lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <5.2.0.9.2.20030126233327.032ca638@mail-dnh.mv.net>
From: brian at pc-radio.com (Brian McWilliams)
Subject: Lock business practices
  "security-by-obscurity" for 150 years

An interesting note by Blaze appeared in RISKS today. He talks about the 
reaction of locksmiths to the NY Times story and the publication of his 
research.

http://catless.ncl.ac.uk/Risks/22.51.html%3E#subj1

Excerpt:

"The existence of this method, and the reaction of the locksmithing
profession to it, strikes me as a classic instance of the complete failure
of the "keep vulnerabilities secret" security model.  I'm told that the
industry has known about this vulnerability and chosen to do nothing -- not
even warn their customers -- for over a century.  Instead it was kept secret
and passed along as folklore, sometimes used as a shortcut for recovering
lost master keys for paying customers.  If at some point in the last hundred
years this method had been documented properly, surely the threat could have
been addressed and lock customers allowed to make informed decisions about
their own security."

Brian

At 10:13 AM 1/23/2003, Richard M. Smith wrote:
>http://www.nytimes.com/2003/01/23/business/23LOCK.html?pagewanted=print&
>position=top
>
>January 23, 2003
>Master Key Copying Revealed
>By JOHN SCHWARTZ
>
>A security researcher has revealed a little-known vulnerability in many
>locks that lets a person create a copy of the master key for an entire
>building by starting with any key from that building.
>
>The researcher, Matt Blaze of AT&T Labs-Research, found the
>vulnerability by applying his area of expertise - the security flaws
>that allow hackers to break into computer networks - to the real-world
>locks and keys that have been used for more than a century in office
>buildings, college campuses and some residential complexes.
>
>....
>
>The technique is not news to locksmiths, said Lloyd Seliber, the head
>instructor of master-key classes for Schlage, a lock company that is
>part of Ingersoll-Rand. He said he even taught the technique, which he
>calls decoding, in his training program for locksmiths.
>
>"This has been true for 150 years," Mr. Seliber said.
>
>Variations on the decoding technique have also been mentioned in passing
>in locksmith trade journals, but usually as a way for locksmiths to
>replace a lost master key and not as a security risk.
>
>....
>
>
>
>
>
>_______________________________________________
>Full-Disclosure - We believe in it.
>Charter: http://lists.netsys.com/full-disclosure-charter.html


Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ