The Security of Biometrics: Two Screws and a Plastic Cover

These are the bones of a typical biometrics or proximity card system: A card reader (the tan box mounted on the lycra display to the left), is connected through wire to an access control system (to the bottom right of the lycra display). In the foreground

A closeup of Frankens quick connect, called Gecko. One drawback to Gecko is its large size, Franken said. To accomplish the hack, the quick connect has to be spliced to wire between the reader and the ACS thats been pulled out of the wall

Franken uses a knife to pry off the readers plastic cover and gain access to the wires that connect to the ACS.

Photo: Lisa Vaas/eWEEK

This is a closeup of the access control system. Nearly all ACSes rely on a legacy protocol called Wiegand. The Wiegand protocol is, Franken said, a) in plain text, b) easily intercepted, c) easily replayed, d) includes output from biometric readers, and e

Note that there are three lights on the ACS: green, amber and red. Green and amber both indicate that a user has been identified by the reader as eligible to be granted access. A hacked ACS can be told whether to blink red, green or amber and can also be

Franken purchased pre-programmed proximity cards and didnt need to hack them. After splicing in a quick connect, he can program from that point whether a card will be granted access or not. He can also program the ACS to deny all further entry to any car

Franken has managed to hack one proximity card reader and ACS, but any others in a given installation wouldnt be affected. Bluetooth changes all that, however. Frankens working on Gecko Version 3 now, which will have a Bluetooth interface and will hence

• Phishing Impaler Sticks it to eBay
• How to Safeguard You