Exclusive: High-security locks for government and banks hacked by researcher

SAN FRANCISCO (Reuters) – Hackers could crack open high-security electronic locks by monitoring their power, allowing thieves to steal cash in automated teller machines, narcotics in pharmacies and government secrets, according to research to be presented Friday at the annual Def Con hacking conference in Las Vegas.

Mike Davis, a researcher with security firm IOActive, discovered the vulnerability last year and alerted government officials and Swiss company DormaKaba Holding (DOKA.S), the distributor of multiple brands of locks at issue.

In an interview with Reuters, Davis said he used an oscilloscope worth about $5,000 to detect small changes in the power consumption, through what is known as a side-channel attack. The method worked best in older models.

The locks include their own power supply so they function even when an external source of electricity is cut off. Most versions do not consume extra or randomized power to hide what they are doing. That leaves them open to attack if a thief can get physically close enough and has the right tools, Davis said.

“I can download that analog signal and parse through the power trace to get ones and zeroes,” Davis said. “I know what the lock is doing internally.”

DormaKaba said it had looked into the matter itself and also retained an independent firm to probe IOActive’s findings regarding its Cencon and Auditcon locks.

“These investigations indicate that our current safe-lock product lines perform as intended in real life environment,” said company senior vice president Jim Mills.

Asked whether older models were also secure, a company spokesman said “there have been no reported events in the field to suggest that current or prior year models have presented security issues in real-world environments.”

Inside ATMs, the company’s locks typically protect the cash in the more secure, lower compartment. An upper compartment includes the interface with customers and directs the lower compartment to send up money. The upper compartment often has less physical security, and breaking into it might provide access to the lower vault’s vulnerable lock.

Davis only tested his attack against the simplest mode of the device. When they are actually in the field, the locks typically interact with another device carried by drivers who supply or remove cash, and they may require one-time codes as well. Such measures provided some added security, Davis said.

A bigger concern is that another series of DormaKaba locks are used on military bases, U.S. presidential jet Air Force One and elsewhere in the government.

Davis said he found that several newer models but not the most recent iteration of that series, the X-10, leaked voltage information that could be used against them. The improvement was not due to IOActive’s research, said DormaKaba spokesman Joe Hudock.

Eric Elkins, president of subsidiary and X-10 maker Kaba Mas, said he could not comment on the severity of the issue without seeing Davis’ presentation. Elkins said that if it works, the attack might put classified information at risk. He questioned why Davis was presenting his research at Def Con.

“The correct method would be to go the government rather than to go to a group of hobbyists or hackers or whatever you want to call them.”

A spokeswoman for the federal General Services Administration, Pamela Pennington, said government employees had been working to understand the side-channel attack and develop a work-around to foil real attacks.

“We are aware of this security issue as it relates to the U.S. government and have developed and deployed mitigation techniques in the federal environment,” Pennington said. “The federal government uses multiple layers of security.”

She declined to describe the steps taken.

Reporting by Joseph Menn; editing by Greg Mitchell and David Gregorio

Source link

more recommended stories

  • France delays signing of Internet pledge amid U.S. pressure

    BIARRITZ, France (Reuters) – France delayed.

  • Trump says U.S. would tax French wine in response to digital tax

    U.S. President Donald Trump speaks with.

  • App looks to get tips from coffee drinkers to Colombia growers

    BOGOTA (Reuters) – An app that.

  • U.S. House lawmakers ask regulators to scrutinize bank cloud providers

    WASHINGTON (Reuters) – Two U.S. lawmakers.

  • VMware to pay $5 billion for firms offering cloud security, developers platform

    (Reuters) – VMware Inc said on.

  • Volkswagen not interested in buying Tesla stake

    FILE PHOTO: Volkswagen AG CEO Dr..

  • Splunk to buy cloud software firm SignalFx in $1 billion deal

    (Reuters) – Data analytics software maker.

  • Ahead of G7 summit, Macron presses U.S. to help reform taxes on big tech

    FILE PHOTO: French President Emmanuel Macron.

  • Citigroup, BNP caught up in U.S. case against Huawei CFO: documents

    NEW YORK (Reuters) – U.S.-based Citigroup.

  • Intel unveils first artificial intelligence chip Springhill

    FILE PHOTO: Computer chip maker Intel’s.

  • Chinese smartphone maker Xiaomi posts 15% rise in sales, misses estimates

    FILE PHOTO: Xiaomi branding is seen.

  • Sony to buy ‘Spider-Man’ developer Insomniac Games

    FILE PHOTO: The logo of Sony.

  • U.S. grants Huawei another 90 days to buy from American suppliers

    WASHINGTON (Reuters) – The United States.

  • Shell debuts electric vehicle chargers in Singapore, first in Southeast Asia

    FILE PHOTO – A sign is.

  • Exclusive: U.S. set to give Huawei another 90 days to buy from American suppliers – sources

    SINGAPORE/WASHINGTON (Reuters) – The U.S. Commerce.

  • Alibaba and the $15 billion question: Amid Hong Kong’s protests, when to list?

    HONG KONG (Reuters) – Hong Kong’s.

  • Exclusive: U.S. to extend Huawei’s partial reprieve on supply curbs – sources

    SINGAPORE/WASHINGTON (Reuters) – The U.S. Commerce.

  • China’s Ninebot unveils scooters that drive themselves to charging stations

    BEIJING/HONG KONG (Reuters) – Segway-Ninebot Group,.

  • Amazon.com defeats IRS appeal in U.S. tax dispute

    (Reuters) – Amazon.com Inc on Friday.

  • Rental firm walks away from Tesla order after quality dispute

    FRANKFURT (Reuters) – Car rental company.

  • STAR Market tech board offers hope to Chinese venture capitalists

    SHANGHAI/HONG KONG (Reuters) – When Chinese.

  • Nvidia revenue tops expectations on strength in video gaming, auto units

    (Reuters) – Nvidia Corp’s quarterly revenue.

  • Online spending helps UK retail sales grow unexpectedly in July

    LONDON (Reuters) – British retail sales.

  • China’s Lenovo first-quarter profit more than doubles on record PC market share

    (Reuters) – Chinese PC maker Lenovo.

  • FCC chairman circulates order to approve Sprint, T-Mobile tie-up

    FILE PHOTO: A smartphone with Sprint.

  • U.S. aviation regulator bans select MacBook Pro laptops from flights

    FILE PHOTO: Apple company logos are.

  • Facebook paid contractors to transcribe users’ audio: Bloomberg

    FILE PHOTO: Attendees walk past a.

  • Exclusive: Google’s jobs search draws antitrust complaints from rivals

    BRUSSELS/SAN FRANCISCO (Reuters) – Google’s fast-growing.

  • Colombia fines Uber more than $629,000 for obstructing regulatory visit

    BOGOTA (Reuters) – Colombia’s commerce regulator.

  • Deliveroo quits Germany to focus on other markets

    FILE PHOTO: A biker wearing a.

  • Russia tells Google not to advertise ‘illegal’ events after election protests

    MOSCOW (Reuters) – Russia’s state communications.

  • Tesla electric car catches fire after hitting tow truck in Moscow

    Joe Young, media relations associate for.