I am currently a little busy. So my HAR post will have to wait a couple of days …. Hope to finish it in the next 48 hours orso …
Archive for August, 2009
I have been looking forward to the HAR conference for a long time. After all, it was going to be the moment to publicly talk about our discovery on bypassing the electronic locking part on the first generation Mul-T-Lock Cliq. More then one year ago we discovered the samples we had in some instances could be opened with the so called ‘magnetic ring’ (you still needed to have the correct mechanical key or bypass the mechanical part). An important discovery as the attack would not show up in the electronic logfile in the lock. And the integrity of the logfile is a key issue in these kind of systems. So we immediately informed Mul-T-Lock about this problem. And even though communication did not always go smooth we came to an agreement. We agreed to go into full detail about this at the HAR conference in 2009. And that is what we just did. At the presentation we showed the problem was not magnetism … it was vibration!
In the meantime Mul-T-Lock came out with a new version and we even received some samples to test. How successful the fix was still has to be determined. And communication is still slow. Marc Tobias and Tobias Bluzmanis claimed at DefCon to be able to still open the latest generation Mul-T-Lock Cliq locks (and a wide range of other electronic and electromechanical locks). They briefed us behind closed doors and I can only say their claims look solid (as was to be expected from these clever and high-profile security experts!).
At the HAR presentation we also demonstrated attacks on electronic locks that make use of the basic Dallas Ibutton key. This key is nothing more then a device that spits out a 64 bit number. If the number is on the list of the lock it will open. I read somewhere 175 million of these keys are in use. We found it is not difficult to duplicate these keys.
What is more interesting is that we found a way to scan for keys on some of these locks. Scanning a 64 bit key can take forever (at approximately one key per second!). However … we discovered sometimes these keys are handed out in batches with numbers following up or in close range of each other. In those cases it might be possible to scan for numbers in a known range.
And our presentation contains some other attack vectors you might enjoy….
To see the entire presentation you need to go to: www.rehash.nl , select ‘HAR2009’ and enter ‘lockpicking’. Unfortunately there is no deeplink to our presentation yet….
Presenting these hacks was nice, but more important to me we also tried to address a more serious topic. That of disclosure and dealing with lock manufacturers.
I like to keep things simple. If we discover a vulnerability in a lock we will notify the manufacturer. We will tell them what we know and most of the time an interesting and technical discussion is started. And sometimes the manufacturer is a little reluctant and barely wants (or dares) to communicate. Especially in the US the stakes can be high for them because of the ‘I will sue you’ culture. So in a way we understand both approaches and are fine with them, as long as it is clear we will go public on the vulnerability at one moment in time. In general we are talking giving them three to six months, although a longer period can be negotiated if that time is needed to update specific projects or customers.
The philosophy behind this is approach is to give the manufacturer some time to fix the problem, inform it’s customers, exchange locks or prepare a press statement. The fact they know a publication is coming should be enough to motivate them to do the right thing. Going public on the vulnerability will send out a clear signal: better make good locks! There are motivated people out there paying attention to what you do and who will write about it if weak spots are discovered.
So far so good ….
What we have seen lately is that lock manufacturers (try to) fix problems but no longer openly want to discuss their fixes. It could be because of this ‘I sue you culture’, but it also creates a lot of ‘security trough obscurity’. And to me that is a sign of weakness. After all, how can we evaluate the ‘new and improved’ product if the manufacturer is reluctant to release information on how they (supposedly?) fixed a problem? The ‘just trust us, we know what we are doing’ approach is not something that gives me a warm fuzzy feeling … at all.
By not saying anything about the fix the researchers are delayed. Or if they have a limited number of locks to test they might even miss an important new feature that is incorporated in some of the new locks. But at the end of the day the information leaks out or is distilled from a greater pool of locks. And since the researchers are highly motivated, the product will fall anyway. Only by it taking a little longer to fall, more locks are sold and more locks are affected when it happens.
Interestingly enough it now seems some security researchers are going the same route as the lock manufacturers. They claim specific locks can be bypassed but refuse to tell the manufacturer how they did it. Only if the manufacturer promises to exchange all the locks in the field (free of charge) they are willing to explain how the technique works. The idea behind this is they are trying to do the end customer a favor. After all, nobody knows how to bypass the customers lock and the manufacturer has to change it free of charge before anyone else hears about it. Logically the lock manufacturer will first try to find the problem itself, but now learns what it feels like to be kept in the dark. Even if they find a vulnerability they can never be sure it is the same one the researchers found. So a fix created does not necessarily means it actually works against the unknown attack…. or if the fix introduces an even bigger problem! And instead of being happy, the end customer is getting nervous. What if someone else finds out about the problem?
There may well be a few extreme cases where putting lots of pressure on some manufacturer is justified because they are really screwing over the public interest. But in general we feel everyone benefits if we try to keep as much information available to as many parties as possible, as quickly as possible. That way, consumers can make informed choices, manufacturers still make their own judgments (and face public scrutiny on them) and manufacturers and enthusiasts can continue to learn from eachother.
Let us try to keep the research area open and transparent and all learn from these discoveries…..
Newsflash: The LockCon #2 impressioning games were won by Jos Weyers (Toool.nl).
His time: 1 minute and 27 seconds (that is 87 seconds for a five pin lock …).
Some technical background on the lock: Abus 5 pin, non-masterkeyed, type C83, pin depths 3-2-6-7-4.
Now I need some time to relax.
When my internal battery is charged up a little I will try to write a nice post about HAR ….
The HAR camp is on schedule. As a matter of fact: they are ahead of schedule. When we arrived this morning the tent was already set up, the only thing we had to do was carry ten big tables and thirty five chairs in. And the tent is much bigger as I expected too! I am sure we are going to have one hell of a time there!
I am real curious how the lockpick championships will go. After all, there is quite something at stake! The games will be played in on solid ground and not in a tent. The risk of rain on a Dutch event just is too big. So for this we rented a nice location (on walking distance from lockpick village). Please visit us at the ‘paasheuvel zaal’ on Saturday from 11:30 till +- 16:00 to see the lockpick championships, or at 23:00 on Saturday evening for the impressioning games. The reason we are doing the impressioning games so late is to give Oliver Diederichsen a fair chance to win a ‘double whammy‘ too. Lets see how that all goes …. I am looking very forward to it all!
Just got back from Vegas and will share some experiences with you….
Lets start with the US lockpick championships:
And the winner is … JGOR!
From the fifty participants that attended the US lockpick championships at the Defcon17 conference, JGOR stood out. It was impressive to see his ‘cool’ way of picking. While his opponents were nervously raking and rapidly moving the tools in and out the lock he was just calmly picking. Setting one pin at the time yet opening locks in impressive times (like 17 seconds in the finals on a lock others did not open). To me it is clear the best man won. Second best was Schuyler Towne, third was a draw between Chris Pentacoff and Tokey (from France!).
By winning the US lockpick championships Jgor won a full paid plane ticket to the European lockpick championships in Turkey next year. It will be interesting to see how well he does there.
Deviant and Babak (Toool.US) did a great job organizing the lockpick village and the various lockpick games. One of the things I admire from Babak and Deviant is their eye for detail. Take for instance the locks used in the games. These locks are connected to an electronic timer that stops when the lock is opened!
It is always fun in Vegas. Renderman introduced me to one of his friends who had a little problem with some of her locks. I seem to be losing my touch as I was not able to open the simple lock. Maybe it was the jetlag? After hearing the story, my dear wife Charlotte found an appropriate t-shirt for me at the vendor area two days later. Other fun was meeting some famous people in vegas.
The vendor area:
As you can see on the video above, there was lots of activity at the vendor area. There even was a stand selling bumpkeys (using a slightly NSFW booth-babe). Check the youtube video for details (and a good laugh).
Public and private talks:
I only visited one presentation. Obviously it was the one by Mark Tobias and Tobias Bluzmanis. Han and I spoke with them before the presentation and learned about the details of their attacks on some of the electromechanical Cliq locks. Pretty impressive things they have come up with. They did not go publicly into details on how to bypass these expensive ‘top of the line’ high security locks. Han and I know the Cliq system well as we did conduct our own research for a year now too. And we will go into details when we discuss our research at our presentation at HAR next week. Interesting times we live in ….
Defcon is a dangerous place. At least for those that are not computer savvy. The famous ‘Wall of sheep’ was showing (parts of) login data of those not using SSL or other types of encryption when popping mail or transferring files etc….
But even when Defcon is a dangerous place … we all made it back safe. Now preparing for HAR! Hope to see you there!