The Red Tiger Security team has been doing a lot of red team exercises recently involving physically breaching critical infrastructure facilities. These exercises expose gaps in security, since we test not only the cyber security systems, but we a holistic all-hazards approach to test all of the various methods that attackers use to gain access:
We are allowed to utilize both cyber and physical penetration techniques to gain access to sensitive computer networks. What we are finding is that often the cyber and physical security defensive systems are often not aligned or linked in any way. These two organizations often do not even report up to the same management team, so this creates the situation where the “left hand does not know what the right hand is doing.” In one of our recent projects, we were able to leverage RFID technology to physically walk into very sensitive data centers, corporate offices, industrial sites, and engineering labs. Physical access allowed our team to directly connect our laptops to computer networks that would normally be behind firewalls. Physical access trumps all investments in cyber security, and thus proves that physical security is just as important as cyber security.
For this reason, we decided to dedicate this month’s technical briefing to RFID (Radio Frequency Identification) technology. This is not new technology, and it first appeared in 1945 – designed out of the Soviet Union to be used for espionage. RFID implementations come in a few different forms. Electronic Product Code tags are stickers that contain a small capsule about the size of a grain of rice, and typically used in retail stores for loss prevention. RFID is used for tracking animals, so the owner of a lost pet can be contacted. It is also used in release of a saved animal back into the wild. Automated Toll Booths also read RFID tags on the window shields of passing cars for automated toll payment. RFID tags can be passive or active, and while all can be remotely read, many allow you to write back to the RFID device. The largest use for this technology is for card access thru doors or to limit access to certain areas, which brings us back around for the reason why we are discussing this topic.
RFID systems used for physical access control can be hacked in a few different ways. Physical access control or “card access” systems contain a centralized database of active badges or cards, scanners installed throughout the various buildings, and the physical cards, badges, or key fobs that are activated and assigned to individual workers. Often the card access database systems are directly connected to the corporate network, with remote access for maintenance. By hacking into the card access software program, an attacker can initialize a new badge, change the areas that a badge has access too, or delete existing users causing a range of problems for the target site. The RFID data is often sent or routed in clear text, so by connecting a network sniffer to the areas where the sensors are mounted, an attacker can intercept or sniff valid RFID traffic and parse valid RFID data out of the traffic. This is often difficult because the scanners may not be using Ethernet based communications and may be using a serial bus to communicate back to the centralized database. The above two methods attack vulnerabilities in the centralized RFID database and sensors, but a much easier way to attack the system is by cloning a valid RFID badge, which does not require any access to the centralized database or the building sensors.
Unfortunately, there is not much that can be done to defend against these RFID attacks. Some have advocated placing RFID badges or cards into metallic or shielding wallets to protect against RFID information leakage, but in tests none of these sleeves or wallets show 100% working protection unless you use a very inconvenient protective band or wrap it in tinfoil. Requiring a photo ID in addition to an active badge provides a second visual check. This could make it more difficult for the attacker, since the name on the cloned RFID cards would have to be changed when written back to the blank RFID. Unfortunately, in our own red team exercises, we have found that social engineering tricks like tail gating and following people into elevators, locked floors, and even sensitive rooms like data centers still works, and does not even require a working badge. In the last ten red team exercises that our team has performed, we were able to gain physical access to a live network port behind the firewall without any active RFID badges. In several cases, we used a camera to take a photo of an existing contractor or employee badge, and then using parts obtained from an Office Depot store, we were able to build a fake badge using simple office supplies for less then $10 USD.
Employee awareness and training is still the best defense against physical and social engineering tricks, so please pass along the link to this briefing to those that might benefit from this information. We also offer multiple training solutions ranging from a 1-day seminar or workshop to a full 5-day boot camp.
Thanks!
Ryan Salsbury and Jonathan Pollet
