Home

Lockpicker Toby Bluzmanis inserts a wire into the LED readout of Kaba’s E-Plex 5800 to open the lock.

To open a door fitted with the latest U.S. government-certified lock from high-end Swiss lock manufacturer Kaba, an employee must both enter a code up to eight digits long, then swipe a unique identity card coded to comply with a new standard that requires an extra layer of security, one designed to track individual staffers and make covert intrusion harder than ever.

Or, as lockpicking expert Marc Weber Tobias will show a crowd of hackers Friday, you can stick a wire in the tiny display light above the keypad and instantly render all of that “security” irrelevant.

At the Defcon security conference in Las Vegas, Tobias and his partner Toby Bluzmanis plan to demonstrate a series of simple hardware hacks that expose critical security problems in Kaba’s E-plex 5800 and its older 5000. Zurich-based Kaba markets the 5800 lock, which Bluzmmanis says can cost as much as $1,300, as the first to integrate code-based access controls with a new Department of Homeland Security standard that goes into effect next year and requires identifying credentials be used in secure facilities to control access.

In demonstrations for me and in videos they plan to show the Defcon audience, the lockpicking duo use one method called “rapping” to open the lock by simply hitting its top surface or lever handle with a mallet, compressing an internal spring that then decompresses and pushes open a latch that releases the lock. In another bypass, they insert a wire into a silicon cover for an LED light that blinks red when the user enters an invalid code. That wire can ground a contact on the circuit board behind the light that triggers a function intended to allow the door to be opened with a remote button, bypassing all its security measures.

A third attack allows an insider to open the back side of the lock and insert a wire that flips a microswitch intended as an override for power failures. That trick resets the lock’s software, tampering with its audit trail and allowing it to be reprogrammed with different codes. Bluzmanis demonstrated in a video that the more elaborate microswitch attack could be performed in under a minute.

“The issue is simply insecurity engineering,” says Tobias, who works as a consultant to several major lock firms and contributes blog posts to Forbes.com. “They simply don’t get it.”

Chances are you’ve never heard of TruePosition. If you’re an AT&T or T-Mobile customer, though, TruePosition may have heard of you. When you’re in danger, the company can tell the cops where you are, all without you knowing. And now, it’s starting to let governments around the world in on the search.

The Pennsylvania company, a holding of the Liberty Media giant that owns Sirius XM and the Atlanta Braves, provides location technology to those soon-to-be-merged carriers, so police, firefighters and medics can know where you’re at in an emergency. In the U.S., it locates over 60 million 911 calls annually. But very quietly, over the last four years, TruePosition has moved into the homeland security business — worldwide.

Around the world, TruePosition markets something it calls “location intelligence,” or LOCINT, to intelligence and law enforcement agencies. As a homeland security tool, it’s enticing. Imagine an “invisible barrier around sensitive sites like critical infrastructure,” such as oil refineries or power plants, TruePosition’s director of marketing, Brian Varano, tells Danger Room. The barrier contains a list of known phones belonging to people who work there, allowing them to pass freely through the covered radius. “If any phone enters that is not on the authorized list, [authorities] are immediately notified.”

TruePosition calls that “geofencing.” As a company white paper explains, its location tech “collects, analyzes, stores and displays real-time and historical wireless events and locations of targeted mobile users.”‘The capability of doing mass tracking is possible.’

It can also work other ways: pinging authorities when a phone used by a suspected terrorist or criminal enters an airport terminal, bus station or other potential target. And it works just as well in monitoring the locations of phones the suspect’s phone calls — and who they call and text, and so on.

For the past four years, TruePosition has quietly taken that tracking technology global. In the U.S., Varano says, TruePosition sells to mobile carriers — though it’s cagey about whether the U.S. government uses its products. But abroad, it sells to governments, which it won’t name. Ever since it came out with LOCINT in 2008, he says, “Ministries of Defense and Interior from around the world began beating down our door.”

That’s got some surveillance experts and mobile activists worried. Keeping suspected terrorists away from nuclear power plants and discovering their networks of contacts is well and good. But in the hands of foreign governments — not all of whom respect human rights — TruePosition tech can just as easily identify and monitor networks of dissidents.

For a company that can do so much to find out where a mobile user is, few outside of the surveillance industry know much about TruePosition. That’s a deliberate strategy on the company’s part, to keep a “low profile from jump,” Varano says. It grants few interviews — a little-noticed Fox News story from 2009 is a rare exception — and discloses little about its foreign clients. Several surveillance experts contacted for this story were unfamiliar with the company.

The result, says Christopher Soghoian, a graduate fellow at Indiana University’s Center for Applied Cybersecurity Research, is to make TruePosition the most important global geolocation company you’ve never heard of. “It’s like that line about Keyser Soze from The Usual Suspects — the greatest trick the devil ever pulled was convincing the world he didn’t exist,” Soghoian says. “They’ve done the same thing. Staying entirely below the radar.”