1. Access Control Vulnerability & Interoperability: Improving the Reader-to-Panel Connection Tony Diodato, CTO Cypress Integration Solutions Access Control Vulnerability & Interoperability 1 Babak Javadi, Director of Research The CORE Group

2. Prevalent Assumptions – Agree or Disagree? 2 Got vulnerabilities? Access Control Vulnerability & Interoperability Wiegand is inherently secure... so is RS-485 If you have a guy hunkered down in your electrical room with alligator clips on the 485 runs, then you have bigger problems. There’s not enough power in a prox card to be skimmed beyond a few inches. The Cloud is your friend. The IT department has it under control. Wired connections are more secure than wireless.

3. Where are the vulnerabilities? 3 Got vulnerabilities? Access Control Vulnerability & Interoperability The card? Between card and reader? Panel to console? Console to Cloud? The last few inches of wire? Between reader and panel?

4. How tough is it to hack a Wiegand connection? 4 Got vulnerabilities? Access Control Vulnerability & Interoperability

5. So what's vulnerable? All of the above! 5 Got vulnerabilities? Access Control Vulnerability & Interoperability The card? Between card and reader? The last few inches of wire? Between reader and panel? Panel to console? Console to Cloud?

6. Vulnerable point 1: Card and reader 6 Securing Vulnerabilities with OSDP Access Control Vulnerability & Interoperability 125KHz Marconi One-way conversation 13.56 MHz HID iClass, MIFARE, DESFire, etc. 2-way conversation (key to securing) Can employ encryption and authentication

7. Vulnerable Point 2: Reader and panel 7 Securing Vulnerabilities with OSDP Access Control Vulnerability & Interoperability Fuel pump skimmers in the news Gecko Attack side / secure side 2-way conversation Can employ Secure Channel Authentication and encryption Standardization SIA standard (on track for ANSI)

8. Vulnerability 3: Panel to console 8 Securing Vulnerabilities with OSDP Access Control Vulnerability & Interoperability RS-232 RS-485 Ethernet Wi-Fi USB

9. Forecast: Cloudy with a chance of extinction 9 Securing Vulnerabilities with OSDP Access Control Vulnerability & Interoperability Substitute the phrase “Other peoples’ computers” for “The Cloud” Panel-to-console Console-to-Cloud

10. Current installation method overview: Reader to Panel 10 Installation Comparisons: Current Practices v. OSDP Access Control Vulnerability & Interoperability Wiegand Strobed Serial

11. Current installation method overview: Panel to door 11 Installation Comparisons: Current Practices v. OSDP Access Control Vulnerability & Interoperability Door strike REX Door monitor

12. Current installation method overview: Wiring 12 Installation Comparisons: Current Practices v. OSDP Access Control Vulnerability & Interoperability 11 wires 500 ft. limit Mixture of 22 to 12 AWG Most are unsupervised

13. Background on 2-wire protocols and OSDP “Back in my day...” 13 Installation Comparisons: Current Practices v. OSDP Access Control Vulnerability & Interoperability 2-wire protocol (not new) Very proprietary Fairly low speed No intent to be interoperable No progress until 2005, when Mercury Security Corporation and channel partners started work on an open protocol In 2012, Mercury, HID Global (and more recently Codebench, Inc.), assigned OSDP specification to SIA

14. Background on 2-wire protocols and OSDP 14 Installation Comparisons: Current Practices v. OSDP Access Control Vulnerability & Interoperability Can’t we all just get along? (Standardization) / 30th anniversary of “sun setting on Wiegand” OSDP leadership elicited stakeholder buy-in: Joe/SIA Frank/Mercury Criteria for standard from working group: Low cost of implementation for manufacturer Minimal packet structure Expandable as needed Well-defined security feature

15. OSDP overview 15 Installation Comparisons: Current Practices v. OSDP Access Control Vulnerability & Interoperability SIA Standard: Open Supervised Device Protocol Current version 2.1.6 On ANSI track Open Source Tools Interoperability Currently working on Ethernet version using TLS (ONVIF) Low-cost Minimal feature set

16. OSDP overview 16 Installation Comparisons: Current Practices v. OSDP Access Control Vulnerability & Interoperability 2-Way Conversation 4 wires (sometimes 2) Fully supervised Authenticated Encrypted Expanded I/O Point-to-point Multi-drop

17. OSDP installation 17 Installation Comparisons: Current Practices v. OSDP Access Control Vulnerability & Interoperability Control Panel (CP) Master unit Command (poll) Peripheral Device (PD) Slave unit Response Addressable (126 devices) Multiple device types

18. OSDP installation demo 18 Installation Comparisons: Current Practices v. OSDP Access Control Vulnerability & Interoperability Legacy panel, OSDP reader Wiegand reader port REX, door monitor, tamper Supervision Secure Channel OSDP panel, Wiegand reader/door Signal wires reduced to single pair Supervision Secure Channel New install Panel Reader Door control

19. How hackable is OSDP? 19 Installation Comparisons: Current Practices v. OSDP Access Control Vulnerability & Interoperability

20. Review previous assumptions/assessments Thoughts, comments, questions 20 Summary: OSDP v. Wiegand Access Control Vulnerability & Interoperability