Release the hounds! Securing datacenters may soon need sniffer dogs
(2024/07/18)
- Reference: 1721264050
- News link: https://www.theregister.co.uk/2024/07/18/sniffer_dogs_datacenter_defence_implants/
- Source link:
Sniffer dogs may soon become a useful means of improving physical security in datacenters, as increasing numbers of people are adopting implants like NFC chips that have the potential to enable novel attacks on access control tools.
So says Len Noe, tech evangelist at identity management vendor CyberArk. Noe told The Register he has ten implants – passive devices that are observable with a full body X-ray, but invisible to most security scanners.
Noe explained he's acquired swipe cards used to access controlled premises, cloned them in his implants, and successfully entered buildings by just waving his hands over card readers.
[1]
Unless staff are vigilant enough to notice he didn't use a card, his entrance appears to be a normal, boring, instance of an RFID being scanned.
[2]
[3]
But like most electronics, Noe's implants include a chemical called triphenylphosphine oxide that’s used to coat circuit boards to prevent them from overheating. Sniffer dogs have [4]already been trained to sniff out the chemical to detect electronic devices.
Noe thinks hounds are therefore currently the only reliable means of finding humans with implants that could be used to clone ID cards.
[5]
He thinks dogs should be considered because attackers who access datacenters using implants would probably walk away scot-free. Noe told The Register that datacenter staff would probably notice an implant-packing attacker before they access sensitive areas, but would then struggle to find grounds for prosecution because implants aren't easily detectable – and even if they were the information they contain is considered medical data and is therefore subject to privacy laws in many jurisdictions.
Noe thinks plenty of other attacks could be mounted using implants. He outlined a scenario in which a phishing mail is stored in an NFC implant – an attacker gains access to a victim's smartphone, uploads the mail, and sends it. Hardy anyone checks their Sent mail file, he noted, and mails sent from known good corporate inboxes are less likely to be considered a risk.
[6]China working on standard for brain-computer interfaces
[7]Tesla owner gets key fob chip implanted in his hand
[8]Neuralink keeps losing the thread on brain implant wiring
[9]'CAPTAIN CYBORG': The wild-eyed prof behind 'machines have become human' claims
Happily, Noe believes that only 50,000 to 100,000 people worldwide have had electronics implanted in their bodies, and perhaps one percent of those have the tech or the capability to use them for evil – rather than applications like [10]keyless entry to a Tesla .
But he told The Register he's aware of red teams adopting the tech, with some success, and pointed out that cyber-crims are always looking for new tools. He also feels that the issue of implants being used as a weapon deserves some consideration as [11]brain-computer interfaces like Neuralink evolve.
In the here and now, Noe explained that tools to defeat implants are already available in the form of multi-factor authentication. He suggests that datacenters require a combination of a card swipe and a keyed code, or biometrics, to defeat implant-packing attackers.
[12]
And maybe consider going to the dogs, too – in the best possible way. ®
Get our [13]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZpiTWJkH@veyFgedFP-72QAAANc&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZpiTWJkH@veyFgedFP-72QAAANc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZpiTWJkH@veyFgedFP-72QAAANc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://www.afp.gov.au/news-centre/media-release/new-afp-tech-dogs-taking-bite-out-crime
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZpiTWJkH@veyFgedFP-72QAAANc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://www.theregister.com/2024/07/02/china_brain_computer_interface_standard/
[7] https://www.theregister.com/2022/08/24/tesla_owner_gets_hand_fob/
[8] https://www.theregister.com/2024/05/15/neuralink_loose_wires/
[9] https://www.theregister.com/2014/06/10/world_to_captain_cyborg_youre_rumbled/
[10] https://www.theregister.com/2022/08/24/tesla_owner_gets_hand_fob/
[11] https://www.theregister.com/2024/05/29/neuralink_to_add_more_subjects_to_trial/
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZpiTWJkH@veyFgedFP-72QAAANc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[13] https://whitepapers.theregister.com/
So says Len Noe, tech evangelist at identity management vendor CyberArk. Noe told The Register he has ten implants – passive devices that are observable with a full body X-ray, but invisible to most security scanners.
Noe explained he's acquired swipe cards used to access controlled premises, cloned them in his implants, and successfully entered buildings by just waving his hands over card readers.
[1]
Unless staff are vigilant enough to notice he didn't use a card, his entrance appears to be a normal, boring, instance of an RFID being scanned.
[2]
[3]
But like most electronics, Noe's implants include a chemical called triphenylphosphine oxide that’s used to coat circuit boards to prevent them from overheating. Sniffer dogs have [4]already been trained to sniff out the chemical to detect electronic devices.
Noe thinks hounds are therefore currently the only reliable means of finding humans with implants that could be used to clone ID cards.
[5]
He thinks dogs should be considered because attackers who access datacenters using implants would probably walk away scot-free. Noe told The Register that datacenter staff would probably notice an implant-packing attacker before they access sensitive areas, but would then struggle to find grounds for prosecution because implants aren't easily detectable – and even if they were the information they contain is considered medical data and is therefore subject to privacy laws in many jurisdictions.
Noe thinks plenty of other attacks could be mounted using implants. He outlined a scenario in which a phishing mail is stored in an NFC implant – an attacker gains access to a victim's smartphone, uploads the mail, and sends it. Hardy anyone checks their Sent mail file, he noted, and mails sent from known good corporate inboxes are less likely to be considered a risk.
[6]China working on standard for brain-computer interfaces
[7]Tesla owner gets key fob chip implanted in his hand
[8]Neuralink keeps losing the thread on brain implant wiring
[9]'CAPTAIN CYBORG': The wild-eyed prof behind 'machines have become human' claims
Happily, Noe believes that only 50,000 to 100,000 people worldwide have had electronics implanted in their bodies, and perhaps one percent of those have the tech or the capability to use them for evil – rather than applications like [10]keyless entry to a Tesla .
But he told The Register he's aware of red teams adopting the tech, with some success, and pointed out that cyber-crims are always looking for new tools. He also feels that the issue of implants being used as a weapon deserves some consideration as [11]brain-computer interfaces like Neuralink evolve.
In the here and now, Noe explained that tools to defeat implants are already available in the form of multi-factor authentication. He suggests that datacenters require a combination of a card swipe and a keyed code, or biometrics, to defeat implant-packing attackers.
[12]
And maybe consider going to the dogs, too – in the best possible way. ®
Get our [13]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZpiTWJkH@veyFgedFP-72QAAANc&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZpiTWJkH@veyFgedFP-72QAAANc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZpiTWJkH@veyFgedFP-72QAAANc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://www.afp.gov.au/news-centre/media-release/new-afp-tech-dogs-taking-bite-out-crime
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZpiTWJkH@veyFgedFP-72QAAANc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://www.theregister.com/2024/07/02/china_brain_computer_interface_standard/
[7] https://www.theregister.com/2022/08/24/tesla_owner_gets_hand_fob/
[8] https://www.theregister.com/2024/05/15/neuralink_loose_wires/
[9] https://www.theregister.com/2014/06/10/world_to_captain_cyborg_youre_rumbled/
[10] https://www.theregister.com/2022/08/24/tesla_owner_gets_hand_fob/
[11] https://www.theregister.com/2024/05/29/neuralink_to_add_more_subjects_to_trial/
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZpiTWJkH@veyFgedFP-72QAAANc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[13] https://whitepapers.theregister.com/
Blake Davis
Is there some evidence of dogs sniffing out implants that wasn't shared in this story?
Blazde
It's rarely mentioned but the reason dogs sniff each other's asses is because of trace triphenylphosphine oxide coming off their own microchips. They just can't get enough of it
triphenylphosphine oxide that’s used to coat circuit boards to prevent them from overheating.
david 12
WTF?
Perhaps this means that TPP oxide has been included as a flame retardant? It sometimes is, but that's in all kinds of common plastics, which are common, so sniffing wouldn't prove anything.
Has anybody got any information that it's used for thermal bonding or temperature handling?
Len Noe
Anonymous Coward
Is an idiot. The only thing he's evangelizing for is Dunning-Kruger.
I mean, if the keycard is the only thing you need to enter a building, you do have to prepare for the very ordinary case that the card is just stolen, or cloned using non-implant tech...