1

It's known that card readers, which use the Wiegand format, can be attacked by installing a sniffer, such as an ESPKey. After the sniffer is installed, whenever anyone uses the reader, their credentials get saved, and the attacker can clone them.

What is the defense against this? The article mentions that card readers have a tamper sensor. Is a correctly installed tamper sensor enough to thwart this attack? What exactly does the tamper sensor do, and what happens when it's set off?

Also, since ESPKey attacks specifically target the interceptable wiegand protocol, is there some other protocol which provides secure communications? Many articles cite Wiegand as being the most common protocol. What percentage of card readers are vulnerable to this attack, and what's the next most common non-vulnerable protocol?

3 Answers 3

2

On the topic of tamper sensors

The tamper sensor built into an average card reader is a simple mechanical device intended to identify when the reader has been removed from the wall. Much like a seatbelt, a tamper sensor is useless if it isn't used properly. When installed according to manufacturer recommendations and connected to an alarm monitoring system, then a tamper trigger could be handled in any number of different ways. Any action from adding a log entry that nobody ever sees, sounding a buzzer or alarm to dispatching an armed guard response, are all possible. Sadly, most card access systems I have audited don't connect the tamper switches to anything at all.

When tamper sensors are installed correctly and monitored AND the system does something useful with that data, they can still be defeated. Understanding how the sensor works for the card reader in front of you is the key. Limit switches (use a rigid object to maintain compression of switch), optical proximity sensors (insert reflective material between sensor and mounting plate), magnetic reed switches (hold external magnet near sensor) all have fairly straightforward weaknesses that can be exploited to remove the reader from the wall and gain access to the wiring without setting off alarms. Even more obscure pin switches, tilt sensors, gyros and accelerometers have sensitivity vulnerabilities too. In my experience, no tamper sensor is foolproof.

A monitored tamper sensor response may not be adequate for preventing sniffer installation. If it takes 3 minutes for guards to respond but the ESPKey can be installed in under 1 minute, guards may arrive too late. Once at the reader, an average responder may assume there was a false alarm and walk away from a hidden sniffer. Heck, they might even give you your first card swipe because they want to see that the reader is functioning normally. If there aren't multiple camera angles of the reader, blocking the camera while installing a sniffer is not hard.

Even if your response time to a perfectly installed tamper sensor is faster than it would take to install a sniffer, a flawless tamper sensor only indicates that the reader is on the mounting bracket. Where the reader is doesn't matter if the unencrypted communication wires are exposed. Once inside the wall, those wires go somewhere. Protocol sniffers like the ESPKey don't need to be installed at the reader. They can be spliced in anywhere between the reader and the controller. Ex: A reader for getting into a parking garage will likely be fed by conduit you can visually follow to a junction/pull box that can be opened with a screwdriver. Installing an ESPKey in a junction box is the same process as behind the reader.

Conclusion: tamper sensors are a very thin layer of the facility security onion.

On the topic of Wiegand security

The Wiegand protocol does not provide confidentiality or authenticity. In other words, anyone can listen in or transmit with assumed authority. OSDP is the new hotness with options for encryption. Yes, you will still have to do work in order to implement it correctly. Some vendor implementations of OSDP do not enable encryption by default. Similarly, using default secrets would be like leaving a candy jar full of working keys by your locked door. Do your vendor-specific research and hire an experienced consultant to work with you on system design. OSDP sits on top of the RS-485 protocol so it can certainly be sniffed with inexpensive tools. When properly configured with AES-128 enabled, any sniffed data should represent a significant puzzle to adversaries. Super computers chipping away at this puzzle until the heat-death of the universe sounds way better than the Wiegand in-the-clear situation most sites have now.

What can you do?

Armour the heck out of card readers, communication wires, door controllers and management interfaces. If your wiring closet door latch can be slipped/loided by someone on their way to the bathroom, it won't matter how sturdy the reader enclosures are or what encryption is used.

Connect tamper sensors to something meaningful and train your staff on appropriate response. When possible, install custom tamper sensors that adversaries can't practice bypassing by buying the same model reader. If you disable power to a tampered reader, staff will not be able to inadvertently feed a sniffer. Get a technician to inspect the tampered reader before reactivating power.

Use OSDP. Say no to default keys. Yes it is expensive to replace all of your readers and door controllers. Do it. Wiegand is about like shouting your password into a public telephone—there are no secrets this way. You don't want your bank credentials going over unencrypted HTTP. And you don't want your bank servers located in a datacenter where the doors can be opened by anyone listening to the wire when an authorized person entered.

3
  • 1
    Welcome to the Security Stack Exchange! I think this is an awesome answer. Super informative, thanks for sharing your knowledge! On the topic of sharing, do you have any links we can check out for further reading on anything mentioned? Commented Jan 4, 2022 at 7:22
  • 2
    Thanks @securityOrange! I added a few links to define some terms and show a couple demos. Unfortunately, I don't have any favorite links for further reading about Weigand security. This sort of info is much more available in the form of classroom time, offered by a number of red-team training companies at a significant premium.
    – Kenny
    Commented Jan 5, 2022 at 11:59
  • Agreed, it's rare to find such a comprehensive and informative answer. Thank you so much! Commented May 25, 2022 at 14:25
0

After doing some more research, as far as I could tell, this is how it works:

The tamper sensor is either a light sensor or a physical switch. If an attacker dismounts the reader from the wall, the sensor gets tripped and an alarm signal is sent down the wire to the controller. I have not researched what exactly the controller does with that alarm signal.

It seems like this sensor is not always installed by default. Example from HID manual:

All readers utilizing a physical tamper switch have tamper enabled automatically. By default, readers utilizing an optical switch do not come with tamper enabled.

The ESPkey manual states that the installation of such tamper sensors is "rare":

While rare, most modern readers have hardware support for a “tamper detection” feature of some kind. If such sensor is wired to the control panel for monitoring, it must be mitigated during ESPKey deployment to prevent detection of the field operator.

0

Wiegand by itself is insecure. Modern systems can use communication that is secure. For example OSDP or other (proprietary) communication protocols. These are able to prevent MITM attacks by enforcing TLS communication or some sort of key exchange between card reader and door controller.

The problem lies in the fact that companies need to invest in such products. Since they might have existing wiegand readers, they may choose to keep those even when replacing their access control system/software.

The tamper is also not always a solution since it needs to be configured and monitored correctly.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .