Physical Security In the Workplace presentation given at Hacker Halted Miami 2008 by Doug Farre and Mitch Capper.

1. Avoiding getting owned without knowing it Physical Security in the Workplace By: Mitch Capper and Doug Farre

2. This Presentation We only have 45 minutes Won’t be covering: Mechanical lock details High security mechanical lock details Latest high security exploits details Goal is to help you evaluate a ‘secure’ area to see possible holes in security

3. What is most important to you? Your Data Your Contacts Your Customers Confidence Your Inventory Your Employees

4. Security Budget Virtual Security: Firewalls Anti-virus IDSs VPNs System administrators Auditing and review Segmented networks Encryption and training Software Updates and Group Policies

5. Your Virtual Security Setup IS GREAT Keeps the virtual bad guys out Stops drive by and 0 day exploits like no others Has kept your company secrets secure for many years

6. Compromising Virtual Security Physical key loggers Bios level rootkits with FDE and virtualization Live malware Cold boot attacks

7. Physical Security is Trump Most virtual security monitors the border Secure data can only be defined as offline and encrypted At the end of the day there is only one undeniable fact: Physical Access means 100% data vulnerability

8. Why don’t people think about Physical Security? Don’t think it’s a threat Impossible to secure Not enough resources or knowledge Haven’t got around to it

9. Espionage Frequently use physical attacks Over 100 billion annually in cost Large attacks can be “game over” Social Engineering w/ minimal physical attacks have accomplished most large attacks

10. Social Engineering and Information Gathering Social Engineering Co-worker Salesman Interviews Reference checks Impersonation Information Gathering Interviews Prospective clients Public tours Dumpster diving Off-site observation Internet

11. Lets Talk Physical Security Breaks down to 5 main areas: Mechanical Access Control Electronic Access Control Alarm Systems Surveillance Egress Devices

12. Egress Devices: Latches Latches Guards Deadlatches

13. Egress Devices: Continued Push Bars Button Releases Infrared/Motion Sensors

14. Alarm Systems Must be hardwired Expensive Install 4 main sensor connection types: Trip on fail Circuit always connected ‘Constant Monitoring’ Magnetic Coupling Use GSM or Phone for reporting Spend most of their time off Response Time

15. Alarm Systems:Considerations Take advantage of unconventional technologies Alarmed glass Photoelectric controls Pull-trip switches Stress detectors Vibration sensors Sound monitoring sensors Ultrasonic motion sensors

16. Surveillance CCTV Primarily Forensic tool Partial Deterrent ID Cards Only good for casual ID Guards Response Two person rule

17. Surveillance

18. Electronic Access Control Handling of lost keys/terminated employees Easy to reprogram/rekey Advanced control (blackout times, use counts etc…) Provides AUDITING

21. EAC: BiometricsBehavioral Characteristics Voice mapping VoiceVault – phone verification Keystroke biometrics BioPassword – keystroke behavior Think Morse Code during WWII Signature Dynamics

22. EAC: Cards Barcode/ Concealed Barcode Cards Mag Stripe Cards RFID / Prox Cards Smart Cards

23. EAC: Fail Most devices/systems use Weigand Protocol, think clear text over hard wire Mechanical Lock Backup No destructive attack resistance

24. Mechanical Locks: Attacks Key Duplication Bumping Picking Impressioning Rights Escalation in Master Key Systems Bypass

25. MLA: Key Duplication All non high security locks Some high security locks Key duplicators Clay Molding Silicon Casting

26. MLA: Bumping Requires a bump key A blank or key in the system A file Can be purchased online for under $5 a key All non high security Some high security Low barrier to entry

27. MLA: Picking Most people can pick an easy lock in 5-30 minutes of initially being given the tools and minimal instruction Within months of casual practice most can open most non-high security locks both pin tumbler and wafer. Large picking community www.lockpicking101.com

28. MLA: Bypass - Shimming Padlock Shimming Handcuff Shimming

29. MLA: Lock Bypasses Medeco Deadbolts Master lock 175 American Padlocks

30. MLA: Adam Rite Wires Effected huge numbers of locks Lock/Egress combined attack

31. MLA: Impressioning Key from the lock Key Blanks, File Skilled Attack The art of a locksmith

32. MLA: Rights Escalation in MK Systems Matt Blaze from AT&T Labs -2002 No technical skill required One key to the system, one lock, 5-7 key blanks, and a file Under desk attack

33. High Security Locks Abloy, ASSA, Bilock, Medeco, Mul-T-Lock, Schlage (Primus) Should be: bump resistant hard to pick hard to duplicate keys hard to drill Industrial Locks

34. HSL: Problems Changing Keys is a pain Even some high security locks suffer from varying degrees of standard attacks (bumping, rights amplification, key duplication) Getting unique blanks very hard for anyone short of the largest companies

35. HSL: Ground Zero Mechanical locks usually are what is in-between the outside world and the sensitive data One of few Active Preventions Low investment can greatly enhance security Frequently Overlooked

36. Electronic vs Mechanical

37. Proper Physical Security Layers Look not just at how you are supposed to enter, but alternate methods/exit ways Dual authentication separate electronic with mechanical authentication

38. Combined Physical/Electronic Locks Combined cylinders (Say AssaAbloy Brand’s Cliq) try to bridge gaps and minimize costs Most brand systems (Medeco, Assa, Mul-t-lock) are already compromised AbloyProtecCliq still safe (also only mechanical lock for that matter)

39. Closing Points Use your imagination! Never underestimate the attacker!

40. Questions? Our email is at @SecuritySnobsdot com (first name @) Mitch Capper Doug Farre

41. MLA: Rights Escalation – The How File each of the 5 keys to the same depths of the normal user key skipping one of each position on each key Put non working key in door try it If doesn’t work file the one unfiled position Try again until works If works and is same height as normal key keep filing, otherwise the key is done Once all keys are done, compare each to the original and make the GMK of different heights