Access Control Vulnerability & Interoperability: Improving the Reader-to-Panel Connection Tony Diodato, CTO Cypress Integration Solutions Access Control Vulnerability & Interoperability 1 Babak Javadi, Director of Research The CORE Group

Prevalent Assumptions – Agree or Disagree? 2 Got vulnerabilities? Access Control Vulnerability & Interoperability Wiegand is inherently secure... so is RS-485 If you have a guy hunkered down in your electrical room with alligator clips on the 485 runs, then you have bigger problems. There’s not enough power in a prox card to be skimmed beyond a few inches. The Cloud is your friend. The IT department has it under control. Wired connections are more secure than wireless.

Where are the vulnerabilities? 3 Got vulnerabilities? Access Control Vulnerability & Interoperability The card? Between card and reader? Panel to console? Console to Cloud? The last few inches of wire? Between reader and panel?

How tough is it to hack a Wiegand connection? 4 Got vulnerabilities? Access Control Vulnerability & Interoperability

So what's vulnerable? All of the above! 5 Got vulnerabilities? Access Control Vulnerability & Interoperability The card? Between card and reader? The last few inches of wire? Between reader and panel? Panel to console? Console to Cloud?

Vulnerable point 1: Card and reader 6 Securing Vulnerabilities with OSDP Access Control Vulnerability & Interoperability 125KHz Marconi One-way conversation MHz HID iClass, MIFARE, DESFire, etc. 2-way conversation (key to securing) Can employ encryption and authentication

Vulnerable Point 2: Reader and panel 7 Securing Vulnerabilities with OSDP Access Control Vulnerability & Interoperability Fuel pump skimmers in the news Gecko Attack side / secure side 2-way conversation Can employ Secure Channel Authentication and encryption Standardization SIA standard (on track for ANSI)

Vulnerability 3: Panel to console 8 Securing Vulnerabilities with OSDP Access Control Vulnerability & Interoperability RS-232 RS-485 Ethernet Wi-Fi USB

Forecast: Cloudy with a chance of extinction 9 Securing Vulnerabilities with OSDP Access Control Vulnerability & Interoperability Substitute the phrase “Other peoples’ computers” for “The Cloud” Panel-to-console Console-to-Cloud

Current installation method overview: Reader to Panel 10 Installation Comparisons: Current Practices v. OSDP Access Control Vulnerability & Interoperability Wiegand Strobed Serial

Current installation method overview: Panel to door 11 Installation Comparisons: Current Practices v. OSDP Access Control Vulnerability & Interoperability Door strike REX Door monitor

Current installation method overview: Wiring 12 Installation Comparisons: Current Practices v. OSDP Access Control Vulnerability & Interoperability 11 wires 500 ft. limit Mixture of 22 to 12 AWG Most are unsupervised

Background on 2-wire protocols and OSDP “Back in my day...” 13 Installation Comparisons: Current Practices v. OSDP Access Control Vulnerability & Interoperability 2-wire protocol (not new) Very proprietary Fairly low speed No intent to be interoperable No progress until 2005, when Mercury Security Corporation and channel partners started work on an open protocol In 2012, Mercury, HID Global (and more recently Codebench, Inc.), assigned OSDP specification to SIA

Background on 2-wire protocols and OSDP 14 Installation Comparisons: Current Practices v. OSDP Access Control Vulnerability & Interoperability Can’t we all just get along? (Standardization) / 30th anniversary of “sun setting on Wiegand” OSDP leadership elicited stakeholder buy-in: Joe/SIA Frank/Mercury Criteria for standard from working group: Low cost of implementation for manufacturer Minimal packet structure Expandable as needed Well-defined security feature

OSDP overview 15 Installation Comparisons: Current Practices v. OSDP Access Control Vulnerability & Interoperability SIA Standard: Open Supervised Device Protocol Current version On ANSI track Open Source Tools Interoperability Currently working on Ethernet version using TLS (ONVIF) Low-cost Minimal feature set

OSDP overview 16 Installation Comparisons: Current Practices v. OSDP Access Control Vulnerability & Interoperability 2-Way Conversation 4 wires (sometimes 2) Fully supervised Authenticated Encrypted Expanded I/O Point-to-point Multi-drop

OSDP installation 17 Installation Comparisons: Current Practices v. OSDP Access Control Vulnerability & Interoperability Control Panel (CP) Master unit Command (poll) Peripheral Device (PD) Slave unit Response Addressable (126 devices) Multiple device types

OSDP installation demo 18 Installation Comparisons: Current Practices v. OSDP Access Control Vulnerability & Interoperability Legacy panel, OSDP reader Wiegand reader port REX, door monitor, tamper Supervision Secure Channel OSDP panel, Wiegand reader/door Signal wires reduced to single pair Supervision Secure Channel New install Panel Reader Door control

How hackable is OSDP? 19 Installation Comparisons: Current Practices v. OSDP Access Control Vulnerability & Interoperability

Review previous assumptions/assessments Thoughts, comments, questions 20 Summary: OSDP v. Wiegand Access Control Vulnerability & Interoperability