Server and Telecom Rack Physical Security Compliance

This week, we continue our series on: The 3 Functions of Rack Security Compliance. As a quick reminder, these 3 functions are the following:

  1. Cybersecurity
  2. Physical Network Security
  3. Operational Security

This week, we focus on the second function of data center security compliance, namely: Physical Network Security. Physical Network Security systems in most data centers are comprised of 3 layers:

  1. Perimeter access security
  2. Rack physical access security

Its important to understand that most physical access security systems use standard protocols to make communication easy. Just like SNMP is the most common protocol used for network management communications, the Wiegand protocol is the most common protocol used for security management communications. Since few have heard of Wiegand, the first question is: what is the Wiegand protocol? The answer is that it is actually a group of standards all under one collective heading. It includes a method of communication between the card or fob reader and the controller unit as well as methods for storing data on both the card or fob and the controller. We are focusing on the communication aspect of the system as that is where much of the vulnerability lies.

Much of what I am sharing today comes from several well documented research projects that target Wiegand-based access systems. Brad Antoneiwicz from the Open Security Research group at Foundstone Security, a part of Intel Security has done excellent research in this area. You may want to link to his blog post about Wiegand vulnerabilities here and you may see an excellent presentation that he did gave that is posted online here. Brad shows in his blog and his presentation that it is easy to establish a man-in-the-middle attack on an card access system. That’s because the process is very easy execute in a small time frame and with limited tools and resources. Just as SNMP is vulnerable to virtual man-in-the-middle (MitM) attacks on network systems, so too card access systems can be attacked by a physical MitM gain entry to data centers and data racks.

With a simple Arduino board and some good logic, Antoneisicz shows us that you can easily gain access to any Wiegand-based card access system. The protocol is trivial to duplicate and you can use something as simple as a battery-powered Arduino to hijack a card access system and gain entrance into a data rack and its valuable data. It turns out that, while some parts of card access systems do offer some level of encryption (for example, the server usually offers https for remote management security) the serial communications from the card reader to the card controller is almost always open to intercept. This allows you to read, communicate and ultimately, hijack the card reader to gain full access to that facility or rack.

For those of you who really want to take a deep dive on the subject of access card reader hacking – including hacking the actual RFID signal from the access card – here is a truly detailed report from Bishop Fox Security.  This presentation was very well received at the DefCon hackers convention in the summer of 2015 and it considered the definitive published work of all the easiest means to hack access security cards.  Everyone who uses a security access card system should familiarize themselves with this report.

So what is the bottom line here? It is that access cards are easily hacked.  The serial communications on a card access system are NOT supervised or encrypted but, are allowed to pass freely in open protocol format from point to point.  Similarly, the RFID signal on an access card floats freely and anyone can grab that signal and use it to create a duplicate card or otherwise hack an access system.   Anyone who can gain access to the wire or wireless data from a card can gain access to whatever that card system is supposed to be protecting.

Fortunately, there is an answer to this huge security hole. Our RackGuardian has an plug-in product known at the EnviroScout which can inspect and supervise ALL communications from the Wiegand-based reader to the controller. If this device sees any signs of tampering, the RackGuardian will immediately send a message to our server and then to our IOS device within 2 seconds of detection.  The combination of instant notification to your mobile device coupled with our on-board analytics to catch any signs of tampering gives you the security that you need in your data center.

As a reader of this blog, you know that security compliance is serious business and its getting more pervasive all the time. We have shown through peer-reviewed research that existing card access systems fail to pass a simple third-party security test. Please consider discussing your physical security needs with one of our experts and lock-down your data center and data racks today.

Until next time,

Be Well!

Cyber Attack Using Rack PDUs as a Backdoor to Server Data

Greetings and welcome back!  This month we look at something that we have been predicting for some time, a Cyber Attack Using Rack PDU’s as a Backdoor to Server Data.  There was an excellent article on this in Identity Week last month.  In this article, it discusses an attack on DDoS protection firm Staminus.  In this attack, the intruders managed to do all of the following:

  • Bring down Staminus’ entire network
  • Reset routers to factory settings
  • Stole Staminus’ databases and dumped the contents online

The attackers were brazen to say the least as they actually posted how they hacked Staminus with an online post.  The two key factors they mentioned in their attack were:

  • Use one root password for all the boxes
  • Expose PDUs to WAN with telnet authority

The first mistake is all-too-common for any type of equipment.  If you use the same password for everything, a hacker only needs to break it once and they are in.  The second problem is the specific reason that we built RackGuardian.  Here, they used an open Telnet port on rack PDU’s to gain backdoor access into the servers in the rack.  I will add that, whether a hacker uses Telnet, FTP or SNMP, each of these ports is normally open on a rack PDU and each has minimal security.

So what can you do once you gain access into a rack PDU?  Plenty!  You can immediately traverse to the servers in the rack if they are on the same sub net.  If they are on a different subnet, you will first need to go to the switch and then back again.  In this case, its not clear which they did as they also had the open passwords on the switches and routers.

The long and short is that a rack PDU makes a perfect camoflauge as a sniper nest to extract data from a server without easily being observed.  After all, who expects data to be coming from a rack PDU?

The moral of the story is clear: You MUST secure your rack PDU’s and RackGuardian is the only product that is specifically built with this purpose in mind.  Cyber Attack Using Rack PDUs is a real threat to every organization.  RackGuardian does all the things that you need to protect your rack systems from harm.  It plugs into the Ethernet ports of your Rack PDU, UPS and other systems and it provides full monitoring of the power and environment in your rack – while it secures all of your rack power and environmental systems from being used as hacker targets.

Think about this and, we would be more than happy to have a confidential conversation about how to protect your rack systems.

Until next time,

Be Well!

 

 

Security Compliance for Data Racks

Welcome back! This week’s blog is: Security Compliance for Data Racks. To begin with, whether you remotely host your servers offsite or you have your own data center(s), you need to have the ability to remotely manage the systems in your racks. These systems include the following groups of items:

  • Processing and Storage
  • Networking
  • Power, Environment and Security

All of these systems need to be managed remotely at some point. Whether your racks are located in a data center, IDF room, MDF room are telecom closet, if a server goes down at night, you’re going to need to reboot it.  The most common way to reboot a server in a remote rack is via power cycling an individual plug on a rack PDU or rack UPS.  In some cases, you may use a specialty device that is specifically devoted to a reboot function.

Each of these systems, PDU, UPS and reboot bar are typically managed by SNMP from a central console system. Sadly, as this  peer-reviewed paper from Georgia Tech shows, even the latest version of SNMP – SNMPv3 – can now be easily compromised. For those who are taken back by this, please realize that SNMPv3 is a protocol that is now 15 years old.  If I asked you to use a 15 year old piece of software to secure your database, would you trust it?  Of course not and so, it should not be a surprise that SNMPv3 can not be trusted as a secure protocol.

The question then becomes: What can SNMP exploits do to my data?  The answer to that question comes from a quick review of the 3 types of systems shown above: processing and storage, networking and power/environmental/security that are typically in a data rack. The first two items are typically open to ports 80 and 443 and are normally guarded by the perimeter firewall. But, many servers, storage and systems and networking gear such as switches, are managed via SNMP.  Because SNMP devices communicate in a very friendly manner toward one-another, this makes it easy for a hacker who has gained access into the SNMP port of a PDU, UPS or other support system to jump to a data system such as a server and steal data.

While that is a very bad scenario, its not the only problem.  Table 1 from the linked Georgia Tech paper shows that many different attacks can be launched by gaining access to one of these devices.   The simple fact is, its easy to enter SNMP-enabled systems and change power cycle servers over and over, destroying database.  As the Table also shows, its also possible to launch Denial of Service (DoS) attacks through several of these systems, effectively shutting down that network segment and access to its data.

 

SNMPv3 Vulnerabilities

The information presented in this week’s blog makes it clear that, if you are concerned about an Security Audit Compliance & Your Data Racks, you need to protect your rack infrastructure. AlphaGuardian’s RackGuardian system is the only system on the market that is uniquely focused on protecting your data by protecting the security of your infrastructure. Power systems such as Rack PDU’s and UPS’s, cooling systems such as In-Rack Cooling, and security systems such as rack-mount environmental and security monitoring units all support and rely on SNMP. RackGuardian protects all of these devices while it securely monitors them as well.  All information is then sent from RackGuardian is transmitted via an encrypted, push communication to a certificate-based data server. The result is you get all the information that you need for remote rack management while keeping all of your systems – and your data – completely safe.

Please think about this for a bit and let us know how we can help you.

Until next time,

Be Well!