Brutkey

Andy Greenberg
@agreenberg@infosec.exchange

Researchers at Defcon just showed they can crack the Securam ProLogic locks used on high-security safes to protect guns, cash, and narcotics in pharmacies.

When they told Securam last year, it sent them legal threats—and didn't fix the flaws.

https://www.wired.com/story/securam-prologic-safe-lock-backdoor-exploits/

Andy Greenberg
@agreenberg@infosec.exchange

One of their safecracking techniques exploits a manufacturer backdoor to instantly obtain the combination. The other uses a custom tool to extract the combination from a hidden port inside the lock's battery compartment, shown here: https://www.youtube.com/watch?v=MYCeUOmPd7k

Andy Greenberg
@agreenberg@infosec.exchange

Securam ProLogic locks are used across the US on safes sold by Fort Knox, High Noble, FireKing, Tracker, ProSteel, Rhino Metals, Sun Welding, Corporate Safe Specialists, and pharmacy safe companies Cennox and NarcSafe specifically to hold drugs in pharmacies.

Andy Greenberg
@agreenberg@infosec.exchange

Senator Ron Wyden actually warned about Securam's backdoor in a letter to the NCSC last year. “Experts have warned for years that backdoors will be exploited by our adversaries, yet...the government has left the American public vulnerable,” he now told me in a statement.

Andy Greenberg
@agreenberg@infosec.exchange

Securam says it will fix the vulnerabilities in a new lock model coming later this year. It has no plans to offer an update to all the locks on safes currently in use. If you want a secure safe, you'll have to buy and install a new lock.

demi7en 🎗🇪🇺
@demi7en@infosec.exchange

@agreenberg@infosec.exchange Better find a more "secure" and ethical provider for your next safe. 🤦

Businesses like this deserve to be wiped out.

Jez Caudle :verified:
@JezCaudle@infosec.exchange

@agreenberg@infosec.exchange In the process of buying a safe and I’m looking for someone with keys. Physical turning things. The bigger the better.