Subscribe to

Blogs

Onity responds to hacker's claim that its locks are vulnerable

 - 
Wednesday, August 8, 2012

Remember Cody Brocious? He's the Mozilla software developer who presented research last month at the Black Hat security conference about an alleged vulnerability on a certain type of Onity lock used on hotel room doors around the world? (If not, the quick recap: Brocious claims to have developed an open-source piece of hardware that can be plugged into a lock's DC port, read its memory and open the door.)

Well, Onity has responded to Brocious's claims in a statement sent to Security Director News: "At the Black Hat conference on Tuesday July 24, a hacker presented alleged vulnerabilities of certain models of Onity hotel locks," the statement begins.

"Onity understands the hacking methods to be unreliable, and complex to implement."

It's true Brocious's method is unreliable. He admits it. In a demo for Forbes magazine, he only got one out of three doors to open using his hack. In an interview with SC Magazine (embedded below) that it was because of a bug in the implementation, and a problem he has no plans to fix for reasons of safety.

However, the last part of Onity's statement directly contradicts what Brocious claims. "It would be a matter of minutes to put this together from parts you can get off the internet or from RadioShack," Brocious said the interview.

Onity's statement continues, seeming to admit that a vulnerability exists, though in the guise of just placating fears: "However, to alleviate any concerns, we are developing a firmware upgrade for the affected lock-type. The upgrade will be made available after thorough testing to address any potential security concerns that you may have. Onity places the highest priority on the safety and security provided by its products."

They better get on it. Brocious claimed he held nothing back in the research he revealed to the public, so if he's right people could be developing these little devices for nefarious purposes right now. "At the end of the day, I felt getting the information out there was valuable," he said in the SC Magazine interview. "We will most likely see in-the-wild attacks, as sad as that is. We will see people using this for malicious purposes."

Here's the interview with SC Magazine:

Help us understand the needs of security professionals and take this survey

 - 
Monday, August 6, 2012

We need your help.

Security Director News is collaborating with IMS Research, recently acquired by IHS, on an end-user-focused survey on the use of physical security equipment.

Not only will the survey's results shed light on the end-user experience when it comes to using physical security equipment, it will also help SDN better tailor its reporting and analysis to the needs of its readership.

If helping the security profession better understand its needs is not incentive enough to complete the survey, IMS Research is also offering the first 100 respondents a $10 Amazon voucher or, alternatively, a $10 donation to your choice of charity.

Please take the survey.

 

The Opinion is Dead, Long Live the Opinion…

 - 
Friday, August 3, 2012
By Jeffrey Grossmann
Program Director, Homeland and Corporate Security Studies, St. John’s University, Queens, N.Y.

 

Editor's Note: The following is Jeffrey Grossmann's response to comments made by Tsung Y. (Bill) Soo Hoo, a faculty member in New Jersey City University's security studies department, concerning the July 30 article "Doctor of Security," which was about NJCU's new doctorate program in security studies and included quotes by Grossmann. Bill Soo Hoo commented using the name TYBill.

Reading the comments posted by TYBill regarding the July 30, 2012, article “Doctor of Security” reminds me of a bad television police docudrama where the hero agent has a sarcastic and condescending (yet funny) retort for every statement the suspect gives. In fact, those comments posted by TYBill do not appear to be typical opinion-based responses, rather, an underhanded attack on the veracity of a source. But I get ahead of myself…

Introductions are in order. My name is Jeffrey P. Grossmann (Grossmann spelled with a double “n” TYBill). I am an Assistant Professor and Program Director of Homeland and Corporate Security Studies at St. John’s University in Queens, New York. I have helped develop and continue to drive the Homeland and Corporate Security Program at St. John’s. I am the 2011-2012 Chair of the Academic and Training Programs Council of ASIS International (a highly regarded group of academic professionals dedicated to the betterment of security education). I maintain an education-based consulting practice where I work with the American Council on Education and the Department of Defense awarding academic credit to training programs throughout our armed forces (something as a veteran I am so proud to do). I have helped colleges and universities in the creation of their own homeland security programs. I have conducted research, been invited to speak at numerous security conferences, and continue to publish articles on both homeland security and generic security academic programs. In short TYBill (I use your screen name since you have chosen to remain anonymous), I have sufficient experience in this field to give an informed opinion on the creation of a security-themed academic program, regardless of your attack on my credibility.

You have taken offense to a few generalized comments regarding the state of homeland security and generic security education. My comments were aimed at providing some background to the world we both work in. I did not reference your program. In fact, I refuse to make public comments on any academic program, not just yours. My comments focused on the central issues confronting our industry (subject matter, accreditation, and the need for doctoral programs). You could even say that I included my own program in those generalized remarks concerning our industry.  

When I address an opinion in which I disagree (and there are a few), I try very hard not to attack the source of thought. In fact as an educator, I owe a duty to my students (and the industry) to help nurture and develop these young thought mechanisms. These opinions or thoughts will develop into ideas, ideas in which problems will be solved, innovative processes will be developed, and goals will be achieved. Yes TYBill, I do not necessarily agree with your remarks, however, I can appreciate your point of view. I will not call your comments “perplexing” or question your loyalty as you did with me, for I understand why someone so close to a cause would react the way you did to generalized criticism.

The truth of the matter is that our industry is growing. It is still in its infancy, especially homeland security education, when compared to similar academic disciplines such as criminal justice. There are legitimate questions which need to be answered. In particular, there are no formalized data sets showing the need for the creation of doctoral programs in the generic security industry at this time (none that I have encountered). You suggest that we create these programs in advance of such need. In fact TYBill, you went on to compare the development of a national homeland security program in response to the devastating terrorist attacks of 9/11, to the creation of educational programs. You made an off-handed and semi-patriotic point that since the government did not wait to address the terrorists attacks of 9/11 (and rightfully so), so too should your organization not wait to develop a doctoral program (not rightfully so). The Office of Homeland Security was established in mere weeks after 9/11/01 to address an “obvious” need. TYBill, instead of attacking opinion, make an argument for an “obvious” need in relation to the creation of a doctoral program in generic security studies. Do not insinuate that I should “rubber-stamp” approval of such an academic endeavor because of my standing in a professional association. Instead, explain how such a program will enhance my profession at this time. Refrain from making patriotic comparisons and concentrate on legitimate comparisons with other programs in similar disciplines.

TYBill, I am sure you did a wonderful job in the creation of your program. You should even be commended for completing such an arduous task. Please do not diminish your significant accomplishments by “bullying” folks who have legitimate questions. After all, isn’t that what makes this country so great, freedom of opinion?

-Jeffrey P. Grossmann, JD

Dispatch from NCS4: Managing spectator violence

 - 
Tuesday, July 31, 2012

I'm in New Orleans for the 3rd Annual National Sports Safety & Security Conference and Exhibition.

The three-day conference, organized by the National Center for Spectator Sports Safety and Security (NCS4) at the University of Southern Mississippi, attracted roughly 400 people this year, a slight increase from last year's numbers, Lou Marciani, NCS4's director, told me. There are also 53 exhibitors, from camera manufacturers to companies offering incident management systems.

The major panel discussion of the day tackled the issue of spectator violence, its causes and what methods are being applied to combat it.

The panel included several security professionals involved in the sports world, including Jeff Miller, the NFL's chief of security; Evan Dabby, senior director of operations for Major League Soccer (MLS); Jim Mercurio, VP of stadium operations and security for the San Francisco 49ers; and Paul Denton, police chief at Ohio State University.

Some of the causes of spectator violence discussed were not a surprise. Alcohol is a major one. Another is team rivalries and gang activity in certain scenarios and in certain cities. But a few causes not often considered were also on the table for discussion.

Nelson Rodriguez, executive vice president of competition for MLS, took a few contrarian viewpoints. He argued that two other factors contribute to fan disruptions and violence. One is the rising cost of tickets, which he said creates an environment were fans feel entitled to do anything they want "because they paid a pretty penny" to be there. The second are attempts to segregate fans of rival teams, which he said perpetuates an us-versus-them mentality, rather than integrating them. In Europe, where soccer is much more popular than it is in this country, all the stadiums segregate fans. That method is beginning to be implemented in some new U.S. stadiums, such as PPL Park in Chester, Pa., where fans of the MLS team Philadelphia Union have their own entrance and seating section. "I wonder if by segregating them we're not creating the gang mentality," Rodriguez said.

However, on that latter point, Rodriguez joked there isn't much debate within MLS on the issue because he seems to be the only who holds that opinion.

Miller from the NFL also mentioned that bad behavior on the part of players can contribute to fans believing that anything goes and disruptive behavior will be tolerated.

As for solutions, Miller discussed what the NFL has done to combat spectator violence, including being proactive about enforcing a fan code of conduct, which he helped develop when he joined the league in 2008. That means anyone caught breaking the code could be ejected. In some cases, those ejected are asked to take an online course to regain future entry. The class is designed to educate fans about what they can and can't do when they're in the stadium. The fan isn't forced to take the online course, but if they don't and are caught in the stadium again they could be arrested for trespassing.

Miller also said he's a big fan of the "broken windows" theory and that security professionals have to go after the little things, whether that's deploying recycling teams to encourage tailgaters to recycle their empty cans and bottles rather than leaving them in the parking lot or targeting public urination. "You have to be relentless," he said. "If you do that, by the end of the year you'll have changed behavior."

And, obviously, alcohol management is an important factor. Miller spoke to the fact that NFL stadiums have limits on the number of beers one person can buy at a time (it's two) and that all vendors are trained to see red flags and not over serve fans. NFL stadiums also cut off alcohol sales before the end of the game, sometimes during the third quarter or even during halftime depending on the situation in the crowd. At one Jets game, they didn't sell any alcohol, Miller said. That is evidence the NFL takes fan safety seriously. "If it was all about revenue the NFL would never cut alcohol sales, ever," Miller said.

Mercurio at the 49ers discussed how last year they began limiting the hours that fans could tailgate, cutting it off when the games start, and being more diligent in barring entry to people who are obviously drunk. (Some of those changes were implemented last year after the 49ers were in the headlines when two fans were shot and another badly beaten after a game against its rivals, the Oakland Raiders.)

Being proactive and working with local law enforcement is also important. Mercurio told one story about last January's NFC Championship game between the 49ers and the New York Giants, which took place in San Francisco. The police chief decided to put undercover police officers in Giants jerseys during the game, then decided to publicize that fact. Mercurio at first questioned whether publicizing that was a good idea, but he had no idea how powerful a deterrent it was that fans thought everyone in a Giants jersey was a police officer. "We will be doing that throughout the season as one of the standing operating procedures," Mercurio said.

As a result of the NFL's crackdown on fan disruptions and proactive stance to stemming problems before they grow out of hand, arrests at NFL stadiums are down 23 percent league-wide since 2008, Miller said. Ejections are up slightly, but that's because more troublemakers are being caught before doing something illegal.

Fan engagement should be part of any stadium security plan, according to Dabby from MLS. In MLS, some of the fan groups are well organized and have a hierarchical structure, which makes Dabby's job easier because he can communicate with the heads of the fan groups, some of which have their own security, something Dabby called "soft policing." Another thing MLS does is use what are called "stewards," Rodriguez said. They are like security, but also work to improve the fan experience. In some cases, these "stewards" travel with the team to away games and patrol within their fan sections. The idea being that they will be a familiar face and they'll also know the potential troublemakers in the crowd.

These MLS fan groups also have certain "carrots," Dabby said, such as the ability to wave large flags, that they don't want taken away. As a result, the fans themselves have been very helpful in rooting out troublemakers within their midsts.

No matter the sport, the fan experience should always be a factor in a security professionals reasoning when developing a security plan, Miller said. Despite security's primary task of keeping fans safe and venues secure, it should also work to contribute to the fan experience when it can. "We as security can't be seen as obstructionists," he said.

Stay tuned for more coverage from NCS4's 3rd Annual National Sports Safety & Security Conference and Exhibition.

Topic: 

Hotel room doors may be less secure than you thought

 - 
Sunday, July 29, 2012

If you're a hotel security professional, you may want to take a look at the research one hacker presented at last week's Black Hat security conference in Las Vegas. If you're anyone who stays in hotels, it will probably interest you as well.

Cody Brocious, a Mozilla software developer and security researcher, presented a paper at the conference on the vulnerabilities of the Onity HT lock system, which he claims is installed on about 10 million hotel guest room doors worldwide.

In the paper, Brocious claims the locks are "insecure by design" and exposes a number of what he calls "critical, unpatchable vulnerabilities."

The security hole Brocious was able to exploit is the DC port that exists at the bottom of the locks, which with the right device and a simple piece of open-source software offers access to the lock's memory. Brocious can plug his device, which he built for less than $50, into an Onity HT lock and, most of the time, gain access to the room, according to Forbes. Brocious claims it's not 100 percent reliable at the moment, but it's only a matter of time before he successfully tweaks his software to increase its success rate.

His paper is not an easy read, geared toward an audience of hackers, computer programmers and cryptographers. It even includes the software program that would allow such a device to pick the Onity HT locks. The Forbes article is much more accessible to the non-programmer reader.

Though he presented his research last week, Brocious's hack is not news to everyone. According to Forbes, Brocious's former employer, a startup that tried to re-engineer Onity's hotel front desk system and develop a cheaper alternative, sold the intellectual property behind his hack to the Locksmith Institute last year for $20,000. “With how stupidly simple this is, it wouldn’t surprise me if a thousand other people have found this same vulnerability and sold it to other governments,” Brocious told Forbes. “An intern at the NSA could find this in five minutes.”

Next time I'm at a hotel I'll be sure to run my fingers underneath the door lock and feel for a DC port.

 

Are you surprised gun sales have risen in Colorado? I'm not.

 - 
Wednesday, July 25, 2012

Gun sales in Colorado spiked in the days immediately following the mass shooting at a movie theater in Aurora, according to Associated Press.

Colorado approved background checks for 2,887 people who wanted to purchase a firearm during the three days (Fri.-Sun.) following the shooting, the AP reported. That is "25 percent more than the average Friday to Sunday period in 2012 and 43 percent more than the same interval the week prior."

While a spike in gun sales makes for a great headline, I'm not surprised.

Any time a mass shooting occurs, two things are going on that influence this consumer behavior.

First, politicians start talking about the need to tighten gun-control laws and/or ban guns outright. Anyone who believes in the Second Amendment will view that dialogue with indignation and rush out to buy the guns before the politicians take them away.

The second thing going on is people feel unsafe. Any act of terrorism will have that effect, and people are buying more guns to protect themselves now that even going to the movie theater can turn into a shootout (depending on your view of guns, you'll think that reasoning is either true or paradoxical).

The AP spoke with one gun dealer in Arvada, Colo. Dick Rutan, owner of Gunners Den, said inquiries about his concealed-weapon training certification "are off the hook." He continued: "What they're saying is: They want to have a chance. They want to have the ability to protect themselves and their families if they are in a situation like what happened in the movie theater."

Gun debate will continue, but it doesn't appear there's much political will to do anything about tighter restrictions.

One security professional I spoke with on Monday about the effects the event will have on movie theater security believes that guns shouldn't be the focus in the aftermath of this event. Jeff Slotnick, president of the security consulting firm Setracon Inc. and chairman of ASIS International's Physical Security Council (he's also both CPP & PSP certified), said the blame for this tragedy should not be placed on the weapon of choice. The suspect could have used a bomb, or grenades, or pistols.

Slotnick believes these types of events speak more to a failure of the country's mental health system, as well as lapses in basic physical security procedures and emergency preparedness training of employees and normal citizens. Those are the topics we should focus on following an event like this, and the initiatives that have the best chance of preventing future tragedies like this.

What do you think?

Prank to ignore or more evidence of weak aviation security?

 - 
Monday, July 23, 2012

Last week, six sewing needles were found in turkey sandwiches served to business-class passengers on six Delta flights from Amsterdam to four U.S. cities.

Some look at the event as the prank of a disgruntled employee that reveals how even competent security systems can fail every once in a while, but others are using the news as more fodder to argue that the largest hole in aviation security remains that surrounding the catering companies that service the airlines.

It was Gate Gourmet, one of the world's largest airline catering companies, that provided the turkey sandwiches with extra needle. This isn't the first time Gate Gourmet has been the focus of security concerns.

The troubling event reminds me of the story last October that broke when a Gate Gourmet employee at Atlanta's Hartsfield-Jackson International Airport blew the whistle on what he said was weak security at the caterer. The anonymous whistleblower took a video that shows several security lapses, including one segment that shows him accessing a catering cart that should be securely locked because it is destined for a future flight. In the video, he places an unauthorized orange juice container into one of the carts. "If I were some crazy lunatic, or Osama bin Laden sympathizer, I can come in and put anything on this plane," the whistleblower told Atlanta's Channel 2 news team at the time.

I could easily see another Gate Gourment employee sticking needles into sandwiches sitting on these carts, or even in the kitchen where they were made.

The Transportation Security Administration won't release specifics about the needle case as it's an ongoing investigation, but did say that the event does not represent a threat to national security.

Man arrested in Maine with arsenal says he brought a loaded gun to a Batman screening

 - 
Monday, July 23, 2012

It didn't take long for some people to jump on the crazy train that began its journey in a theater in Colorado when a lone gunman shot and killed 12 people and injured 58 others at a midnight screening of the new Batman movie.

On Sunday morning, just two days after the "Batman" massacre, a Maine State Police trooper pulled over 49-year-old Timothy Courtois going 112 m.p.h. on the Maine Turnpike, according to the Portland Press Herald.

Police found an arsenal in the car, including an assault rifle, four handguns and several boxes of ammunition, the newspaper reported (they later found an even larger arsenal in his home).

Courtois told police he was on is way to shoot a former employer in New Hampshire and that he had brought a loaded handgun into a recent screening of the new Batman movie. The Press Herald didn't mention if his claim could be confirmed, but in apparent support of it, police found several newspaper clippings about the "Batman" massacre in his car.

Another eerie aspect is that Courtois was driving a brand new 2013 Ford Mustang and called it his concept car, according to the newspaper, and planned to install a dashboard camera and police scanner. I can't help compare a black mustang to the Batmobile.

This man was caught because normal people were vigilant and reported his speeding to the police.

It's that kind of awareness that Jeff Slotnick, president of the security consulting firm Setracon Inc. and chairman of ASIS International's Physical Security Council, told me was sorely needed to prevent more massacres like the one that took place in that Colorado theater.

Slotnick spoke with me for a recent article I wrote about the aftermath of the attack. "We don't pay attention in our society," he said. "I think it's very important that we start paying attention, that we start being good citizens, that we start taking responsibility for not just our safety, but the safety of our neighbors."

Following the Colorado movie-theater massacre

 - 
Friday, July 20, 2012

The headlines this morning are dominated by news of the movie-theater massacre that took place very early this morning in the Denver suburb of Aurora, Colo. Here's a roundup of news and analysis about the event:

A 24-year-old lone gunman identified by police as James Holmes, a white male, burst into a midnight screening of the new Batman flick, "The Dark Knight Rises," threw a smoke grenade and opened fire on the audience with an assault rifle. There are 12 dead (10 died at the scene, and two at local hospitals) and more than 30 wounded, according to ABC News.

Police have Holmes in custody, arresting him in the theater parking lot. The FBI is assisting in the investigation and has said there's no reason to believe Holmes was associated with any larger terrorist organization. There is no known motive at this point.

While in custody, Holmes apparently referred to the presence of explosives in his nearby apartment. A SWAT team was deployed to the building, which was evacuated, and pushed a video camera through the outside window to investigate inside the apartment. No word yet on what they found.

While no one knows Holmes's motive at this point, ABC News went out on a limb and reported that they had found a reference to a "Jim Holmes" of Aurora, Colo., on the website for Colorado's Tea Party, according to Politico. Seems too soon to report such a thing without first confirming whether it's the same James Holmes. (Here's the Tea Party website ABC News cited.)

Holmes's rampage was the largest mass shooting in Colorado since the 1999 massacre at Columbine High School, which is only 15 miles from the site of this morning's shooting.

Dale Stockton, editor of www.LawOfficer.com, offers his commentary on the law enforcement response to this morning's shooting and best practices for responding to mass-casualty events.

Colorado's gun laws are fairly liberal, and this event has created the customary calls for stricter gun control.

The International Business Times includes a summary of the gun laws in Colorado, including the fact that gun registration is not required.

New York City Michael Bloomberg made his anti-gun beliefs known on a morning radio talk show. “Soothing words are nice,” Bloomberg said, according to Politico. “But maybe it’s time the two people who want to be president of the United States stand up and tell us what they’re going to do about it, because this is obviously a problem across the country. And everybody always says, ‘Isn’t it tragic?’”

CNN's Piers Morgan shared his opinion on Twitter this morning: "Horrendous details from this Colorado cinema shooting. America has got to do something about its gun laws. Now is the time."

Plenty of people jumped on his back, including journalist and columnist Michelle Malkin, who tweeted that "armed CO citizens have SAVED lives in mass shootings," including this link to information about a 2007 church shooting where an armed parishioner saved lives by taking down the shooter.

Janet Napolitano, secretary of the Department of Homeland Security, released a statement saying she was "deeply saddened" by the incident. "Federal, state, and local law enforcement agencies continue to respond to this horrific event and I have directed the Department of Homeland Security to provide any support necessary in the ongoing investigation," she said. "We are committed to bringing those responsible to justice. Our hearts and prayers go out to anyone impacted by this tragedy, especially the family and friends of those killed or injured.”

President Obama and Gov. Mitt Romney have said they will address the incident in remarks today.

Tags: 

Cinema-massacre victim lived through another mass shooting last month

 - 
Friday, July 20, 2012

A heart-wrenching story is emerging about one of the victims in this morning's mass shooting at the Colorado movie theater. Of course, the story of all those killed and wounded in the shooting is heart-wrenching. But one victim has a story that stands out.

Jessica Ghawi, an aspiring sports newscaster, has been named as a victim in the shooting, according to local TV station KSAT. Several friends have tweeted memories and tributes to Ghawi, who was @JessicaRedfield on Twitter.

Jessica's brother, Jordan Ghawi, a firefighter and paramedic in Texas, wrote on his blog that he was able to speak with a mutual friend, Brent Lowak, who was with Jessica at the theater, and was wounded himself. "[Lowak] stated that they were in the theatre when an incendiary device was fired into the crowd and that shots rang out immediately afterwards. Brent further stated that he took two rounds and that my sister took one round followed by an additional round which appeared to strike her in the head."

What's eerie is that this was not the first mass shooting Ghawi had been a part of. She was present for the shooting last month at the Eaton Center mall in Toronto.

She blogged about her experience at that shooting. Reading Ghawi's words now makes my skin crawl.

Ghawi wrote: "I can’t get this odd feeling out of my chest. This empty, almost sickening feeling won’t go away. I noticed this feeling when I was in the Eaton Center in Toronto just seconds before someone opened fire in the food court. An odd feeling which led me to go outside and unknowingly out of harm‘s way. It’s hard for me to wrap my mind around how a weird feeling saved me from being in the middle of a deadly shooting."

Another excerpt: "I was shown how fragile life was on Saturday. I saw the terror on bystanders’ faces. I saw the victims of a senseless crime. I saw lives change. I was reminded that we don’t know when or where our time on Earth will end. When or where we will breathe our last breath. For one man, it was in the middle of a busy food court on a Saturday evening. I say all the time that every moment we have to live our life is a blessing. So often I have found myself taking it for granted. Every hug from a family member. Every laugh we share with friends. Even the times of solitude are all blessings. Every second of every day is a gift. After Saturday evening, I know I truly understand how blessed I am for each second I am given."

Read her full blog post.

Pages