The Security of Biometrics: Two Screws and a Plastic Cover

The Security of Biometrics: Two Screws and a Plastic Cover

These are the bones of a typical biometrics or proximity card system: A card reader (the tan box mounted on the lycra display to the left), is connected through wire to an access control system (to the bottom right of the lycra display). In the foreground

The Security of Biometrics: Two Screws and a Plastic Cover – Quick Connect

A closeup of Frankens quick connect, called Gecko. One drawback to Gecko is its large size, Franken said. To accomplish the hack, the quick connect has to be spliced to wire between the reader and the ACS thats been pulled out of the wall

The Security of Biometrics: Two Screws and a Plastic Cover – Cover Off

Franken uses a knife to pry off the readers plastic cover and gain access to the wires that connect to the ACS.

Photo: Lisa Vaas/eWEEK

The Security of Biometrics: Two Screws and a Plastic Cover – Access Control System

This is a closeup of the access control system. Nearly all ACSes rely on a legacy protocol called Wiegand. The Wiegand protocol is, Franken said, a) in plain text, b) easily intercepted, c) easily replayed, d) includes output from biometric readers, and e

The Security of Biometrics: Two Screws and a Plastic Cover – Amber Light Identifying User with Access Rights

Note that there are three lights on the ACS: green, amber and red. Green and amber both indicate that a user has been identified by the reader as eligible to be granted access. A hacked ACS can be told whether to blink red, green or amber and can also be

The Security of Biometrics: Two Screws and a Plastic Cover – Proximity Cards

Franken purchased pre-programmed proximity cards and didnt need to hack them. After splicing in a quick connect, he can program from that point whether a card will be granted access or not. He can also program the ACS to deny all further entry to any car

The Security of Biometrics: Two Screws and a Plastic Cover – All Systems Go

Franken has managed to hack one proximity card reader and ACS, but any others in a given installation wouldnt be affected. Bluetooth changes all that, however. Frankens working on Gecko Version 3 now, which will have a Bluetooth interface and will hence

The Security of Biometrics: Two Screws and a Plastic Cover

• Phishing Impaler Sticks it to eBay
• How to Safeguard You