The Security of Biometrics: Two Screws and a Plastic Cover

1
2
3
4
5
6
7
8
1 of 8

The Security of Biometrics: Two Screws and a Plastic Cover

These are the bones of a typical biometrics or proximity card system: A card reader (the tan box mounted on the lycra display to the left), is connected through wire to an access control system (to the bottom right of the lycra display). In the foreground

2 of 8

The Security of Biometrics: Two Screws and a Plastic Cover - Quick Connect

A closeup of Frankens quick connect, called Gecko. One drawback to Gecko is its large size, Franken said. To accomplish the hack, the quick connect has to be spliced to wire between the reader and the ACS thats been pulled out of the wall

3 of 8

The Security of Biometrics: Two Screws and a Plastic Cover - Cover Off

Franken uses a knife to pry off the readers plastic cover and gain access to the wires that connect to the ACS.Photo: Lisa Vaas/eWEEK

4 of 8

The Security of Biometrics: Two Screws and a Plastic Cover - Access Control System

This is a closeup of the access control system. Nearly all ACSes rely on a legacy protocol called Wiegand. The Wiegand protocol is, Franken said, a) in plain text, b) easily intercepted, c) easily replayed, d) includes output from biometric readers, and e

5 of 8

The Security of Biometrics: Two Screws and a Plastic Cover - Amber Light Identifying User with Access Rights

Note that there are three lights on the ACS: green, amber and red. Green and amber both indicate that a user has been identified by the reader as eligible to be granted access. A hacked ACS can be told whether to blink red, green or amber and can also be

6 of 8

The Security of Biometrics: Two Screws and a Plastic Cover - Proximity Cards

Franken purchased pre-programmed proximity cards and didnt need to hack them. After splicing in a quick connect, he can program from that point whether a card will be granted access or not. He can also program the ACS to deny all further entry to any car

7 of 8

The Security of Biometrics: Two Screws and a Plastic Cover - All Systems Go

Franken has managed to hack one proximity card reader and ACS, but any others in a given installation wouldnt be affected. Bluetooth changes all that, however. Frankens working on Gecko Version 3 now, which will have a Bluetooth interface and will hence

8 of 8

The Security of Biometrics: Two Screws and a Plastic Cover

Phishing Impaler Sticks it to eBay How to Safeguard You

Top White Papers and Webcasts