In this lecture, Walter Belgers will look at some security flaws in locks to see how they came about. Then, he shows us how similar mistakes are made in software development and deployment. In both cases, we have to deal with design flaws, implementation errors, zero day attacks, brute force attacks, user errors and more. Real life examples will be given and demonstrated. There are some interesting differences in how security is looked at in the hardware and the software world. Both groups can certainly learn each other.

1. @ITCAMPRO #ITCAMP18Community Conference for IT Professionals
Lockpicking and IT Security
Walter Belgers, M.Sc, CISSP, CISA, CEX
www.toool.nl

2. @ITCAMPRO #ITCAMP18Community Conference for IT Professionals
Many thanks to our sponsors & partners!
GOLD
SILVER
PARTNERS
PLATINUM
POWERED BY

3. @ITCAMPRO #ITCAMP18Community Conference for IT Professionals

4. @ITCAMPRO #ITCAMP18Community Conference for IT Professionals
• 20 years of lockpicking experience
• President of TOOOL,The Open Organisation of Lockpickers
• Fastest Dutch lockpicker ;-)

5. @ITCAMPRO #ITCAMP18Community Conference for IT Professionals

6. @ITCAMPRO #ITCAMP18Community Conference for IT Professionals
SEA

7. @ITCAMPRO #ITCAMP18Community Conference for IT Professionals

8. @ITCAMPRO #ITCAMP18Community Conference for IT Professionals

9. @ITCAMPRO #ITCAMP18Community Conference for IT Professionals
Design - software
• Security often a small component in software and
hence, often an afterthought
• Functionality is more important than security

10. @ITCAMPRO #ITCAMP18Community Conference for IT Professionals

11. @ITCAMPRO #ITCAMP18Community Conference for IT Professionals
Design - locks
• Locks are always there to provide security, so no
afterthought
• Lock manufacturers are good in specifying requirements
• Risks are pretty well understood (but not by all!)
• Locks are tested (e.g. for certification)

12. @ITCAMPRO #ITCAMP18Community Conference for IT Professionals
Design - locks
• Secure against what?
• Key control (who can copy)
• Protection against destructive attacks
(drilling, pulling, breaking)
• Protection against non-destructive attacks (lockpicking,
pickgun, bumping, impressioning)
• Tight cost and space constraints

13. @ITCAMPRO #ITCAMP18Community Conference for IT Professionals
Design: KABA E-plex 5800
forbes.com

14. @ITCAMPRO #ITCAMP18Community Conference for IT Professionals

15. @ITCAMPRO #ITCAMP18Community Conference for IT Professionals

16. @ITCAMPRO #ITCAMP18Community Conference for IT Professionals
http://null-byte.wonderhowto.com/how-to/turn-innocent-dry-erase-marker-into-hotel-hacking-machine-0139534/

17. @ITCAMPRO #ITCAMP18Community Conference for IT Professionals
https://www.youtube.com/watch?v=6txFFS1TwSE

18. @ITCAMPRO #ITCAMP18Community Conference for IT Professionals
Implementation error

19. @ITCAMPRO #ITCAMP18Community Conference for IT Professionalsanimation: Deviant Ollam

20. @ITCAMPRO #ITCAMP18Community Conference for IT Professionals
Implementation error

21. @ITCAMPRO #ITCAMP18Community Conference for IT Professionals
•Awareness is
always a problem
•Password guessing
•Social Engineering
•Showing your keys..

22. @ITCAMPRO #ITCAMP18Community Conference for IT Professionals
Showing (master) keys
http://www.nbcbayarea.com/investigations/One-Gas-Pump-Key-Lets-Thieves-Steal-Your-ID-177999751.html

23. @ITCAMPRO #ITCAMP18Community Conference for IT Professionals
Showing (master) keys

24. @ITCAMPRO #ITCAMP18Community Conference for IT Professionals

25. @ITCAMPRO #ITCAMP18Community Conference for IT Professionals
Backdoors

26. @ITCAMPRO #ITCAMP18Community Conference for IT Professionals

27. @ITCAMPRO #ITCAMP18Community Conference for IT Professionals
Pictures: Oliver
Diederichsen

28. @ITCAMPRO #ITCAMP18Community Conference for IT Professionals
Key re-use

29. @ITCAMPRO #ITCAMP18Community Conference for IT Professionals
(Partial) key re-use
http://www.crypto.com/papers/mk.pdf

30. @ITCAMPRO #ITCAMP18Community Conference for IT Professionals
(Partial) key re-use
http://www.crypto.com/papers/mk.pdf

31. @ITCAMPRO #ITCAMP18Community Conference for IT Professionals
Root user
•Often, there is an omnipotent user
•root
•Domain Administrator

32. @ITCAMPRO #ITCAMP18Community Conference for IT Professionals
Root user

33. @ITCAMPRO #ITCAMP18Community Conference for IT Professionals
Using sample code

34. @ITCAMPRO #ITCAMP18Community Conference for IT Professionals
Using sample ‘code’
http://www.youtube.com/watch?v=Ti9S1qzPXTI

35. @ITCAMPRO #ITCAMP18Community Conference for IT Professionals
Remember showing keys?

36. @ITCAMPRO #ITCAMP18Community Conference for IT Professionals
0day
http://users.ece.cmu.edu/~tdumitra/public_documents/bilge12_zero_day.pdf

37. @ITCAMPRO #ITCAMP18Community Conference for IT Professionals
Responsible disclosure

38. @ITCAMPRO #ITCAMP18Community Conference for IT Professionals
PR

39. @ITCAMPRO #ITCAMP18Community Conference for IT Professionals

40. @ITCAMPRO #ITCAMP18Community Conference for IT Professionals

41. @ITCAMPRO #ITCAMP18Community Conference for IT Professionals
Brute force attacks

42. @ITCAMPRO #ITCAMP18Community Conference for IT Professionals
Brute force attacks

43. @ITCAMPRO #ITCAMP18Community Conference for IT Professionals
Brute force attacks

44. @ITCAMPRO #ITCAMP18Community Conference for IT Professionals
Denial of Service

45. @ITCAMPRO #ITCAMP18Community Conference for IT Professionals
Denial of Service

46. @ITCAMPRO #ITCAMP18Community Conference for IT Professionals
Denial of Service

47. @ITCAMPRO #ITCAMP18Community Conference for IT Professionals
Sequential attacks
• “Unknown user” versus “Incorrect password”
• Timing attacks

48. @ITCAMPRO #ITCAMP18Community Conference for IT Professionals
Sequential attacks

49. @ITCAMPRO #ITCAMP18Community Conference for IT Professionals
Sequential attacks

50. @ITCAMPRO #ITCAMP18Community Conference for IT Professionals
Sequential attacks

51. @ITCAMPRO #ITCAMP18Community Conference for IT Professionals
Security testing
• Let an experienced security consultant look at the security?
• Use automated vulnerability scanners?
• Certification?

52. @ITCAMPRO #ITCAMP18Community Conference for IT Professionals
Certification

53. @ITCAMPRO #ITCAMP18Community Conference for IT Professionals
Tooling

54. @ITCAMPRO #ITCAMP18Community Conference for IT Professionals
Tooling
http://www.revk.uk/2013/12/abs-lock-vs-3d-printer.html

55. @ITCAMPRO #ITCAMP18Community Conference for IT Professionals
•You can’t see how secure a piece of software is
•We can’t all be security experts
You get what you pay for

56. @ITCAMPRO #ITCAMP18Community Conference for IT Professionals
• With locks, you can see something
• But does it mean anything?
You get what you pay for

57. @ITCAMPRO #ITCAMP18Community Conference for IT Professionals
4’49.20 0’40.90 0’34.31 0’02.163’57.00
• With locks, you can see something
• But does it mean anything?
You get what you pay for

58. @ITCAMPRO #ITCAMP18Community Conference for IT Professionals
Awareness
• Always a problem..
http://krebsonsecurity.com/2011/08/beware-of-juice-jacking/

59. @ITCAMPRO #ITCAMP18Community Conference for IT Professionals
Awareness

60. @ITCAMPRO #ITCAMP18Community Conference for IT Professionals
Holistic view
• You are depending on the environment
• You are as secure as the weakest link

61. @ITCAMPRO #ITCAMP18Community Conference for IT Professionals
Holistic view

62. @ITCAMPRO #ITCAMP18Community Conference for IT Professionals
Threat modeling

63. @ITCAMPRO #ITCAMP18Community Conference for IT Professionals
Thank you for
your attention
Any questions?
walter@toool.nl