Vulnerability Checklist for Cards, Readers

Friday, July 21, 2017 @ 04:07 PM gHale


Farpointe Data just posted a radio frequency identification (RFID) Cybersecurity Vulnerability Checklist for access control manufacturers, distributors, integrators and end users to use to protect their access control systems from becoming hacker gateways to their facilities and IT systems.

Knowing what to do is especially important now that government agencies, such as the United States Federal Trade Commission, have begun filing lawsuits against businesses that do not provide good cybersecurity practices.

“Seemingly daily, end users are being reminded of how their access control systems are no longer secure,” said Farpointe Data President Scott Lindley. “They learn how a hotel had to pay a ransom to release guests that got locked into their rooms via a hack of the electronic key system or how easy it is to spoof popular access cards.”

Since the start of 2017, Lindley said users learned about a series of hacks on various credentials:
• The Chaos Computer Club said they “hacked a padlock product and its accompanying mobile app which communicates via Bluetooth Low Energy (BLE) to the padlock. This could potentially also affect hotels with mobile room keys as their door locks also communicate with smart phones via BLE technology and exchange confidential information.” 
• IPVM reported how a $30 copier easily spoofed a popular proximity card. The column said the copier “used to copy the cards works much the same way as normal card readers, with transceiver coil, power supply, IC chip, buzzer and even LEDs components shared by both. Given the principal operation of contactless card readers, the copier excites the coil and delivers power wirelessly to the card, which then momentarily stores energy and then uses it to broadcast card details back to the copier.”
• In an on-site demonstration at the ShmooCon hacker conference, an ESPKey, a small device that costs about $100 to make and has half a dozen wire clamps, a Wi-Fi transmitter and 4MB of memory, showed it takes two or three minutes to break into an RFID card reader wall plate, attach the ESPKey and reinstall the wall plate to capture the ID codes of everyone in the workplace.

To help prevent such attacks, the Farpointe Cybersecurity Vulnerability Checklist covers a range of topics that can lead to hacks of contactless cards and readers. Sections include default codes, Wiegand issues, reader implementation tips, card protection solutions, leveraging long range readers, assuring anti-hacking compatibility throughout the system and leveraging additional security components.

“We are encouraging every access control manufacturer, dealer, distributor, integrator or end user to go to our website to either download or print out this Cybersecurity Vulnerability Checklist and use it,” Lindley said.



Leave a Reply

You must be logged in to post a comment.