Seeing lots of stuff swirling around about the hack of the secure keys in HID readers. It's an impressive feat by the researchers, they destroyed several readers in the process of refining their attack and getting into the chips.
A few things worth pointing out:
1) This is kind of a "yeah, no shit" exploit. It has long been understood that physical access to a device all but guarantees an eventual exploit by a dedicated and knowledgeable team.
2) The researchers have not disclosed or publicized the keys (at least so far, and it seems unlikely). So the net threat level to users with these readers is about the same as it was before. The keys *can* be extracted with enough effort, but that as already a given (see #1 above).
3) For attackers wanting to gain physical access to a property secured by these devices the odds are they would use older, and easier, proven methods that require nothing fancy: tailgating, social engineering, stealing (vs cloning) an employees credential, etc.
4) This risk can be essentially circumvented by using custom encryption keys, which HID supports, but frankly does not make it easy enough for customers to implement without additional costs.
5) Even if the keys are leaked, that alone does not give an attacker immediate access to a facility. They would still need to know, clone, or guess an existing valid credential ID in order to make a duplicate to gain access.
In short, I think this exploit showcases a common issue we see in physical security, which is that customers are not willing or motivated enough to spend more money to get proportionally better security. "Good enough" is often, well, good enough.
Some things you can do, which are general best practices:
1) Educate employees on risks of tailgating, social engineering, and other more common attack vectors.
2) Maintain and monitor access logs/credential uses to spot anomalous behavior.
3) Implement Badge In/Badge Out policies to reduce the chance that a cloned credential can be easily used.
4) Add video coverage to all ingress points to maintain visual access log data.
5) Consider two-factor methods like Badge + PIN.
6) Consider harder to clone credentials, primarily ones based on standard mobile wallets
7) Consider biometric credentials.
Please comment on any other ideas you have about balancing security with the realities of the market.
