commonly, what we see is having end-of-line resistors.
935230	941970	So the effect, as seen by the controller, is the door switches between two different resistances.
941970	945530	The way we accomplish this in practice, rather than having a three-lead switch,
945530	951730	usually is having a series resistor that runs on one of the lines in series with it,
951730	956330	and a shunt resistor that crosses across those two lines.
956330	960970	So we always have some power flowing through the shunt resistor, even when that switch is closed.
961090	967490	And when the switch is open, it must flow through that series resistor as well.
967710	971650	There are ways to defeat that, and we'll talk about those in a minute.
971650	977690	But the absolute best that we can do is an encrypted digital line that has denial-of-service detection heartbeats.
977690	981210	And we'll talk a little bit more about digital lines shortly.
981210	987190	What we'll look at first is a game that we're actually releasing this year for DEFCON Safe Mode with Lock Bypass Village
987190	994830	that will let you practice rewiring alarms to disable the actual alarm on the end of them.
995590	1000950	So this is mirroring a physical demonstration that we were planning to do at DEFCON in real life,
1000950	1005510	but of course that can't happen. So this is the best that we can do as a surrogate.
1005510	1009890	What we have here is a simulated door with its contact sensor
1009890	1015270	and an alarm controller here. We'll talk about what a zone is in a minute,
1015270	1019830	but it means for the sake of this demonstration, a single door.
1019830	1027230	We have a supply current of 25 milliamps and zero volts that are coming across that system.
1027230	1033410	That tells us that there is a short circuit here and an equivalent resistance of zero.
1033410	1037090	So a short circuit, and that is an alarm status of OK.
1037090	1043130	If we open this door, we now have an open circuit. So the circuit has been broken.
1043350	1048010	The line voltage becomes indeterminate because there's no current going through,
1048010	1053230	and this is an alarm state. So it's simply looking for short circuit or open circuit.
1053290	1060270	In order to defeat this system, what we can do is cut the line and strip it,
1061870	1068110	and then take a jumper cable and hardwire those two wires together.
1068270	1073950	And so now we have an OK state. We see a short circuit on the controller end,
1073950	1079250	and the door is totally disconnected. So we can open and close that door all we want,
1079250	1082750	and the controller will have no idea.
1083270	1086830	You'll notice that when I initially cut that line to strip those wires,
1086830	1090910	that did trigger the alarm. We wouldn't generally want to do that in the field.
1090910	1095010	The way to get around that is using this tap piece of hardware,
1095010	1099370	so we would actually strip just the outer sheath and then tap the inner wires
1099370	1102890	and bridge those taps together.
1103230	1107470	So that's something that you can practice for yourselves using this game.
1108350	1112330	In the next situation of a normally open switch,
1112330	1115730	so we have an open circuit when the door is closed.
1115730	1120410	When we open the door, that's then going to complete this circuit,
1120410	1124910	and we now see zero ohms, so a short circuit situation.
1124910	1129390	The way that we defeat this is very simple. Cut the line.
1129490	1134450	And now we have an open circuit, no matter what happens, because the line is cut.
1135090	1139770	The most secure situation is where we have these end-of-line resistors.
1139770	1145190	So we have a series resistor here, and a shunt resistor connecting these two lines there.
1145190	1151970	And that happens right at the end of the line, right before the sensor exists.
1152210	1157930	And so what happens now is, if I have an equivalent resistance of 45 ohms,
1157930	1161570	when the door is closed, it jumps up to 500 when the door is open,
1161570	1165130	so we have our OK state and our alarm state.
1165190	1169430	If I were to cut the line, it's going to detect an open circuit,
1169430	1171670	which is different than those other two states,
1171670	1174950	and that indicates tampering has happened on the line.
1174950	1180390	Likewise, if I go through and actually bridge that connection,
1181170	1186070	it's going to detect a short circuit, which it also normally would never see,
1186070	1187870	because of these end-of-line resistors.
1187870	1192530	So that also indicates tampering along that line, and that would send a different alarm,
1192530	1196310	that hopefully would be responded to with greater severity.
1196310	1203290	The way that we can defeat that is by adding our own resistances along the line,
1203290	1206750	and so there's a number of ways that you can play around with doing that in these games,
1206750	1210710	such as adding potentiometers that you can then control,
1210710	1213990	as well as a whole slew of resistors.
1213990	1220290	And you can play around with that to get a situation where you can both disable an alarm once,
1220290	1224170	as well as go through the whole situation of disabling an alarm,
1224170	1228670	where it never actually sent an alarm while you were tampering with those wires.
1228670	1234250	So that's something that you can play with as well in the Lock Bypass Village this year.
1237820	1242980	So let's talk a little bit about digital communications lines,
1242980	1246960	and the various attacks and defenses that exist on those.
1247260	1251660	So a digital communication line is going to be sending a 0 or a 1.
1251660	1259080	So here's an example of 0101001101 being sent in the ideal case.
1259120	1263580	Communications lines have some parasitic capacitance,
1263580	1268100	so because those lines are two plates close together effectively, just very long,
1268100	1273600	it acts like a capacitor, and that causes some capacitive effects here,
1273600	1277420	so we see the line getting charged up and then charged back down.
1277420	1284080	It also has some parasitic inductance, so that line is going to induce a magnetic field around it
1284080	1291160	as the electric current in it changes, and so as a result we see this higher-order Fourier effect
1291160	1298360	that happens on the line. And so the combination of those two is this pattern that we see down here,
1298580	1301620	a slightly distorted digital signal.
1303380	1307620	There's also noise. So there's noise in the environment, there's magnetic and electric noise,
1307620	1310320	and that's going to inductively couple with the line.
1310560	1316540	And there's noise in the sender and the receiver electronics as well, all of that contributes.
1316700	1322220	And so we're going to take this slightly distorted signal from our nonlinear line,
1322220	1329540	and we're going to add onto it this noise, and we get a further distorted electrical signal.
1329540	1334980	This, as you can see, would still be relatively easy for the receiver to decode and determine
1334980	1337900	what bits were being sent at what time.
1338100	1342240	Noise, though, is a somewhat powerful phenomenon.
1342260	1346940	As the amplitude of the noise relative to the amplitude of the signal increases,
1346940	1352660	the noise starts to overtake the signal until the signal is no longer decipherable.
1352660	1355900	And that's a situation where we have a breakdown of communications.
1355900	1359420	That's something that is often the case just naturally,
1359420	1365620	but it can also be used by an attacker to cause a denial of service.
1365980	1373280	And mathematically, what we see is the 0 bit is going to form some normal distribution,
1373280	1378600	normal because the noise usually is Gaussian, and the 1 as well is going to do that.
1378600	1385160	As the noise increases, these distributions widen until determining which one is which
1385160	1389080	becomes very difficult because this overlap becomes huge.
1389780	1395240	So how can the red team attack a digital communication line knowing bad information?
1395640	1400000	So, to attack confidentiality on the line, they can tap that wire.
1400000	1406860	That can be with a physical tap, like the one that we looked at when we were attacking the analog alarm wire lines.
1406860	1412600	It can also be with an inductive-based tap, so just listening for RF frequency
1412600	1416020	generated by what that line is communicating on.
1416020	1420000	To attack integrity, they can introduce packets on the line,
1420000	1423800	so tapping into it and then sending data down.
1423800	1428180	And to attack availability, this is the easiest. They can introduce noise.
1428820	1433180	The defenses against this is you want to physically shield the line,
1433180	1441120	and that's going to help both stop tapping as well as sending power down the line,
1441120	1443820	sending rogue signals down the line.
1444460	1452120	You can encrypt the digital signal, so that will then prevent both confidentiality and integrity attacks.
1452360	1457100	And to protect availability, you want to send heartbeats,
1457100	1462580	so that the line can at least detect if it's being denied service,
1462580	1466300	and that will then let you respond appropriately.
1466300	1471100	So a denial-of-service attack in a very secure environment is the same as an alarm.
1471100	1476560	It needs to be responded to as if it were an alarm, because it could be an attacker doing this on purpose.
1478080	1486260	In the wireless world, what we have is a slightly varied situation.
1486400	1490880	So we can't put a DC current across empty space.
1490920	1493600	That's because of the laws of physics.
1493600	1496480	And the laws of the land further constrain what we can do.
1496480	1501660	We must act within a certain frequency band, so we don't interfere with all the other frequency bands.
1502380	1506560	And so there's a number of ways that we can use what's called a carrier frequency,
1506560	1512480	to send a digital signal along through the air in the wireless world.
1512860	1517180	There's frequency modulation, or frequency shift keying, that you're familiar with from radios,
1517180	1521180	where we change the frequency depending on if it's a 0 or a 1.
1521280	1525680	We can change the amplitude in an AM digital situation,
1525680	1530240	or we can phase shift based on if it's a 0 or a 1.
1530460	1532840	Those are the three main ones that we see.
1532840	1535660	The red team attacks there is for confidentiality.
1535660	1541060	We just sniff, because these are being broadcast for anyone to intercept,
1541060	1547840	and we can then read what's being sent without any wiretapping required, and read that data.
1547860	1554600	For integrity, we can transmit new, and we can transmit to overwrite the data that's being sent out.
1554600	1558220	And for availability, of course, we can jam that signal.
1558220	1561900	So again, for a wireless alarm, if jamming happens,
1561900	1568580	that's something that we want to treat as an alarm situation in a high security environment.
1568580	1574160	One interesting aside about FM versus AM is,
1574160	1581380	FM is easier to jam and easier to hijack the signal by sending your own data,
1581380	1586720	because whichever signal in a frequency modulated situation is stronger,
1586720	1591740	by even a small amount, the receiver is going to pick up that signal and only that signal.
1591740	1594220	With AM, it's going to pick up a mixture of the two.
1594220	1596920	So you can actually try this with your radio.
1596920	1603480	If you put it halfway between channels on the FM band, it's going to flip from one to the other.
1603480	1609580	If you put it halfway between channels on the AM band, you're going to hear both channels blended in with one another.
1609580	1617740	But in a security situation, with sending signals across the empty space,
1617740	1624360	that means that FM is easier to jam and to take over with integrity-based attacks.
1624360	1626780	The Blue Team Defense, of course, is encrypt as well.
1626780	1630380	That is the only way to protect confidentiality.
1630380	1633120	For integrity, encrypting works for that as well.
1633120	1638580	We also have the added option of locating where this transmitter is
1638580	1645260	that's trying to take over our communication and trilaterate their position and take them out by various means.
1645260	1650940	We can, of course, also increase the signal strength to avoid their ability to drown us out.
1651060	1652900	And for availability, it's very similar.
1652900	1656120	We can locate and take out the jammer, we can increase our power,
1656120	1662580	and we can also use heartbeats to detect if availability has been compromised.
1663480	1670260	So that's sort of a very high-level overview of how we can attack digital communications lines.
1670260	1676660	We'll take a step back to the physical systems that we see on these doors and what can we do about them.
1676660	1681780	So, for these magnetic read switches,
1681780	1686820	one very sort of brute-force-ish attack is we can literally unscrew the magnet
1686820	1691260	and hold it in place relative to where it was beside the doorframe
1691260	1694520	and then open the door with the magnet staying where it is.
1694520	1699600	Of course, that's only possible with sensors that are mounted on the outside of the frame,
1699600	1701360	on the unsecure side of the door,
1701360	1710780	but it's a very low-tech attack that, if it's possible, is virtually undetectable by the controller.
1710780	1715580	We can use a surrogate magnet to maintain the magnetic field while the door opens
1715580	1718080	and the real magnet moves out of place.
1718940	1725300	And so we actually have another game that we're releasing with Bypass Village that you can practice this on.
1725300	1731900	So here is our door and we can swing it open and closed and we can see this magnet along the top
1731900	1738980	and we can see the magnetic field that's measured by our sensor up here.
1738980	1746260	And then we can move a little stick with a magnet on it in and out and around that sensor
1746260	1755200	and we can try to use that to make the controller think that the door is closed when it's actually open.
1755280	1758680	And so if we get it to the right place here, it now thinks that that's the case
1758680	1765980	and as we close the door, we can now open and close it without actually triggering that alarm.
1765980	1771500	So that's something that you can play around with yourselves in this game that we are releasing.
1773240	1781960	In terms of the defenses available to the blue team, using an in-frame magnetic sensor helps a lot
1782900	1788820	and putting it on the secure side also helps to avoid these attacks being mechanically possible
1788820	1792960	and we can make them more difficult by using what's called a balanced magnetic switch.
1792960	1798060	So it doesn't just look for the presence of a magnetic field above a certain intensity,
1798060	1803360	it looks for the presence of a magnetic field above a certain intensity but below another one.
1803360	1807460	So if the field is too strong, it's also going to set off that alarm
1807460	1812400	and it makes it a whole lot harder to actually use this surrogate magnet attack
1812400	1818880	and that's something that you can also practice how to defeat those systems with the game that we are releasing.
1819520	1825220	In terms of the request-to-exit systems, if it's a passive infrared,
1825220	1831080	you can send hot or opaque gas or aerosol or something through that door near to the sensor
1831080	1834340	and cause it to think that someone's on the other side.
1834340	1840960	So there's a fairly well-known attack with taking a can of compressed air, turning it upside down and squirting it
1840960	1847560	and then that condensation that's created is enough to trigger many low-security PIR sensors.
1847560	1854020	If it's a push-to-exit button or a handle, an egress handle, you can manipulate it from the other side.
1854020	1858540	So for instance, if this is a request-to-exit sensor and we did an under-the-door tool attack,
1858540	1863420	that would give us two for one, it would also defeat this request-to-exit sensor.
1865280	1871400	And from the blue team's perspective, using a hybrid PIR and radar sensor is going to help immensely
1872020	1875540	with avoiding people faking a human signature on the other side
1875540	1880120	and using a token reader for egress is incredibly powerful.
1880120	1885960	It effectively means that we cannot use request-to-exit sensor-based attacks.
1885960	1891900	We may as well just attack the credential reader on the unsecure side itself.
1891900	1898100	And so that does increase significantly the difficulty of attacking this particular system.
1898100	1908080	So using a token reader on the exit side as well is sort of the electronic equivalent of a euro-style double-barreled deadbolt.
1908080	1913600	Very good design for security purposes, of course at the cost of user convenience.
1913840	1920880	In terms of PIR sensors, we can set them to have high security settings
1920880	1930280	so that it will only trigger if a person is in the very specific right area and not this giant large range here.
1930280	1936300	Long range is really meant for convenience and accessibility, so it'll open the door as someone's walking towards it.
1936300	1939080	It's not meant for security at all.
1940080	1948140	In terms of attacking these actuators, we can separate the electromagnet slightly.
1948140	1953420	So if you ever catch the door open that's equipped with a mag lock,
1953420	1960700	you can take a piece of gaffer tape or something fairly thin and put that onto the surface of it.
1960700	1969320	And that's going to separate those components just enough that it will reduce the holding force from 2,000 pounds down to, say, 50.
1969320	1973380	At which point the door feels secure, but it can be forced open.
1973380	1976900	And that's something that you can then come back and do.
1977160	1986920	And attacks like that, attacking the magnetic-based retaining system, are possible with some designs of mag strikes.
1988300	1991080	We can attack the comms line and the power.
1991080	1995700	So in the case of mag locks, they fail unlocked if there's power that's gone.
1995700	2002440	And we can, of course, attack the comms line to any of these to make the hardware think that the controller is telling it to open up.
2002440	2005380	And we can use physical bypasses as well.
2005380	2007740	So mag strikes are often poorly sized.
2007740	2012560	The dead latch is going to fall into that hole, and we can Lloyd that latch.
2012560	2017100	If you don't know what that means, check out our Bypass 101 talk.
2017480	2025840	And the blue team, what they can do to help against these attacks is, of course, shield their communications lines and use hardware that fails in a locked state.
2026220	2031440	That might not be allowed due to fire code, but wherever possible, you should try to do that.
2031900	2038000	So here's an example of where we can read that actually there is a mag lock on the other side of the door.
2038000	2041840	That's what these two bolts are telling us, as well as this conduit coming through here.
2041840	2050580	What's interesting, though, is this conduit is, of course, the power that's going to that mag lock that is telling it to stay locked.
2050640	2054640	In this case, turning power on and off is the communications line.
2054640	2063240	And so we can just unscrew any of these junction boxes here and break that wire, cut that connection somehow.
2063240	2068320	And this mag lock is going to then fail in an unlocked state, and we can open this door.
2068320	2070040	Fairly simple attack there.
2070040	2077400	In the case of this type of hardware, where we have a key switch, we can, of course, pick the lock or do other attacks like that.
2077400	2083120	We can unscrew the enclosure casing and then jumper out those lines and make it think that the key has been turned.
2083200	2089140	And, of course, we can perform an attack like that anywhere along the comms line where it's accessible to us.
2089220	2095440	What the blue team can do to defend against this is put the key switch on the secure side of the door.
2095440	2098240	I really don't know why this isn't seen more often.
2099200	2103500	Possibly it's so that the guards can do it when they come on to shift to open up for the first time,
2103500	2110200	but they really should be given a key or some other better credential to get in if that's the case.
2110340	2117400	And that will avoid this threat entirely, because if you're on the secure side, then you're already in.
2117920	2122100	You can use a lock of equal or higher security as the facility's front door.
2122100	2131300	So too often we see crappy weaver locks on these key switches where the front door might be a high security medico,
2131300	2134140	and installing a tamper switch within this box.
2134140	2140380	So if the controller sees that this box has been opened, it will not honor that if the key switch is turned,
2140380	2144020	no matter what happens, as a bit of a defense with that.
2144020	2149440	Of course, that can be bypassed as well. There's loads of ways to bypass tamper switches.
2150180	2155680	Let's talk a little bit about the communications protocols that are used by the credential readers.
2155680	2161240	So we have the VIGINT protocol is sort of the original, most well-known one,
2161240	2172340	and it is based off of magnetically charged wires in the card that are going to be placed in either a 0 or a 1 position.
2172340	2179880	And as we swipe that card, it's going to then have sensors that detect that and give us the data from there.
2179880	2185800	We can have magnetically encoded information on a mag stripe, which is similar.
2185800	2189600	And then we can have RFID technologies as well.
2190900	2200980	Down the line, though, for backwards compatibility, almost every reader and almost every controller still supports the VIGINT protocol.
2200980	2204980	And that's just to make sure that we can mix and match any reader with any controller,
2204980	2209700	and there's something they can fall back on that will work.
2210220	2218780	And so that VIGINT protocol looks like, if this is the data that we're sending, so the 0101, 001101 that we saw before,
2218780	2223840	we have our data 0 line and our data 1 line, and they're normally a 1,
2223840	2231480	and we pull either the 0 or the 1 down to a 0 when we want to send a 0 or a 1, respectively.
2231560	2237160	So here we send a 0, then a 1, 0, 1, 0, 0, etc.
2238740	2249420	Because we have that VIGINT protocol in use for backwards compatibility, if we can access those lines,
2249420	2260840	we can then read the VIGINT-encoded data that's being sent, as well as replay or send our own reconstructed packet in that same format.
2261000	2267840	And that's what the BLE key does, which was released at Black Hat 15 by two very smart individuals.
2267860	2271400	They designed a piece of hardware that would clip onto the alarm wires.
2271400	2276440	So we see here the green and the white VIGINT wires, as well as our black ground.
2276440	2283740	It clips onto that, and it listens to every credential that gets swiped, and it can communicate with your phone via Bluetooth.
2283740	2292540	And that phone can then get the raw credential data, as well as replay any valid credentials, and cause that door to open on demand.
2292540	2296640	So that's one particular attack against that communication line.
2296640	2310000	A good remediation for this is OSDP. It's one of the... well, it's really the only encrypted communication protocol that we see in somewhat widespread use.
2310000	2316240	It's still not very widespread, and there are some proprietary systems that will use other encrypted forms as well.
2316240	2323880	And hook up your damn tamper wires. So when you remove that credential reader from the wall to get access to the wires behind it,
2323880	2330640	almost all of them, the good ones at least, are equipped with a tamper switch that will send the controller a signal saying,
2330640	2338800	hey, this reader has been removed from the wall. If that happens, the controller should respond appropriately, set up the appropriate alarms, etc.
2338860	2342120	All too often, we see that not even hooked up.
2343120	2346660	So here's a quick example we can take a look at.
2346660	2356800	We have our reader here, and we can assume that there's some sort of actuator on the other side, very likely a mag lock.
2356800	2367080	As well as we have an accessibility door here with a visible magnetic strike system, and that will be opened by some other situation.
2367260	2371000	So there's a couple items that we can notice in the wild.
2371000	2377440	One thing to note about all of this hardware we've been talking about is it is blazingly expensive.
2377600	2386600	Here is some of the standard retail costs for what a new construction building might pay for these pieces of hardware.
2386600	2396260	So things like not hooking up your tamper wires, putting poor quality locks on the unsecure side that can disable the system,
2396260	2400900	not shielding your communication lines and letting those be accessible from the public, etc.
2401000	2406900	All of those are really simple fixes and very cheap in comparison to the cost of this hardware,
2406900	2415280	and something that really should be looked at if you have a facility that cares about security enough to pay this kind of money for these systems.
2415280	2421900	But anytime you see a door that's equipped with this equipment, these are the kinds of costs that are involved in actually setting that up.
2422720	2431880	So we've talked a lot about access controllers determining or giving the go or no-go decision on a door based on a credential swipe
2431880	2435980	and sending an alarm if there is an unauthorized access.
2436860	2441640	We can also talk about alarm systems, and they are more state-based.
2442200	2448980	So on a very high level we have three states, an armed state, disarmed, and an alarmed state.
2448980	2452940	And we can enter the arming and disarming sequence to move between these top two.
2452940	2459420	If a sensor is tripped when it's armed, it's going to alarm, and then the reset sequence will move us back to disarmed.
2459460	2465960	In order to attack these systems, our starting state is armed, we're assuming that, since it needs to be attacked.
2465960	2474520	And the two routes that we can take is we can cause the disarming sequence to be entered or cause the controller to think it has been,
2474520	2482340	and move it to a disarmed state, or we can prevent these sensors from being tripped and prevent it from going into an alarmed state.
2482920	2492240	So, to give one example of the first type of attack, this is a typical timeline that happens in older, less well-designed systems.
2492240	2496700	We have our controller here. The sensor gets tripped as time moves along.
2496700	2502120	In a normal situation, a normal entry, the disarmed code is entered, the panel enters a disarmed state,
2502120	2508860	and then the timeout happens, but because the code has been entered in time, nothing happens at that point. The police are never contacted.
2509500	2516640	If, however, a valid code is not entered in time, then when the timeout happens, the panel will then contact the police,
2516640	2520580	and they will be dispatched to see what's happening with this alarm.
2521220	2528140	This allows for what's called a crash and smash attack, which is that, if at any point, between the sensor being tripped and the timeout,
2528140	2532780	the panel is rendered inoperable, the communications lines are rendered inoperable, etc.,
2532780	2542700	it will then prevent it from sending that call for help out when the timeout happens, because the panel no longer operates.
2542900	2549260	This, of course, assumes that your keypad panel is the same as the controller, which in many systems it's not,
2549260	2555980	but many good burglars know which ones are, and which ones are vulnerable to this.
2555980	2558960	And so that's something that you do see on occasion.
2559340	2564400	A better way to handle this is to have an intermediary server that's off-site.
2564400	2567860	As soon as that sensor is tripped, the server is notified.
2567900	2571880	When the disarm code is entered, that server is notified as well.
2572020	2578280	If the disarm code is not entered, then when timeout occurs, the server then will dispatch the police
2578280	2583120	without requiring any more communication from the local facility.
2583120	2589980	That way, if there's a crash and smash attack, and that panel is rendered inoperable, an alarm will still go out.
2590480	2598380	So that's the disarming sequence, or at least sort of a pseudo-situation to move us to a disarmed state.
2598380	2602200	We can also prevent the sensor from being tripped.
2602200	2606580	And there's a load of ways to do that, depending on what type of sensor exists.
2606680	2608720	So we have a number of different types.
2608720	2615240	We have cameras that are usually human-operated, but increasingly we have computer vision systems
2615240	2617760	that are going to look for motion where there shouldn't be.
2617760	2622930	We have these door-open sensors, as well as glass-break sensors are common,
2623280	2626000	so to prevent that through-the-window attack.
2626380	2630220	We have passive infrared sensors that we looked at for requests to exit.
2630300	2634040	Those ones we did want to trip, to make the door think someone was exiting.
2634040	2640200	These ones, as a red team, we don't want to trip, because that will tell the alarm system someone's here and there shouldn't be.
2640360	2645140	So they detect the presence of a human body infrared spectrum.
2645200	2651080	And then we have various underground seismic-based systems to detect someone walking on ground,
2651080	2654820	as well as fence-climb sensors that we see on the outside.
2654880	2660920	Both of these, by the way, are incredibly prone to false positives.
2660920	2665720	So they are only usually seen in very high-security applications.
2666020	2672760	In terms of how the controller combines all of these, we have what's known as alarm zones.
2672760	2681400	So zones are the individual circuits that one or more of these sensors is put on.
2681400	2688860	So in this case, we have a normally-closed zone that has two magnetic-read sensors on it,
2689020	2692440	a second normally-closed zone that has only one on it,
2692440	2695380	and for normally-closed, we need to wire them in series,
2695380	2699260	and then a normally-open zone that has two wired in parallel.
2699620	2707780	For security systems, you usually have them wired in series, if not only a single one on a zone, which is generally better.
2707780	2715120	And then for fire systems, you're going to wire in parallel and have normally-open systems there.
2715120	2722440	So that is how all of these devices get handled by the controller.
2722440	2727060	And what that means is if multiple different sensors are on the same zone,
2727060	2731340	the controller cannot tell which one was tripped, just that one of them was.
2731340	2734560	And so the idea is they generally tend to be aligned in space,
2734560	2740860	so the controller can identify where physically in the facility this alarm is coming from.
2741570	2745900	So there's a number of specific defeats for each of these.
2745960	2755320	One that we'll talk about for passive infrared sensors is to block the infrared signature from your body actually reaching the sensor.
2755320	2766660	So you can use these space blankets that will then reflect the ambient thermal signature back onto the sensor and cause it to not see you.
2766660	2770000	You have to be very careful with those, because if you touch it with your hand,
2770000	2776220	then your hand is now going to... it won't radiate, but it will conduct through because you're touching it,
2776220	2778940	and that's going to defeat your efforts there.
2779160	2784940	We've actually found anecdotally that for many of the commercial PIR sensors out there,
2784940	2790920	yoga mats work incredibly well, a lot better than these do, to block your IR signature.
2790920	2797500	You can move very slowly, because these things have to get a sense of what the environment is,
2797500	2801840	and so if you move slowly, it might think that you are just part of the ambient environment.
2802000	2807800	You can move out of its focus range, so many of these in facilities that might have animals walking around,
2807800	2815900	which is usually a residential setting, will be set to only focus on above two or three feet on the ground.
2815900	2825300	That's the default setting in many cases, and in some cases that is just a physical limitation of the device that's being shipped out.
2825580	2834220	If that happens, you can then effectively get down to that level, away from the focus range, and avoid these entirely.
2834220	2841940	And as well, passive infrared sensors are much more sensitive to motion across them.
2841940	2845640	Moving towards and away from them, they're less sensitive towards.
2845640	2850560	So if you can make your motion in that direction, it will help you avoid being detected.
2851080	2856620	So here is another example that we see that is no longer available.
2859920	2868660	So taking a look at one particular hypothetical layout of passive infrared sensors, this is a bad layout.
2868660	2871560	Take a stare at it and see if you can figure out why.
2871900	2882300	The reasons are, number one, way at the edge of the range is a large part of the room that is accessible by one of the doors.
2882360	2894880	And so we can now get around and access large parts of this room through that, as well as this particular door here gives us access to the back of two of the sensors.
2894880	2904920	And so by doing that, we can then place an IR shield in front of it from behind, and effectively blind them to almost all of the room.
2904920	2917640	And finally, the way that these are laid out, it allows motion in a towards and away from direction to help avoid it detecting on its more sensitive perpendicular axes.
2918700	2926120	The last thing I'll actually mention about this particular layout is someone who is entering this room and seeing that this layout is the case,
2926120	2930780	will wonder, well, why are they clustered along this particular wall?
2930780	2936680	One potential reason might be this shaft here, that X indicates a shaft in the wall.
2936680	2940640	That's likely a pipe riser shaft through which comms lines run as well.
2940640	2944700	So if someone can infer from that that the comms lines for these are running through this shaft,
2944700	2951280	they can enter that instead where there are no sensors and cut them off along the comms lines instead.
2951340	2957860	A better layout surrounds the room and makes sure that all doors are firmly in the coverage range.
2957860	2966280	And there's no way to get in any of these doors without moving entirely perpendicular to these sensors in their sensitivity direction.
2966640	2971660	As well, there's no way to get behind any of the sensors, let alone all of them.
2971660	2979080	And there's no way to get anywhere appreciable within this room without setting off at least one of our motion sensors.
2979200	2980940	So this is a much better layout.
2981840	2988180	The last thing that we can look at, and this is getting a little bit more into social engineering, so we'll only touch on it briefly,
2988180	2992200	is attacking the response that happens when an alarm gets sent out.
2992440	2997860	So when the responding forces are distracted, they might be sleeping, they may be on other calls, etc.
2997860	3003040	It might just be a human factors problem in the control room, which we see very, very frequently.
3003700	3006520	They will not respond effectively to an alarm.
3006520	3014100	And so that can be induced as well, or you can choose to attack in the times that you know they're most likely to be in a state like that.
3014340	3021100	Response fatigue is the term that we use to describe when an alarm has too many false alarms
3021100	3029420	and security decides they're going to stop responding to it. It's probably just a raccoon climbing the fence or bumping up against the fence or whatever.
3029480	3031660	Kind of like the boy who cried wolf.
3031660	3039160	So by setting off one alarm many, many times, making security think it's a false alarm, you can cause them to stop responding to that.
3039480	3041960	They might have higher priority calls that come along.
3042020	3046360	So you can set off more critical alarms than where you actually want to go.
3046360	3054880	Security is going to go to that higher priority location and you now have a lack of response for where you are setting off whatever alarms you want to.
3054960	3057280	They're often just plain old slow.
3057280	3063900	So if there's not on-site security, if it's either an off-site security service or police that are called,
3063900	3073000	they can take upwards of 30 minutes, maybe more, to get to the site and actually do a sweep and see if anything is amiss there.
3073020	3075060	That is way too long.
3075060	3080000	The vast majority of criminals are in and out well within that period of time.
3080080	3086220	So just being fast enough that you outrun the response is usually sufficient as well.
3086220	3092880	In terms of dealing with the response in an ethical hacking situation, so most commonly we see this with physical pen testing,
3092880	3095780	there are a number of considerations to keep in mind.
3095960	3102620	We don't want to diminish the ability of the facility to respond to a real threat that could do real damage.
3102620	3112420	So that could happen both if we disable alarms, but also if we cause security to, say, have response fatigue on a particular alarm.
3112420	3116120	Or if we cause them to be one place where there's a real incident and another.
3116120	3117860	So that's something to consider.
3117940	3130080	And we also don't want them to, especially if it's the police, to have responding to us as ethical hackers at the expense of other potential calls.
3130080	3135340	So fairly famously now within this community is the Iowa courthouse pen test case,
3135340	3143860	where two individuals were hired to penetration test a courthouse and they ended up getting arrested and charged as a result of it.
3143860	3147740	A lot of people made a lot of mistakes in that particular case.
3147740	3167520	But one mistake that, in my humble opinion, the red team made is it was irresponsible of them to have those police officers called to the site without prior notice to the force at the possible expense of other higher priority calls.
3167520	3177000	Someone could possibly have died as a result of that if there had been a higher priority life or death call that was averted as a result of responding to this.
3177000	3185960	So that is a number of considerations for attacking the response and for dealing with any of these alarm situations.
3186060	3196980	We want to make sure that we do it responsibly and in a way that does no harm or does no unreasonable harm as determined by the client and external stakeholders.
3197680	3201480	So I encourage you to try it out.
3201480	3208580	We've released a couple of little games that let you practice these aspects that we've talked about throughout this talk.
3208580	3212700	It has been a lot, so feel free to ask me questions.
3212700	3221680	Feel free to give suggestions for something that you'd like to see at a future Bypass Village that you can practice hands-on, hopefully in person at DEF CON 29.
3221680	3227460	But for now, you can practice rewiring alarms and using magnets to disable grid switches.
3227580	3231180	And with that, I would be happy to take any questions that you might have.