Google’s own employee hacked their office doors
A hacker found a way to trick doors into opening without the requisite Radio Frequency Identification (RFID) keycard in Google’s Sunnyvale offices last July. Fortunately for Google, it was David Tomaschik, the Tech firm’s own employee, who had no malicious intentions.
When he sent his malicious code across the Google network, he saw the lights turn from red to green on the door to his office. Then came the satisfying thunk as the lock opened.
It was the zenith of work in which Tomaschik had revealed vulnerabilities in technology made by Software House, the creator of the office controllers managing the physical security of the California site.
Last summer, when Tomaschik looked at the encrypted messages the Software House devices (called iStar Ultra and IP-ACM) were sending across the Google network, he discovered they were non-random; encrypted messages should always look random if they’re properly protected.
He was interested and burrowing further found a “hardcoded” encryption key was utilized by all Software House gadgets.
That implied he could viably replicate the key and forge commands, for example, those requesting a door to unlock. Or on the other hand he could just replay legitimate unlocking commands, which had much the same effect.
Tomaschik also discovered he could do all this without any traces of his actions. And he could prevent legitimate Google employees from opening doors.
“Once I had my findings it became a priority. It was pretty bad,” he told Forbes. Google then moved quickly to prevent attacks on its offices, according to Tomaschik.
A Google spokesperson said there was no evidence the doors had been exploited by any malicious hackers. The iStar v2 Board now uses a more suitable form of encryption, known as TLS, which goes some way to fixing the issue.
Meanwhile, Google has segmented its network in order to provide protection for the vulnerable systems still in its properties, the spokesperson added.
But problems likely remain for others using the vulnerable Software House tech. Tomaschik said Software House had come up with solutions to fix the problem, though to switch to TLS, it’d require a change of hardware at the customer site. That’s because the Software House systems didn’t have enough memory to cope with the installation of new firmware, Tomaschik said.
A spokesperson for Software House owner Johnson Controls said: “This issue was addressed with our customers.” They didn’t respond to a question on the need to replace physical devices.
Tomaschik told Forbes the flawed Software House tech was likely to be deployed widely, inside and outside Google, as there are only a handful of companies making such office controls.
That means that all manner of other businesses could be open to attack by hackers-turned-robbers.
Source: Forbes
