Page 19 - Security Today, May 2017

For instance, a little over a year ago, around 1.4 million homes in western Ukraine lost their electricity for several hours. This was a very sophisticated attack. Once the hackers had access, they manually opened the breakers. They then employed theBlack- Energy virus to hinder efforts to locate and restore the opened breakers. There was also a simultaneous Distributed Denial of Service (DDOS) on the utilities’ call centers to slow down cus- tomer reports of outages.
Closer to home it was learned that breaches of the operat- ing system at a dam outside of New York had been attributed to hackers working for companies that performed work on behalf of the Iranian Government, including the Islamic Revolutionary Guard Corps. Here the perpetrators successfully obtained unau- thorized access to the Supervisory Control and Data Acquisition (SCADA) systems of the dam. Fortunately, in this case the FBI found those behind the cyber intrusion and the Justice Depart- ment held them accountable.
Security Professionals Can Be at Fault
Interestingly, some security people don’t seem to secure their own security equipment. Over the past year, as noted already by the FTC, users are learning that today’s IP-enabled contactless card readers and wireless cameras have become favorite targets of hackers. Unsecured, they provide irresistible backdoors. Thus, new specifications are needed for electronic access control projects.
Let’s begin with understanding one the easiest problems to cor- rect with security equipment. Were you aware that by simply put- ting the default installer code in a disarmed state, it can be used to view the user codes including the master code or to change or create a new code? Therefore, if a potential unauthorized person gains access to a panel in the unarmed state, using the installer code gives that person access to all installed hardware and will even allow creation of a new user code or change of a current user code. This code then trumps the master/ other user codes.
So, if the installer does not change the default code, the user might as well be giving a user code to everyone. Less than 30 sec- onds is all it takes to view the master, all other user codes, or even create a new one. Yes, you reply, but what if the installer says that they don’t have the default installer code? Unfortunately, too often, these codes can be found online by anyone that knows how to use a simple Google search. And, of course, once inside the system, the hacker can get also access to the rest of the computer system.
Sometimes the problem is within the software itself. Oftentimes, the default code is embedded in the app to provide a mechanism to let the device still be managed even if the administrator’s custom pass code is lost. However, it is a poor developer practice to embed passwords into an app’s shipped code, especially unencrypted.
Adding to the problem is that Wiegand, the industry standard over-the-air protocol commonly used to communicate credential data from a contactless access credential to an electronic access reader, is no longer inherently secure due to its original obscure and non-standard nature. Today, no one would accept usernames and passwords being sent in the clear nor should they accept such vulnerable credential data. ID harvesting has become one of the most lucrative hacking activities. In these attacks, one or more a
credential’s identifiers are cloned, or captured, and are then re- transmitted via a small electronic device.
For this reason, options are now available that can be added to the readers. The first is MAXSecure, which provides a high- er-security handshake, or code, between the proximity or smart card, tag and reader to help ensure that readers will only accept information from specially coded credentials. The second is Valid ID, a relatively new anti-tamper feature available with contact- less smartcard readers, cards and tags. Embedded, it can add an additional layer of authentication assurance to NXP’s MIFARE DESFire EV1 smartcard platform, operating independently, in addition to, and above the significant standard level of security that DESFire EV1 delivers. Valid ID lets a smartcard reader ef- fectively help verify that the sensitive access control data pro- grammed to a card or tag is indeed genuine and not counterfeit.
Role of the Access Control Provider
First of all, when considering any security application, it is criti- cal that the access control provider needs to realistically assess the threat of a hack to a facility. For example, if access control is being used merely as a convenience to the alternative of using physical keys, chances are the end user has a reduced risk of being hacked. However, if the end user is using their access system as an element to their overall security system because of a perceived or imminent threat due to the nature of what they do, produce or house at their facility, they may indeed be at higher risk and they should consider methods to mitigate the risk of a hack. Here are a few steps that may be considered in reducing the danger of hacking into a Wiegand-based system.
• Install only readers that are fully potted. Potting is a hard epoxy seal that does not allow access to the reader’s internal electronics from the unsecured side of the building. An imme- diate upgrading is recommended for readers that fail to meet this standard.
• Make certain the reader’s mounting screws are always hidden from normal view. Make use of security screws whenever possible.
• Embed contactless readers inside the wall, not simply on the outside, effectively hiding them from view. Or, if that is not possible and physical tampering remains an issue, consider upgrading the site to readers that provide both ballistic and vandal resistance.
• Make use of reader cable with a continuous overall foil shield tied to a solid earth ground in a single location. This helps block signals from being induced onto the individual conduc- tors making up the cable as well as those signals that may be gained from the reader cable.
• Deploy readers with a pig tail, not a connector. Use extended length pig tails to assure that connections are not made im- mediately behind the reader.
• Run reader cabling through a metal conduit, securing it from the outside world. Make certain the metal conduit is tied to an earth ground.
• Add a tamper feature, such as Valid ID, commonly available on many leading access control readers.
WWW.SECURITYTODAY.COM NS5