Critical vulnerabilities in a market-leading line of digital locks securing hospitals, airports, and water treatment facilities makes it possible for rogue employees or outside attackers to clone digital keys, researchers reported late last week.

Thursday's advisory from security firm IOActive is notable not only for the serious security issues it reported in the CyberLock line of access control systems, which are certified to meet a wide range of US governmental requirements and certifications. The report is also the topic of a legal threat from CyberLock attorneys who invoked draconian provisions of the Digital Millennium Copyright Act if IOActive disclosed the vulnerabilities. A redacted version of a letter CyberLock outside attorneys sent IOActive researcher Mike Davis has reignited a long-standing tension between whether it should be legally permissible for researchers to publicly disclose unfixed vulnerabilities in the products they test.

"Of course, as you know, the public reporting of security vulnerabilities can have significant consequences," Jeff Rabkin, a partner at the Jones Day law firm wrote in a letter dated April 29, one day before IOActive published the advisory. "[Redacted company name] also takes the protection and enforcement of its intellectual property rights seriously and, prior to any public reporting, wants to ensure that there has been no violation of those rights, including [redacted company name]'s license agreements or other intellectual property laws such as the anticircumvention provision of the Digital Millennium Copyright Act. Presumably, IOActive is aligned with ensuring responsible disclosure and compliance with the laws."

The Digital Millennium Copyright Act of 1998 makes it a felony to circumvent technology intended to prevent access to copyrighted material. It also provides substantial civil penalties copyright holders may recover. Word of the letter touched off wails of protest on social media sites from security researches and privacy advocates. They characterized it as an abuse of the legal system that threatens the public's right to know about vulnerabilities in products they use to secure their property and secrets. Officials from CyberLock didn't respond to e-mails seeking comment for this post.

“Unclonable” no more

IOActive's five-page advisory warns that some of the bugs undermine fundamental assurances about the security of the product, which looks and acts like a traditional lock, but is locked and unlocked with a programmable digital key known as a CyberKey. That allows a CyberLock to impose tight-knit restrictions on each key holder that among other things controls the times of day someone can access a particular area or locked storage container and the duration of time the key is valid. It also allows each access or access attempt to be logged to create a detailed audit trail. CyberLock marketing materials also stress assurances that a CyberKey can't be duplicated or changed. According to the IOActive advisory:

CyberLock offers a line of "high security" locks and cylinders as well as related products and services for updating, managing, provisioning, and storing CyberKeys. In various marketing materials, CyberKey is described as "unclonable" and suitable for use in money handling and critical infrastructure systems as a secure and auditable solution. However, after some reverse engineering it appears that these devices are easily cloned, and new keys can be created from lost cylinders and keys regardless of the permissions granted to the key. Additionally, time-of-day restrictions are enforced by the key, not the cylinder, allowing an attacker access at any time regardless of the configuration.

The advisory went on to say that "site keys" are stored in unencrypted, "cleartext" form that can be recovered from the lock cylinders. Attackers may also obtain the site keys by intercepting communications between any previously authorized CyberKey and any CyberLock. Once extracted, the site key can be used to create cloned keys that can be modified to remove time-of-day or one-time access restrictions. CyberLock cylinders can also be broken off from the company's line of digital padlocks "with a few sharp strikes to the mechanical retainer," allowing the lock to be unlatched. Even more potentially serious, as the following diagram taken from an oscilloscope-connected CyberLock model shows, the devices may be vulnerable to a form side channel attack. Known as a simple power analysis, the technique allows the site key to be recovered.

The report also includes other images that suggest it's possible to extract the entire firmware that powers the CyberLock. The report doesn't elaborate, but the firmware-extraction attacks appear to use a technique known as optical fault injection, in which secure chips are dissected and analyzed with microscopes and lasers.

CyberLock fires back

In a three page response sent Tuesday, Rabkin, the CyberLock attorney, vigorously disputed some of the IOActive findings. For one thing, he said, the findings don't apply to the entire CyberLock product line, and even then, firmware is regularly updated. Rabkin went on to write:

Moreover, IOActive's reverse engineering process required the use of skilled technicians, sophisticated lab equipment, and other costly resources not generally available to the public to extract [company name redacted]'s firmware from an embedded semiconductor chip. Leaving aside the question of whether IOActive's methodology violated [company name redacted]'s legal rights, your process appears to have included at least the following steps: (1) forcibly disassembling a [redacted] to remove the cylinder using "a few sharp strikes to the mechanical retainer"; (2) shaving off the semiconductor chip's packaging; (3) connecting leads onto the depackaged chip; (4) extracting the firmware from the depackaged chip; and (5) reverse engineering a portion of the source code for the extracted firmware. [company name redacted] does not claim, and never has, that a door protected by one of its products is impregnable. It is simply common sense that anyone with the time, sophistication and resources to engage in IOActive's methodology could more simply defeat a [company name redacted] product by drilling the lock off the door, or for that matter chopping the door down with an axe. To suggest, as your report does, that [company name redacted]'s products suffer from "severe" vulnerabilities simply because you were able to develop a bypass in your lab ignores the fact that the exploit in question was not possible without the use of costly and sophisticated lab equipment and highly skiled technicians—not exactly a real-world scenario for the intended use of [company name redacted] products.

An IOActive spokesman said the company has no indication CyberLock will take any legal action.

While most or all of the attacks described in the advisory require physical access to the lock—presumably in highly secured and monitored areas—the reported vulnerabilities are nonetheless serious. That's because the threat models the locks are intended to protect against include the types of rogue employees and extremely sophisticated and persistent adversaries known to target high-security sites. Facilities that use or have used CyberLock products include the Amsterdam Metro, the Cleveland Transit Authority, the Clark County (Nevada) Fire Department, the Temple Terrace (Florida) Police Department, the Atlanta-Fulton County Water Treatment Facility, Seattle Public Utilities, and Tacoma, Washington's Broadway Center for the Performing Arts. CyberLock marketing materials also promote its use in airports, and in facilities that require certification from the North American Electric Reliability Corporation.

As the IOActive report noted, one of the key selling points of CyberLock is that keys can't be cloned, either from a lost or expired key or from analyzing the lock itself. The exploits the researchers describe may have their limitations, but if they work as described, they completely undermine that assurance.