Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

Re: CAU-2008-0001 - Slowly Closing Door Race Condition
From: David Weston <DAVID.G.WESTON () saic com>
Date: Tue, 01 Apr 2008 08:49:03 -0700

I saw Nate do a 0day sploit on this at the Hard Rock Amsterdam!


On 3/31/08 10:18 PM, "Nate McFeters" <nate.mcfeters () gmail com> wrote:

Hahaha, nice find.

On 4/1/08, I)ruid <druid () caughq org> wrote:
                     ____      ____     __    __
                    /    \    /    \   |  |  |  |
       ----====####/  /\__\##/  /\  \##|  |##|  |####====----
                  |  |      |  |__|  | |  |  |  |
                  |  |  ___ |   __   | |  |  |  |
------======######\  \/  /#|  |##|  |#|  |##|  |######======------
                    \____/  |__|  |__|  \______/

                   Computer Academic Underground
                       http://www.caughq.org
                         Security Advisory

===============/========================================================
Advisory ID:    CAU-2008-0001
Release Date:   04/01/2008
Title:          Slowly Closing Door Race Condition
Application/OS: Physical Structures
Topic:          Physical structures employing exit doors with locks
               are vulnerable to a race condition.
Vendor Status:  Not Notified
Attributes:     Physical, Race Condition
Advisory URL:   http://www.caughq.org/advisories/CAU-2008-0001.txt
Author/Email:   CAU <advisories (at) caughq.org <http://caughq.org> >
===============/========================================================

Overview
========

Physical structures which employ automatically locking doors to secure
exit points expose a race condition which may allow unauthorized entry.


Impact
======

Malicious outsiders may be able to enter a structure via an exit point.

Exit points may additionally provide an exit from a secure area of the
structure, allowing an outsider entering through the exit point to gain
direct access to the secure area.


Affected Systems
================

Physical structures which employ automatically locking doors at exit
points of the structure.


Technical Explanation
=====================

An exit's lock[1] generally converts a two-way door into a one-way
door, allowing a person to traverse the door's threshold in one
direction but not in the other.  These types of locks are used to
secure exit points of structures so that people may exit via the door
but not re-enter without disabling the lock through force or
authentication.

When a person exits the structure through an exit point which is
secured by such a mechanism, a race condition exists wherein a
malicious outsider may be able to reach the door and enter through it
before it closes and locks itself.

Many doors, especially heavier ones, also employ closing mechanisms[2]
which are designed to cause the door to close slowly so as not to slam
the door shut and damage the door frame, or damage any human appendage
which may be in between the door and it's frame.  Such closing
mechanisms can greatly increase the amount of time that the race
condition exists.


Solution & Recommendations
==========================

1) Always ensure that personnel exiting an exit door wait outside the
  door until it has completely closed and locked before walking
  away.

2) Employ a double door system such as is used in an air-lock where
  the interior door must be secured prior to the exterior door being
  allowed to open.


Exploitation
============

First identify the exit point that you want to exploit.  Stand at a
safe distance during a high-traffic time and watch for people to use
the exit point.  Time how long it takes for the door to close and
lock itself when someone traverses the exit point.

Next, identify a safe hiding place near the exit point, preferably
in a direction that would be behind a person exiting the door, but
which is within a distance to the exit point which you could traverse
in under the door's closing time at a brisk pace or run.

Finally, hide in this location during a lower traffic time and wait
for someone to utilize the exit point.  After they have exited the
door and are walking away, run to the door and enter before it has
closed and locked.  Extra points are awarded for a spectacular dive
and/or roll to catch the door at the very last second.


References
==========

[1] http://en.wikipedia.org/wiki/Lock_%28device%29
[2] http://en.wikipedia.org/wiki/Door_closer


Credits & Gr33ts
================

Theodor Geisel, AHA!, NMRC, Uninformed Journal, dc214


--
I)ruid, CĀ²ISSP
druid () caughq org
http://druid.caughq.org

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/




_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Thanks,
David Weston
Security Engineer
Science Application International Corporation
Web:  http://www.saic.com/infosec
Email:DAVID.G.WESTON () saic com
Office:858-826-5435
Cell:   310-866-9713

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
  • Re: CAU-2008-0001 - Slowly Closing Door Race Condition David Weston (Apr 01)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]