Schneier on Security

Clive Robinson • August 21, 2009 10:12 AM

@ Muffin,

‘”LALALA-I-Can’t-Hear-You” (LICHY) security now?’

Hmm how do you pronounce LICHY?

As in Itchy or the fruit…

More seriously I used to design electronic locks and they are a bit of a problem to design in many ways.

I’ve generaly found that they all sucumb to relativly low level attacks on the mechanics so by and large the electronics can be ignored as “high tech pixi dust” (and offten a simple reverse polarity on the battery disposes of any electronic issues due to protection circuits 😉

Such low level attacks on the mechanics include, magnets freezer spray, good old fashioned grease, or plain old “spin the handle and jerk” attacks (another variety of “bumping” or Newtonian cradle attacks).

However it’s nice to see somebody doing other things to high tech locks 8)

As somebody once put it to me in a jokey Bishops voice,

“My son, put not your faith in that, which others say cannot be broken, for delusion is but one of many grevious human failings”

Clive Robinson • August 21, 2009 1:25 PM

I must admit I’m not that familiar with the locks shown but they appear to be a replacement for a standard mechanical cylinder that you would find in any fairly standard swing door such as those found on shops and office entrances and the slightly more security concious office door.

Let me start by saying if you put your trust in standard cylinder locks then you are setting yourself up for a world of disappointment, as you will see if you bother to take any cylinder lock apart. Put simply they have never been designed with security in mind just reliability.

That is the manufacture has made a simple calculation that locks that bind up in use cost them money and reputation, locks that are bypassed by intruders cost the lock purchasers insurance company money. So reliability in use not security is the key design criteria irrespective of what the marketing blurb might say (and do you really believe that SuperBright laundry powder really will make your grey with age T-Shirt glowing white again?)

That is they have done one of those things Bruce gets hot under the collar about “externalised the risk/cost”

If you read the web page and look for any technical details you will be sorely disappointed there really aren’t any. The closest it comes to is this paragraph,

“The core technology consists of a key that contains mechanical bitting and a processor and battery, which communicates with the microprocessor and sidebar-control motor within the lock. When the proper mechanical and electronic credentials are simultaneously presented to the lock, an internal motor is activated, a rotor turns, and a sidebar is allowed to be pushed into the plug. If the key is properly bitted, then the lock can open.”

To understand what this is saying you need to think about what this sort of lock really is,

“a simple mechanical latch”

Effectively it has three parts,

1, Latch
2, Rotational to linear motion converter
3, A removable handle

The difference between a simple mechanical latch and a lock is the removable handle (the key) is one half of a “security interlock”. When the correct key is presented the interlock is removed and the lock is a simple mechanical latch from that point.

Thus two things become clear, the energy required to open the latch comes from the human holding the key so has very definite limits (for the weak of wrist) the entire security relies on the interlock. Thus if you can bypass or operate the mechanism from “down stream” of the interlock you are in.

The interesting part of the paragraph is this,

“When the proper mechanical and electronic credentials are simultaneously presented to the lock, an internal motor is activated, a rotor turns, and a sidebar is allowed to be pushed into the plug.”

If you read it backwards it becomes clear that you have three things,

1, A conventional mechanical key mechanism
2, An additional electromechanical element (actuator) that locks the key cylinder into the rotary to linear movement converter.
3, A microprocessor that reads a security token on the key and stores it’s ID etc for audit and supplies current to the actuator.

This is where the fun starts, you apparently have,

Two security mechanisms operating in series if either does not work then the lock does not open.

On security mechanism is the mechanical key and cylinder (true).

The other security mechanism is the RFID on the key and cylinder microprocessor (false).

The second security mechanism is actually the sidebar.

So if you can copy the mechanical key or bump it the only other thing you have to do is somehow get the sidebar to work.

Without actually seeing the sidebar design and it’s motor actuator and control electronics I could not specificaly tell you the best method of attack.

But,

1, It might just fall into place if subject to appropriately directed kinetic force (bumping).

2, It might be persuaded to stick by injecting grease into the lock such that the next valid operator causes the sidebar to stick in the active position.

3, Creating an intense magnetic field might either pull it into place or again make it susceptible to sticking the next time a valid user opens the lock.

4, If it is not fully blind to the key way it might be possible to push it back and insert a shim or other small mechanical item to act in it’s place.

5, The design of the cylinder plug and sidebar locking sleeve might be such that the same effect as actuating the sidebar could be achieved with an external mechanical device.

If any of these don’t grab you then you can take one step back and attack the actuator, magnetically electronically or mechanically.

It needs to be said at this point the microprocessor has not played any part in these base level attacks, so unless it has attack sensors (very unlikely) it will not log anything that can be audited at a later date even though a valid mechanical key might have been used and the door opened.

You can take another step back and attack the microprocessor in various ways by injecting out of band signals into it to create faults. One such method is applying an appropriate RF signal of sufficient power to inject a firmware or software fault that might well cause the microprocessor block to fail in useful ways. I won’t go into details as nobody that I know of has published results on this sort of very viable fault injection attack yet and it would easily earn you a PhD (I know Ross Anderson is aware of it as I suggested it as a method to get around his non synchronous logic).

You could take another step back if you where up to analysing the RFID protocols attack the communications link between the token on the key and the microprocessor block in the lock.

But why start at the top when starting at the bottom is going to be oh so much easier.