Caribou – Noise https://noise.getoto.net The collective thoughts of the interwebz Fri, 18 Mar 2011 11:30:03 +0000 en-US hourly 1 https://wordpress.org/?v=6.8.2 Caribou and Cardkey Door Control Systems https://noise.getoto.net/2011/03/18/caribou-and-cardkey-door-control-systems/ Fri, 18 Mar 2011 11:30:00 +0000 http://noise.getoto.net/?guid=095cd79c16448b31428a8b56f5c892b1 Caribou is a proof of concept exploit application that targets cardkey systems like the prox cards that you're likely familiar with from parking lots, apartment complexes, and possibly your entry access system at your employer.

Per the site and demo:
"By providing Caribou only with the IP address of the target cardkey device, a single-button "Unlock" will access the cardkey system, unlock all available doors in sequence, allow 30 seconds for entry, and then re-lock all those same doors. Caribou has the capability of performing a brute-force of any customized security PIN used with the system."
While the proof of concept code isn't provided, the speed with which is unlocks the door indicates that the keyspace for the pin is likely relatively small, and the author provides a series of tips on securing HOA and other common spaces that use devices of this type. The most important item is the common sense (but often ignored) need to place the entry access system on a private network so that it can't be brute forced via open wireless or wired networks.
]]>