house
[Music]
welcome everyone my name is Bill Grayden
I've spoken on a number of occasions in
past about this and related topics
defeating door alarms and intrusion
detection and various ways that the red
team can get in despite these
countermeasures and the blue team can
defend against it
and so I work for ggr security where we
go in and perform red team attacks and
then consult on those remediations
this is going to be a bit of a lightning
talk this is content that I could take a
full day to go over you might have seen
Eric's uh bypass 101 talk earlier this
Con and so it's also one that we're
putting on as part of the the physical
security Village and after this talk I
encourage you to check it out in the
Villages right next door where you can
go and try a lot of the defeats and
vulnerabilities that we're going to talk
about today
so if you saw Eric's talk and if not you
can look it up online after it talks
about how to get a door open without
lock picking so reaching around hitting
the handle from the other side a bunch
of other really clever techniques that
will work there
there's a bunch of other ways to get
doors open so you can pick the lock of
course and you can force the door
none of those are what this presentation
is about this presentation is about well
what can we do to defeat or to mitigate
that as a Defender well we detect and
then how can we evade those detections
right so no door is invulnerable any
door can be breached with sufficient
Force skill time money and motivation
and that time and force aspects are
particularly important right so
something like a halogen bar is a known
science in uh
in firefighting and explosive breaching
and stuff like that so with enough Force
you can get through any door and so now
it's not a matter of how do we Harden
against it how do we get better locks
whatever it's a matter of okay if
someone's going to get in how do we
detect that and respond
right and so for instance the U.S
military recognizes as well so in UF UFC
426-1 they identify different levels of
protection and the main metric for those
levels of protection is not is it going
to keep you out but how long is it going
to keep you out so low level of
protection at least one minute of delay
very high is 30 minutes of delay right
so the Army's standard for a very high
level of protection will only keep out a
determined attacker for half an hour but
you know what if you're the Army half an
hour is plenty of time to get some
response for us there to deal with it
so with that in mind let's think about
sort of the the situation without
detection is a locked vault in the woods
and it's an analogy I like to use
because it's like you've got to Vault
very difficult to get into but there's
still a way to force your way in or pick
the locker bypass to do something and if
it's in the woods there's no one there
to hear it no one there to stop you you
will get into that locked vault in the
woods
so if we are the owner of that Vault
what can we do to protect against that
well we can station a guard there
watching it 24 7 all day every day and
he can go and deal with it if someone
starts trying to breach into this vault
that's not particularly economical a lot
of logistics concerns with providing for
the life of a guard in the middle of the
Woods
so we might do something like put an
automated detection mechanism on it so
something like these magnetic read
switches that will detect when that
vault door gets opened and now we can
have that on a bunch of our vaults in
the woods and have only one guard who's
remote who gets the signal when this
gets opened and he can go in and respond
to it when that happens
one of the most common technologies that
gets used for this is magnetic read
switches
so up top you've got a magnet and then a
switch that essentially just looks for
the presence of that magnetic field if
it sees one it's going to say
everything's good the door is closed as
soon as that magnetic field goes away
it's going to send an alarm signal
so we can attack the sensor directly
with something like a mechanical Attack
Just unscrew that magnet we can open the
door hold the magnet in place
and the sensor is none the wiser or use
a surrogate magnet so our own magnet we
put that in we can open the door and
that's now none the wiser
right something like a balanced magnetic
switch that looks for the correct field
strength is going to defend against that
so that's something that you can go next
door and try in our village right so
we've got a couple doors that have these
contact sensors to detect intrusion and
so you can use a magnetic probe to
figure out where the magnet is what the
polarity is insert a surrogate magnet
there and then you can open the door
while holding your magnet over the
sensor and therefore it won't detect
that that door has been opened
and there's a bunch of other sensor
technologies that could get used instead
so we've got many of them use this
magnetic technique you might have a
glass break detector so to detect if
someone smashes through the window
instead something seismic for someone
walking over ground or a fence climb
detector which essentially looks for
vibration now the problem with a lot of
these is a very high false positive rate
so your guard force is going to get
quite fatigued if if they're not really
on their game with all the false
positives there
and then we'll talk in a little bit
about things like passive infrared
detectors for area detection looking at
not the perimeter not someone going
through the door but the area is someone
within this room
so these work by looking for the the
black body radiation spectrum of the
human body
so if it sees temperature that matches a
person in its field of view it's going
to trigger that alarm and say someone's
in here
now is it someone that shouldn't be in
here well that's where you put in the
alarm code and determine if you should
be there or not but it detects that
someone is in here
so a couple techniques that will defeat
these one is to move slowly very very
slowly like across the room in 20
minutes but that will go slowly enough
that this sensor thinks it's just a slow
atmospheric change and it will not trip
you can move out of the focus range
right so many of these are tuned so that
say a dog or a raccoon or something
walking in front of it will not trip it
which means that if you just crawl on
the ground you're not going to trip it
either
avoiding perpendicular motion some
motion across the field is what gets
detected in and out does not it at least
not nearly as
reliably and then you can use an
infrared blocking material as well so
these space blankets are somewhat
effective from a distance
uh so you can see here
here's one of our colleagues putting a
space blanket over herself so you can
see the warm uh thermal signature of her
body and it gets blocked and it's now
ambient room where that space blanket is
the problem is once you're engulfed in
it that Heat's got to get out at some
point and so it starts to heat up and
doesn't Shield you as effectively as uh
as it does when you first put it on
so that works somewhat effectively what
we find works really well and we'll do
on-pan testing engagements is actually
yoga mats they're thick enough that
they'll block it and insulate long
enough for you to get across so that or
even a heavy winter jacket will work
make sure it's not one you were just
wearing otherwise it will be warm from
your body heat
right and going underneath to or to
pretend you're a pet and be out of the
focus range of these sensors is
something that's actually seen in the
criminal world so so here's a case of a
salon robbery and another sort of funny
video of a gentleman doing this
different store if it'll load
right so you can see him crawling along
the floor there in an effort to avoid
those motion sensors
right and that's the the path of Entry
he took so again anything can be forced
with sufficient time money Force Etc
so these sensors are also vulnerable if
you can get behind them and insert an IR
blocking material right in front of the
sensor's field of view right so here's a
pharmacy probably some things in there
that we want to keep out of out of the
hands of Bad actors and it's got these
passive infrared detectors but they are
around the perimeter the perimeter is a
public area and so anyone can come in
behind that and stick an IR blocking
material there and that's going to
defeat that
and so when you're laying these out from
the defense side you want to think about
that possibility right so in this case
you look at this and say hey the room's
mostly protected but these are located
such that you can reach from the door
from the entrance behind and take out
two of the three of them and motion
around this room is largely towards and
away from it not perpendicular which is
what it's sensitive to
right so a better layout might be going
at the corners there's no way to get to
that sensor until you've thoroughly gone
within its field of view and most motion
within the room will be perpendicular to
it
glass break detectors as well you want
to make sure that you have the right
detector Technologies for all ways
through an opening so you might put
glass breaks on your windows but if
those windows can be opened and you
don't have contact sensors
that's not going to be effective
so we can we've talked a little bit
about defeating the sensor technology
and the sensor itself
but let's start looking Upstream a
little bit
so we've got this wire coming out of the
sensor what can we do if we can access
that wire but maybe not defeat the
sensor itself
this wire then feeds into the alarm
controller and the terminology used is
zones
so there's a zone for each sensor or set
of sensors and these sensors essentially
operate as switches
so they're going to be either closed
connected or open disconnected
when it's a closed or what's called
normally closed so in the normal
non-alarm situation the circuit is
connected
you might wire multiple op in series and
then if any of those disconnect that's
going to disconnect the entire circuit
and that zone has now tripped and you
know that there's some sort of intrusion
in that zone
normally open is the opposite so it will
connect when there's an alarm when
there's an intrusion and in that case
you wire up in parallel
so if we can access these wires you can
start to see what we can do
if it's a normally closed
sensor the switch is closed there's no
alarm the switch is open there's an
alarm
I can jumper across those two wires and
just short them out and now I'm free to
open that door or trip that motion
sensor whatever
and the controller sees the same thing
as if I hadn't there's no alarm
for normally open it's the opposite so I
need to keep that circuit open I can
just cut the line
and now the circuit stays open
regardless of what the sensor does the
controller has no idea
so some defenses that can be used it's
vulnerable to just have
switch open switch closed it's a little
bit better to use resistors and this is
something that was uh first
first done in fire systems
um so what was happening is you've got
fire alarms you've got poles you've got
heat detectors Etc that feed into that
fire systems are usually normally open
so it is disconnected and it connects
when something is triggered
you can see the problem with that in
very old buildings that aren't
maintained as often as they should be
you know there's construction that
happens and and water gets in and wires
corrode and if a wire corrodes and
disconnects well now that normally open
circuit is always disconnected always
open that sensor doesn't work so the the
fire industry realized that this is a
threat to Life Safety we've got to have
some way of detecting when that line is
no longer functioning properly
and what they came up with is End of
Line resistors
so there's a resistance that it looks
for in the normal State and if that line
gets shorted if that line gets opened
that resistance is no longer there and
now it's going to detect that it's not
normal there should be an alarm
so this is less vulnerable it is still
vulnerable and we'll talk about a couple
ways to defeat that and of course the
best is an encrypted digital line with
well-designed encryption so denial of
service detection of some sort using a
knot so you can't just repeat that sort
of thing
so these End of Line resistors you see
them all over once you know to look for
them you'll see little boxes at the end
of various fire devices labeled EOL
you'll see boxes in the wall labeled End
of Line device ones with little resistor
pictures on them
so take a look for those now that you
know that they exist
in security systems they tend to look
like this so you have a resistor along
with the detector that you have so in
this case we have a password for red
detector and so now if that detector is
in its normal State it's going through
that resistor and the controller looks
for that resistance
so you can see here it's a close up
there on this terminal block here
so if we want to defeat this if we got
access to that wire we can replace the
resistor and there's a couple different
ways to measure what that resistance
must be at the end of the line put our
own resistor on there or we can regulate
the voltage and if we maintain that same
voltage across the line it's going to
look identical to that controller
and it turns out there is a fairly easy
way to regulate the voltage voltage
Regulators are a well-studied field of
electronics and one of the simplest is a
zener diode
so you might be familiar with diodes
they let current flow in One Direction
and they're an insulator in the other
direction
now the thing about insulators is they
only ever go up to a certain voltage air
is an insulator but above a certain
voltage it will Arc and you've got
lightning
and that's true of diodes as well so if
you over voltage any diode it will break
down and allow conductivity at a certain
point zener diodes are designed to do
this at a specific controlled voltage so
say a 5 volt zener diode below 5 volts
it does not conduct above 5 volts it
does
what this means is if I put this across
the line
it's now going to regulate if it's say 5
volts on this line I put a 5 volt zener
it's going to hold it at 5 volts and it
will not let it go above 5 volts it will
maintain that and so that's one way to
defeat this and this is something that I
talked about at Defcon two years ago so
if you're interested in this technique I
encourage you to check out that talk
right and so you can find these lines
all over the place in junction boxes
connected to the control panel itself
in conduits all throughout the building
and sometimes they're labeled so this
one says fa means fire alarm so if we're
looking to attack the security system
it's not what we want one that says door
contacts or security junction box is a
little bit more of interest to us
we can follow the line back from the
sensors itself right so here I might not
be able to tamper with these passive
infrared sensors directly because I'm
going to be right in their field but I
can follow this line back and access it
somewhere beyond their field of view
and so you really want to if you're the
defender avoid running your security
cables outside of the secured area they
protect in this case here's one running
outside of the building entirely
so you might think well if there's so
many problems with hardwired
um
hardwired communication lines Wireless
must be the way to Go Wireless of course
has problems with jamming
so I'm not sure if we have sound
but we should be able to see everything
that's going on here
all right so I'm arming the system
and then I'm opening that door which
triggers it
and so you can actually take many of
these operate on 440 433 megahertz
so you can take any ham radio and listen
to that and so you can actually hear
that signal that gets sent out
and you can hit the transmit feature and
this is on our trusty bow thing here and
if I'm transmitting at 433 megahertz I
can now open the door and it jams that
signal
so over the air you're competing with
every other RF signal out there it is
significantly less reliable than uh than
hardwired lines
so definitely for high security
installations you want to go hardwired
and ideally digital communication and
then it doesn't have the problems with
those end-of-line resistors
so we can also attack the controller and
the communication right so we've talked
about preventing the sensors from being
tripped we can trick it into thinking
that it's now in a disarmed State and
when it does go into an alarm State we
can prevent that call out
so what this looks like in older
controllers is you got the controller
here sensor gets tripped there's a
certain amount of time and you have that
time to enter the code to disarm it
if that timeout happens before the
disarm code is entered then it will
dispatch the police
so what we can do is trip the sensor
smash the controller
and now that timeout happens but there's
nothing to call out and dispatch the
police anymore so it's called a crash
and smash attack and it became
relatively well known amongst burglars a
couple decades ago and so systems got
wise to that
and the fix is to have an intermediary
server that's off-site so as soon as
that sensor is tripped it notifies the
server the disarm code is entered it
notifies the server and the server
stands down
if there's a crash in Smash attack or if
there's a timeout and no no code entered
This Server dispatches the police and
now it doesn't matter if that panel is
operable or not on site
the police are going to be notified
and the last instance that we'll talk
about is access control which is the
source of my Twitter handle access
control is letting the right people in
keeping the wrong ones out and you often
have detection on when there's intrusion
from someone that's not supposed to have
access there
so you've likely seen these all over the
place including all around this building
you've got card readers of some sort and
some mechanism for unlocking the door
when the right card is tapped and of
course behind the scenes there's going
to be controller that that makes that go
or no-go decision and wires to connect
to it
If This Were present on a door and I
smashed my way through that door this
controller has no idea so the way it
attacks it is we add a contact sensor so
when that door gets opened if I smash my
way through that the controller now
knows that the door has been opened the
problem with this of course is what if
someone's leaving
well if there isn't a card reader on the
way out it's going to send an alarm
every time someone leaves so we have a
sensor to detect when someone's leaving
as well
and so this is a passive infrared based
request to exit sensor when it detects
someone walking up to that door and the
door then opens it suppresses the alarm
if I tap a card and the door then opens
there's no alarm but if the door opens
and neither of those two things happens
it will send an alarm
the consequence of this relatively
complicated system is I can attack just
about anything on it right so if I can
attack this sensor here the contact
sensor or the wires leading to it
it will not know the door opens and I
can do the same on the request to exit
sensor make it think someone's exiting
and then I can freely open the door and
it will not detect
and there's also a course a line out
from the controller so if I can block
that call out notifying of an alarm and
a line in so if I can attack that line
in and make the controller think hey
we're supposed to be unlocked right now
it's public hours public hours are
Friday night at 2 A.M yeah and so now
that that lets me in and suppresses the
alarm as well
um so there's a couple different types
of sensors that get used here magnetic
is almost Universal at this point you'll
see some mechanical ones and very old
installations as well and some hinge
hinges that detect the position of that
door
and then the request to exit sensor has
different methods as well so the there's
the passive infrared based there's also
buttons right and so you push the button
to to go out or ones that detect the
position of the egress Hardware itself
which means that if I bypass that door
and say depress the lever on the inside
that will not only unlock the door but
it will also suppress the alarm for my
unauthorized entry
so for the passive infrared sensor
you've probably seen this before is
if you can spray an upside down can of
canned air
in through that door it will trip that
sensor and make make it think someone's
leaving because that's a change in
temperature and that's all these look
for is a change in temperature
if you have a button and you can stick
some sort of tool in and hit that button
from the unlocked side that's going to
trip that as well and make it think
someone's leaving and suppress that
alarm
and so this is something you can also
try out in the village
so there's a couple other pieces that
could be added to these Access Control
Systems something like a key switch to
let a guard come in and flip the switch
to say the building's now open the
building's now closed
well if the key switch looks like this
you know this is a high security medical
lock on here but anyone with a
screwdriver can open up that panel and
jumper out that switch there
so you want to think about things like
that if you have accessibility buttons
right the one on the inside is going to
unlock the door as well same deal that's
going to suppress that alarm
and the fire system for certain types of
installations that must be tied in by
code and so if you can access the fire
system or any of the communications
cables to it you can also cause the door
to unlock and the alarm to be suppressed
and everything needs power of course as
well and so if that gets lost there's
not going to be any call-outs happening
and so we can disable this system by
attacking any of these Comm lines any of
this equipment and the nature of modern
access control is it's very complicated
there's a lot of attack vectors we can
take
so there's one more attack Factor here
for how to get through this door without
tripping that alarm might not be
immediately obvious looking at this
slide well it's something like this
if I can get through that door without
opening it this contact sensor is never
tripped now this looks like a bit of an
extreme contrived example well not so
much in this case if you've got a vent
Lube in the door especially if the
screws are on the unsecure side that's
going to be a way through or a window
that can get smashed and you go through
the window on the door
and of course you can go around the door
entirely right which is why in that
slide from the uh the UFC manual at the
beginning it talks about a complete
perimeter of detection you want to make
sure that any way in is going to be
protected both false ceilings and vents
and and so detecting the entire
perimeter or you can detect the entire
interior that you care about
and detection is only that first step so
you need to detect the entire perimeter
or interior you then need to delay an
intruder after that detection has
happened and you need to delay an
intruder long enough for your response
to arrive and so your response has to
get there before the Intruder has a
chance to do whatever harmful act they
might be planning to do within your
facility
and not only that but your response has
to be with greater force than the
Intruder is coming with right if you
send a single guard and the Intruder
shoots that guard well your response has
now been nullified so that's something
to think about as well
and and so again that's something that's
recognized in the the military Doctrine
is these defense layers right so
familiar for those in cyber security you
want to have multiple layers that need
to be breached with detectors on each so
that first one gets the Intruder
detected and then the next ones provide
delays that give you a response for us
time to get there and time to keep the
Intruder away to protect whatever asset
you're protecting
so this was sort of a whirlwind talk
there's you know every single slide I
presented is a rabbit hole that could be
a presentation on its own I encourage
you to go try it in the physical
security Village next door and I'd be
happy to take any questions on any of
the multitude of things we've scratched
the surface on today thank you very much
folks
[Applause]
hehe
yeah so the question was where is the
security Village it is right next door
in the uh don't remember the room number
but in The Villages area on your program
uh right next door there and you can go
try that out
all right we'll all hang out at the
front if you have any later questions or
if you're just too shy to ask in front
of everyone thank you very much folks
foreign
[Music]