Server-room lock was nothing but a crock

Welcome back to Pwned, the column where we immortalize the worst vulns that organizations opened up for themselves. If you’re the kind of person who leaves your car doors unlocked with a pile of cash in the center console, this week’s story is for you. Our tall tech tale of woe comes courtesy of a reader we’ll Regomize as Pete …

[Anonymous Coward]

Just walk in like you own the place

This is many, many years sinceupon, while an uncle of mine was a) still alive and b) still working.

He was working at the Design Centre and I remember him recounting a time when the place has an exhibition of very upmarket showers in the foyer.

A Transit pulled up and a couple of guys in overalls, carrying tools walked in. They proceeded to carefully dismantle one shower and carry the parts out to the transit. Helpful folk held the door open for them as they took bigger bits out.

They sheeted the load down and drove off.

They'd simply walked in and nicked it!

[Doctor_Wibble]

Re: Just walk in like you own the place

> a couple of guys in overalls, carrying tools walked in

Just like with a hi-vis and a clipboard :)

[GlenP]

Re: Just walk in like you own the place

Same thing happened at the University, two men in white coats walked in to a lab and loaded an expensive piece of kit onto a trolly then walked out - nobody thought to ask for any ID or anything.

[Terry 6]

Re: Just walk in like you own the place

At my uni, in the late 1970s it was a TV in the halls of residence. Blokes in overalls walked in. Switched off the TV, unplugged and walked out with it, quite casually.Would be put down to apocryphal had it not been for the lack of TV in a space where TV had been the day before, and a management spitting blood.

[KittenHuffer]

Re: Just walk in like you own the place

Was there a time when b) was true but a) was not?!?

[Helcat]

Re: Just walk in like you own the place

You know there are times it happens (sort of).

Specifically where identity theft is involved. But also where records aren't updated so someone who is life extinct is also still listed as employed, or on benefits etc. It happens where systems aren't allowed to talk to each other.

[MiguelC]

Re: Just walk in like you own the place

At a previous job it frequently felt like that. That why I no longer work there.

[Martin an gof]

Re: Just walk in like you own the place

Sounds like the Laundry Files' Residual Human Resources.

M.

[Dr Dan Holdsworth]

Re: Just walk in like you own the place

This happened once at a metalworking factory; an HGV turned up, backed up to the loading bay perfectly and the driver then turned up with a loading list as per normal. The staff in the loading area, never the sharpest tools in the box, looked for and loaded the requisite pallets onto the truck which the driver checked, tied down, signed for and then drove off. As he did so the foreman came running up:

"Who was that? We're not expecting a truck today!"

"'S OK, he's signed for it."

"Yes, but WHO was he?"

This bloke had presumably done his research and likely had inside info because he asked for stuff that was ready and waiting and followed the procedures that the place used. Nine times out of ten following the established pattern will get someone into any system without questions. If you wish to reconnoitre an area then a cheap suit and a Hi-Vis tabard labelled HMRC will make you invisible to practically everyone; a clipboard helps this effect along even further. A Border Agency tabard will likely establish an exclusion one into which the security staff will not set foot.

[The Oncoming Scorn]

Re: Just walk in like you own the place

A Pharma tale, as huge chunks of GSK Dartford was being closed down, manufacturing equipment was shifted to other sites.

Thus it came to pass that a pill pressing machine was wheeled out of a building, down the hill towards the security gate, the guard helpfully opened the barrier as they approached & exited, then instead of crossing the public road to enter our other site, did a sharp right & loaded the equipment into a car parked 100 yards away.

[Anonymous Coward]

Re: Just walk in like you own the place

This happened at a brewery near me. Someone pulled up to the loading dock with a lorry, the driver exited with a clipboard in one hand and proceeded to load crates of beer onto the lorry. Then he drove off.

Everyone was used to lorries from the local stores showing up and 'helping themselves' (with an order already lodged, of course), so when a trucker showed up and acted as if he had a right to those crates, no one batted an eye.

And at a local mall, a couple of guys in overall walked in, unplugged and loaded one of those coin-op rides on a trolley, no one batted an eye.

[Anonymous Coward]

Re: Just walk in like you own the place

Many years ago, our local Currys was shoplifted several times by someone wearing a white "lab" coat walking out with a TV or other expensive bit of kit.

[Anonymous Coward]

Re: Just walk in like you own the place

These days of risk and liability, all you really have to do to shoplift is walk out without paying. Most retailers did the math, and realized that the risk of employee injury/death and bad PR was much more expensive than just letting them go and charging them later with all the video evidence they tend to have available these days.

I've seen what the security cam server racks at a [store I can't reveal the name of] look like. There are cameras in so many places, including some in the fixed part of the frame of the sliding entry doors to get good face photos.

[jvf]

labcoats rule

It could get boring in our lab for several days at a time as tests were run. In order to look busy, I’d grab my clipboard and stare at it while wandering through the office areas wearing my lab coat. No one ever asked what I was doing there, just smiles and greetings.

[collinsl]

Re: labcoats rule

And in your wake a new employee asks "who's that?", and gets the reply "oh, don't mind them, they're just a bit eccentric, they don't like to show that they have no work to do"

[Anonymous Coward]

Re: Just walk in like you own the place

A long dead acquaintance of mine used to be a very bad person, think firearm assisted withdrawals from banks and post offices and a very loose understanding of property ownership and you're probably not even close.

He was a mostly reformed character when I knew him (thank %deity) but he had a wealth of stories which he could back up with proof

Once upon a time he needed a new washing machine so he walked into the local branch of Rumbelows (long defunct UK electrical retailer) wearing a dust jacket, holding a clipboard and pushing a hand truck.

He picked up the most expensive machine on display, waved the clipboard at the staff and walked out with a brand new washer.

[Anonymous Anti-ANC South African Coward]

Re: Just walk in like you own the place

Rumbelows - haven't heard that name in yonkers!

[DS999]

Or in the US wear an ICE jacket and mask

Then you can not only take stuff, but PEOPLE!

[Anonymous Coward]

Re: Just walk in like you own the place

A man with a recovery truck went to the garage where my car was being mended, said "I've done to pick that up for scrapping", was given the keys and drive away with it. The receptionist at the garage had the sense to photograph his vehicle, and the police were able to tell me from that that he already had two convictions for the same thing. However in my case they took nine months to tell me that they would be taking no further action.

That's Police Scotland for you. Strong on thought crime, unconcerned by actually-nicking-stuff crime.

[Rob Daglish]

Re: Just walk in like you own the place

We had something similar with the trees on the side of a new bypass. Lots of men with hi-vis and pickup trucks spent weeks planting them, and about a week later a similar team of men in similar looking pickups came and removed them. It was only weeks afterwards we found out they'd been nicked in broad daylight. Sometimes just looking like you're supposed to be there doing a task gets tou away with a lot!

[nohatjim]

Re: Just walk in like you own the place

It happened over a weekend at Lasmo oil while I worked there - lots of expensive 1990's era Sun Workstations - £10k each - 47 walked out the door - the security guard helped carry them to the lorry.....

[the spectacularly refined chap]

Re: Just walk in like you own the place

I've heard plenty of stories like that from one of the big motor shows, I forget which. The cigarette lighters get stolen multiple times a day along with some more ambitious stunts. One was like you describe, men in overalls went to a car and proceeded to remove all the seats, explaining they would get worn over the course of the exhibition if not replaced.

Of course when they went out the door they were never seen again.

[juul]

ISO certification VS security

An ISO certification is not about having the best possible security, it is crudely speaking a certification that you have change management process, where there is continuous improvement and management reporting.

The reason why they should not have the ISO certification is that their screening process did not detect that the manufacture of the lock, was not able to support them after they bought the lock, or that they change process did not detect this before installing the lock.

Something is missing in the story I think, why would it be a problem that the previous lock was controlled by the data center network, is that not suppose the be the most controlled and regulated network and therefor very secure and reliable?

[dinsdale54]

Re: ISO certification VS security

The less generous assessment from a friend who was an ISO9000 consultant was "It won't stop screwups but you'll know whose fault it was"

[alain williams]

Re: ISO certification VS security

Not always.

Some 30 years ago I spent a year working for a large company that provided IT services. Two departments worked back to back. They went through ISO9000 assessments 6 months apart.

There was one aspect that was really hard to be compliant so my department pushed the burden to the other one. 6 months later they pushed responsibility to us.

[herman]

Re: ISO certification VS security

That is OK, if you had a process defined for that!

[CrazyOldCatMan]

Re: ISO certification VS security

The less generous assessment from a friend who was an ISO9000 consultant was "It won't stop screwups but you'll know whose fault it was"

Our old ISO assessor (we had 9000 and, briefly, 27001) summed it up thusly: "We want you to have a procedure and follow it, with evidence that you have done it. Doesn't matter if it's crap as long as you do CI on it.."

[Anonymous Coward]

Re: ISO certification VS security

"We want you to have a procedure and follow it, with evidence that you have done it. Doesn't matter if it's crap as long as you do CI on it.."

I always use McDonalds as an example: their food may be crap but ISO 9001 ensures that their food is consistently crap in every store.

[Richard Pennington 1]

Re: ISO certification VS security

It was ever thus. I'm retired now, but (back in the day) I used to do security evaluations, and much the same applies.

It [ISO9000 etc.] won't prevent the next disaster, but it will make sure the next disaster is fully documented, and that the documented procedures were correctly followed.

[Sorry that handle is already taken.]

Re: ISO certification VS security

I spent a brief amount of time working in India about 20 years ago. Every business loudly and proudly advertised its ISO9001 certification, no matter what it was the business did...

[Daedalus]

Re: ISO certification VS security

Just like they all announced CMM level 5 compliance back in 2000 AD. The worst part was that so many companies in the USA and elsewhere took that as gospel. In a world where Micro$oft had self assessed at level 3.

[Paul Hovnanian]

Re: ISO certification VS security

Micro$oft had self assessed at level 3.

That just means they have a planned process for releasing bug fixes. Nothing about why they need to make so many.

[Someone Else]

Re: ISO certification VS security

Micro$oft had self assessed at level 3.

Being generous, I wot.

[Dante Alighieri]

Re: ISO certification VS security

So did Tharg sign off, johnny Alpha or Judge Dredd?

[KittenHuffer]

Re: ISO certification VS security

I always ensure that companies I work for are ISO 3103 compliant!

------> Not possible to get the correct keyboard effect otherwise!

[The Oncoming Scorn]

Re: ISO certification VS security

I didn't have to click that link as I include that on my resume.

To date nobody in a interview has called me out on that.

[J. Cook]

Re: ISO certification VS security

... and here I thought that was a joke, much like the RFCs published on April 1st in the US.

[Richard 12]

Re: ISO certification VS security

You don't want to actually drink a BS 6008 cup of char.

It's about consistency. Once you find a blend you like, it's important that it's similar next year.

[Someone Else]

Re: ISO certification VS security

If one fails to attain that certification, is the rejection letter accompanied by a 418 error?

[doublelayer]

Re: ISO certification VS security

"why would it be a problem that the previous lock was controlled by the data center network, is that not suppose the be the most controlled and regulated network and therefor very secure and reliable?"

That's not what it said. It said that "One vulnerability that showed up as part of the initial security screening was that the server room network was connected to the production datacenter network, so anyone entering that room could get all kinds of access."

That suggests lots of problems with network administration and physical security. It isn't clear what kind of locks if any they had on the server room before, but it seems that they couldn't count on it keeping people out. Worse, it seems that access to the room granted access to something on another network which probably needed better controls over which devices are permitted to connect and what they're permitted to access which, even if the lock was suitable, wouldn't have been fixed. I don't see anything suggesting the old lock was network-connected at all, and if it was on this kind of network, I'm not certain that would have been secure or reliable.

[NetMage]

Re: ISO certification VS security

What previous lock?

[Anonymous Coward]

Re: ISO certification VS security

In my experience, ISO-9000 certification means that you have a large filing cabinet labelled "ISO-9000" and some manuals nearby. My portion of the ISO-9000 certification paperwork was (only slightly paraphrased) "Use computer to work on job."

[Anonymous Coward]

Re: ISO certification VS security

I do consultancy work including for some very security & quality conscious military, aerospace and pharma organisations. I am usually asked if I am ISO 9001 certified (which I am not). If not, why not?

Simple, everything I do is a bespoke piece of work. No two sites or installations are identical.

To this end I have a small number of templates which contain basic details of the legislation that I am working to plus a layout format for each type of customer.

Some years ago I was quoted several £1,000s to "certify" me to 9001.

ISO 9001 is not a quality standard, it's a consistency standard, designed for people making widgets to a tolerance. It doesn't matter what the tolerance is, as long as you have a procedure for making the widgets and check that they are within the tolerance, even if the widgets (or a significant number of them) are so badly made that they are not fit for purpose.

One of my large company competitors lists compliance with several ISO standards including 9001, but one of their reports was recently rejected by UK HSE as being unfit for purpose! I know this because I was asked to re-do the work.

Several of their other reports I have seen were at a level that I would be ashamed to have written, but they have a "quality process" and therefore can be certified.

[seven of five]

Re: ISO certification VS security

> ISO 9001 is not a quality standard, it's a consistency standard, designed for people making widgets to a tolerance. It doesn't matter what the tolerance is, as long as you have a procedure for making the widgets and check that they are within the tolerance, even if the widgets (or a significant number of them) are so badly made that they are not fit for purpose.

This. You can make ISO 9001 compliant lifevests out of concrete. SOLAS will not like them, but ISO9001 is fine with it. I am not sure you could change them to a floating material without re-doing your 9001 certification...

[Richard 12]

Re: ISO certification VS security

Products cannot be ISO900X certified, only processes.

So you can change the concrete to closed cell floatation foam, but you must follow The Process.

[Strahd Ivarius]

Re: ISO certification VS security

Any company using MS software can't receive any ISO certification, then?

[John Riddoch]

"Don't pound on mouse like a wild monkey"

I'm reminded of the old bug report you used to be able to find in Sunsolve (fantastic resource, which of course Oracle killed). "Workaround: don't pound on mouse like a wild monkey".

For context, mashing the mouse buttons in CDE could cause the calendar manager (dtcm) to crash. They did fix the bug, but the workaround was also listed in the bug report.

[Anonymous Coward]

Re: "Don't pound on mouse like a wild monkey"

I had a 'bug' like that just the other day, somehow a user was holding down the F1 key, which was attempting to login a different user on every keypress, which disrupted what they were trying to do*. Not exactly a bug, but the 'fix' was the same: "ask the user to make sure there wasn't anything resting on the keyboard".

* Deliberately being a bit vague here

[Aladdin Sane]

Lockpicking lawyer, is that you?

[Maximus Decimus Meridius]

The best LPL video I ever saw was the gun safe where, by removing the recessed plastic handle used to pull the door open, you could put your hand inside and remove the gun without opening the lock. https://www.youtube.com/watch?v=gJrSWXFXvlE

Well, technically the best video was one where he got into the ex girlfriends' back door, but that is a different matter. https://www.youtube.com/watch?v=Joed0P3hhbc

[Sorry that handle is already taken.]

Well, technically the best video was one where he got into the ex girlfriends' back door, but that is a different matter.

LPL has done an April Fools video every year for the last eight, beginning with "Manipulating My Tiny Coq" and ending (so far) with "Getting Into My Wife’s Furry Fanny".

[Sorry that handle is already taken.]

Readers of this website and PWNED in particular might be interested in a keynote speech the LockPicking Lawyer gave to Saintcon a few years ago.

[khjohansen]

Not LPL

... Deviant Ollam, here to inspect your elevator (allegedly)

[Aladdin Sane]

Re: Not LPL

Trying to inspect my elevator? You're going down.

[Anonymous Coward]

I read parts of that story in his voice.

[Pete Sdev]

Well done

Well done to the junior sysop for applying the monkey test - a key part of QA.

[Anonymous Coward]

I have a lockpick set in my laptop bag

and i know how to pick basic locks.

Amazing how many keys get "lost" in dysfunctional departments.

[KittenHuffer]

Re: I have a lockpick set in my laptop bag

As part of my EDC I have a small 'scarab' multitool (with small screwdriver blades) and a titanium tootpick.

Several years ago one of my younger colleagues had left their desk key at home, and was trying to get into their desk. I popped round to them, applied torque with the screwdriver, 'jiggled' the pins with the toothpick, and unlocked the drawer in less than 5 seconds!

Though this was more a product of the awful quality of the desk drawer locks than my skill as a lock picker!

[Anonymous Coward]

Re: I have a lockpick set in my laptop bag

Desk and filing cabinet locks are usually so terrible that picks aren't required. I've had to deal with too many lockouts to count, and it's rarely worth the time to go get a real set of tools.

Just need two paperclips: one unrolled, to manipulate the mechanism, and a second whose loop has been squashed a bit to provide tension.

[Doctor Syntax]

Re: I have a lockpick set in my laptop bag

Who needs paper-clips when an office is fitted out with filing cabinets, all with the same key?

[KittenHuffer]

Re: I have a lockpick set in my laptop bag

For medical reasons I'm not allowed access to paper clips! ..... So I just carry around a world class physicist instead!

[The Oncoming Scorn]

Re: I have a lockpick set in my laptop bag

You are Trin Tragula & I claim my five pounds.

Hows the wife?

This must be Thursday I never could get the hang of Thursdays.

[Anonymous Coward]

Re: I have a lockpick set in my laptop bag

... or worse, they use a very well known key with a biting that's public knowledge.

one of the better known datacenter cabinet makers in the US has the same lock with the same biting for every single cabinet they make- the good old CH751. I won't say who it is, because the cabinets are otherwise world-class quality.

It's primary purpose is to (presumably) keep the doors from flying open on accident, or to keep honest people honest.

We had our in house access control people re-key a set of the cabinets to a different biting for a specific purpose, and they complained that the cylinders were the worst wafer lock style ones they've ever encountered, but managed to make it work.

[xyz123]

Re: I have a lockpick set in my laptop bag

The trick is to have Fake Doors!

Hundreds of them! Try finding the server room schmucks!

[Pussifer]

Re: I have a lockpick set in my laptop bag

Real Fake Doors - SFW - https://youtu.be/6h58uT_BGV4?si=6x0IfLOts3NPLlbl

[M.V. Lipvig]

Re: I have a lockpick set in my laptop bag

If you choose this method, Security must be made to open every door several times a day. If not, you soon have a number of dusty but otherwise pristine doors, and one that shows wear.

[KSM-AZ]

Re: I have a lockpick set in my laptop bag

No--- just move all your stuff every few hours so it's behind a different door!

[xyz123]

Re: I have a lockpick set in my laptop bag

Bump Keys.

Friend at a previous job had a set. He proved to management how effective they were by opening around 12 doors in a row in the "executive floor area". Each one within 3-5seconds. Thats including the time to move from one door to the next

They quickly changed to an ID Pass/PIN system for all secure areas.

[Strahd Ivarius]

Re: I have a lockpick set in my laptop bag

PIN for a secure area?

0000, as usual?

[PB90210]

Re: I have a lockpick set in my laptop bag

Had a colleague lock a bunch of keys, including the key to unlock the drawer, in a desk drawer. We managed to find a key in that big box of 'spare keys that once belonged to something important in the building' that would open the drawer if you jiggled it.

I actually observed him doing it. He used the key to open the drawer BUT turned the key back to the LOCKED position before taking it out. He then tossed the bunch of keys into the drawer... he then managed to nudge the drawer closed... CLICK... and it was locked.

[Anonymous Coward]

Re: I have a lockpick set in my laptop bag

I have a Yale key safe (yes I know it can allegedly be opened with a potato) with a keypad for the electric opening mechanism and a physical backup key in case the battery runs out preventing the electronic open mechanism working. Setup guide tells you to "store the backup key in a secure location" .... followed by "DO NOT STORE THE KEY INSIDE THE SAFE"

[Anonymous Coward]

Re: I have a lockpick set in my laptop bag

We had the battery run out on a tape safe, maybe 2 years ago. No physical backup key on that one! Turns out the solution was to grab the big round keypad with both hands and YANK straight up (not out). Its electrical cable stays attached to the safe, but the battery is on the back of the keypad.

Of course, I had disassembled the keypad from the front, breaking some plastic tabs in the process, to find that out...

[Andy A]

Re: I have a lockpick set in my laptop bag

My mum has two safes, each with the "emergency" key stored in the other. It took me a whole week to convince her that this was more sensible than leaving them in a vase on the shelf.

[Anonymous Coward]

Re: I have a lockpick set in my laptop bag

Back in my days as a PFY, I was assigned to perform RAM upgrades. An upcoming ERP rollout meant that we needed to bump everyone up to something crazy like 16 MB of memory. Post upgrade, I also needed to log in and do something else (might have been mapping a new server or similar).

I discovered that one rather paranoid user locked their keyboard in their desk drawer. Sure, I could have walked back to the IT storage closet and grabbed a spare, but it was more fun to pick the lock. Ok, "pick" is overselling it. A small screwdriver for tension and a straightened out paperclip as a rake gets the job done.

For bonus points, I put our standard "IT was here" form on top of his keyboard, and relocked the drawer.

[Anonymous Coward]

Re: I have a lockpick set in my laptop bag

Maybe he had OCD and didn't want anyone else touching his keyboard?

[Anonymous Coward]

Re: I have a lockpick set in my laptop bag

I lock my keyboard in my desk drawer. It's a non-standard keyboard and I want it to be still around next time I'm in the office. There is a standard keyboard on the desk as well.

[NXM]

Re: I have a lockpick set in my laptop bag

My mum had a then flashy Peugot 205 GTI. One day the wind blew the door shut with the lock popper down, and we were locked out. Having seen kids nicking cars on the telly I borrowed a coat hanger from someone, bent it into a hook, put it down next to the window and pulled the popper up!

Most security is there for show.

[Bebu sa Ware]

The number of machine rooms I have seen …

that have false ceilings with the ceiling void shared with the surrounding less secure rooms and often the whole floor.^†

You would think if you had decent physical security on the room's door(s) - most do - that intrusion detectors in the roof void and in the room itself would be de rigeur. Not a bit of it.

Most network cabling isn't physically secure either and often runs in the ceiling void in open cable trays. A clever eavesdropper could intercept the traffic by interposing some type of bridge/router. A decent reason for encrypting traffic at the ethernet level I suppose.

After a respectable number of decades I concluded that real security is the merest drop drowning in an ocean of performative security and has always been so.

_{† Raised or false floors are often just as bad.}

[Aladdin Sane]

Re: The number of machine rooms I have seen …

Most security is more of an embuggerance to ne'er-do-wells than something that'll actually stop them.

[Anonymous Coward]

Re: The number of machine rooms I have seen …

In my experience (>30 years as a management systems auditor - client/sector specific, not ISO, etc) most security measures are a nuisance to legitimate staff - they hardly about to a low bar for genuine miscreants.

[Aladdin Sane]

Re: The number of machine rooms I have seen …

I recall a YT video a few years back where a man went shopping in the departures area of an airport and managed to make a quite serviceable weapon. This was with the blessing of the airport company though.

[disgruntled yank]

Re: The number of machine rooms I have seen …

Back in the last century, I came into the office on a weekend, and discovered that my office door was locked. The ceiling had acoustic tiles, so I commandeered the stake for a potted plant down the hall, stood on a chair, pushed the tile aside, and used the stake to push down on the inside door handle.

For a while after that I was pretty good about carrying the office key.

[The Oncoming Scorn]

Re: The number of machine rooms I have seen …

I was minding my own business deploying kit (GSK Stevenage this time), when the head of site security stopped & asked me about the reliability\security of Kensington locks.

Then I asked why & it transpired someone over the weekend had got into a unsecured room, worked their way into a locked room by way of the ceiling tiles, crawling over the partition wall & dropped themselves to the floor leaving foot prints on the desk.

We lost so many laptops there some stolen almost nightly by night shift guards in our offsite provisioning center (Wiping the card swipe access logs), the best one was deploying a laptop to a lady on a wet Thursday afternoon & then deploying a new one to her on equally wet Monday morning as she & her boyfriend had gone to Tesco, leaving both their laptops on the back seat which was promptly broken into by smashing the window (At least we still had her laptop to do a profile data copy).

[Rob Daglish]

Re: The number of machine rooms I have seen …

Haha, reminds me of one of our cabling team...

We had two (very good) cablers, who the LA would only employ on short term contracts of around 3-6 months. The LA provided all the gear though, but not a van to transport it in, so they used their own cars. Occasionally, the contracts wouldn't get renewed until after the previous one ended because LAs can move slowly when having to spend money.

Mysteriously, on those occasions, one of the teams car would be broken into, and various power tools nicked...

We all had a pretty good idea what was happening, but proving it was a different story

[Mr Sceptical]

Re: The number of machine rooms I have seen …

Presumably none of them had fire supression systems since they'd immediately blow out all the tiles as the pressure increased?

[David Hicklin]

Re: The number of machine rooms I have seen …

> that have false ceilings with the ceiling void shared with the surrounding less secure rooms and often the whole floor

I'll raise you on that and have a small server closet with a halogen discharge system. That wold have been exciting to go off with a blizzard of ceiling tiles.

[seven of five]

Re: The number of machine rooms I have seen …

Halon, not Halogen. And it is not allowed anymore for very good reasons. On the upside, you're already dead when the fire/smoke reaches you.

Related: the dispersal nozzles of fire suppression systems are capable of producing noise levels able to knock out disk arrays. Ask Rabobank (or was it ING?) how I know...

[Ken Shabby]

Re: The number of machine rooms I have seen …

Place I was at it in the mid 80’s, there Halon went off. Not only flying floor tiles but also instant fog and the loud bang made the one guy in there shit himself.

[petef]

ETI

In the 1970s there was a hobby electronics magazine called ETI. They published a circuit diagram for a lock using a numeric keyboard and a bunch of SCRs. Type the correct sequence of numbers to open the lock. Get one wrong and it resets. What they had failed to anticipate was that pressing all keys simultaneously would also open the lock.

[upsidedowncreature]

Re: ETI

I remember ETI, my dad was a regular reader. He even had a couple of articles published. I wanted him to build the Transcendent 2000 synth, a friend of his built one which I was fascinated by.

[David Hicklin]

Re: ETI

Still one of my favourite magazines, built a few things out of it and have most of them in PDF form.

[GlenP]

Secure...

I can claim I had some of the best physical security for a computer room that you'd find in an office outside of certain government departments. It had previously been a deeds store for a property company, 9" reinforced concrete structure (including the ceiling, which was a pain when we installed the cabling) with a Chubb safe door. There were only two keys, one in my possession and one kept in a hidden lock-box with only a couple of senior people having the code. It wasn't impregnable, nothing is, but it would slow down any miscreants for long enough.

Far worse was the situation I inherited with that company before we moved offices. The computer cupboard had a locked door, but the clearly labelled key was kept in an unlocked key cabinet in an office that wasn't permanently manned.

[The Oncoming Scorn]

Re: Secure...

Was the filing cabinet stuck in a disused lavatory with a sign on the door saying 'Beware of the Leopard?

It must be Thursday etc etc.....

[Luiz Abdala]

I call this "Security by Obscurity".

See title and icon.

[candyman76]

Re: I call this "Security by Obscurity".

I totally came here to say this exact thing! We had one app the user and password were the same single letter cause they did not like to type a lot. And another time a coworker was trying to get into a system, I said use admin and blank password. That has been years ago and he still mentions it sometimes. :)

[Ziggy182]

Fun article

My mother used to work for the BBC in the 70s, a bunch of men came in wearing boiler suits, came into the lobby with a clipboard showing a shipping order to move the Steinway Grand Piano they had, they covered it with blankets and all due care and loaded it up.

There was no such order and the piano has never been found

[collinsl]

Re: Fun article

There was a story told on the great programme "Tales of Television Centre", made just before they closed the famous question mark in London, where in the 70s during the heyday of Michael Bentine, a comic who had a habit of filming elaborate and quite funny sketches outside TV Centre (including one where he made it into a "rocket" which took off to the moon, starring Clive Dunn as a sort of Dr Who-esque figure), one day a group of masked bandits drove into the centre (past the Commissionaire (security) on the main gate who thought it was a Michael Bentine skit, ran into the building, broke into the cash office, knocked the staff on the head, stole the week's wages and drove out again, with the Commissionaire saluting them as they left!

[xyz123]

MacOS has a similar issue. Basically you can brute-force admin logins without entering a username/password by simply using a hardware macro keyboard to rapidly pummel Enter/Return.

Eventually the OS gives up and signs you in without credentials..which drops you to the administrator level.

This is why Apple doesn't use MacOS for its servers. It uses a mix of Windows Server and Linux.

[Anonymous Coward]

I have a door entry system, the sort used in office buildings and blocks of flats There is an outdoor unit, with a keypad, RFID reader, built in video camera and SIP phone, linked by ethernet to multiple indoor units with 7inch touchscreens, and it can be operated by a phone app as well.

There are two wires that run from the electric lock to the outdoor unit. The outdoor unit has a relay inside which connects the two wires in order to unlock the door.

It occurs to me that I could just smash the outdoor unit off the wall with a hammer, short those two wires together and the door would open. It would only take me a couple of seconds to gain access.

The majority of door entry systems seem to have this fatal flaw. Any sensible design would have a separate module on the inside of the door to drive the lock rather than driving it from the outdoor unit.

[KittenHuffer]

The physical security version of this!

[khjohansen]

.. A hammer??

You absolute brute! Try CH751, A126, 501CH or C415A ... from your "junk" keyring ;)

[J. Cook]

Re: .. A hammer??

... or an EK333.

Or anything from the "Cabinet Key Set" from Covert Instruments. :D

we have a bypass key for a very low end key box that uses, IIRC, a 001 biting or something equally ridiculous :D.

[GlenP]

When I've been involved in the installation of such systems in offices I've made it clear it is solely for when the premises are manned, the doors must be secured with keylocks out of hours.

[Mr Sceptical]

I've done the exact same thing to get into my office building at a weekend - using a small screwdriver only.

Most decent intercom manufacturers recognised this flaw and have a 'security relay' unit that controls the actual door release. It's connected to the intercom by a serial cable and effectively needs a valid access command to release. Not impenetrable but you'd need an identical intercom to circumvent it.

[David Hicklin]

> The outdoor unit has a relay inside

Just use a large magnet

[collinsl]

Properly secure ones don't - the card/PIN reader on the outside just sends the card details and PIN off to a central server, which then checks it's own database to see if the card is a) valid, 2. allowed to use that door, and iii.) that the PIN is correct. If all three are true, it will send an unlock command down a different cable to the magnet lock above the door (or if it's a fancy system, the external unlock inside the handle, which can also have a separate secondary lock within it like a tumbler lock or battery operated code lock).

[Anonymous Coward]

secure (doubtful)

A company had an ATE and the design servers/disks in a room.

To get in you needed 2 keys.

Unfortunately they had an external window for the room. One criminal and a brick ,the servers would be gone.

Shifting the ATE would be hard work. It weighs about a ton.

[seven of five]

Re: secure (doubtful)

Depends on the window. I know of windows which could take an hours toil with a Pickaxe or an entire Magazine out of an HK G3 rifle at 20 Metres... multi-layered glass, foil and lexane. Still transparent and not that heavy nor thick (comparable to triple layer isolating).

[andy the pessimist]

Re: secure (doubtful)

The glass looked normal thickness.

If you are using a pickaxe or G3 then take the whole lot. It's not worth my life.

[seven of five]

Re: secure (doubtful)

Sure, it's just - we made those windows, that is how I know.

[Anonymous Coward]

My dad showed me a vulnerability in the server room security where he worked...

He used the key to the server room door (so this was NOT unauthorized access), but instead of unlocking the door, simply put the key in the slot between the door and the latchplate, pushing the latch back far enough to open the door. It was faster to do this than unlocking the door the normal way.

Sometimes the security is just enough to keep the most casual attackers out. Getting in the building in the first place was somewhat more difficult.

[PB90210]

Re: My dad showed me a vulnerability in the server room security where he worked...

Seen something similar...

Heavy duty doors secured by swipe card and keypad... gap between the doors big enough for a credit card to pop the latch... now comes with heavy duty plate covering the latch area

[retiredmonkey]

How incompetent do you have to be to design a lock where pressing too many buttons "overloads" it and causes it to fail?

[Paul Hovnanian]

Most such locks are state machines. There's no text buffer to overload. Start in State 0. Push the correct button, advance to State 1. Anything else just knocks you back to State 0. You can hit buttons until the cows come home and only the best of improbable luck will get you to the "unlock" state.

[notyetanotherid]

Any such state machine should only reset to state 0 after the required number of digits in the code have been pressed otherwise you significantly reduce the number of key presses required to brute-force test every possible combination: e.g. if you reset immediately a wrong digit is entered, hitting 0123456789 tests up to 7 4-digit codes

[Richard 12]

The usual reset logic seems to be a timer.

Starts in state 0, first button press starts the timer. Any wrong button press puts it into state -1 where all buttons loop back to -1. Timer expiry resets it to state 0.

The final correct button places it into state Unlocked and stops the timer.

Some have an explicit "reset" button as well.

Usually the keypad is the most secure part, of course. It's the rest of the lock that's useless.

[Dante Alighieri]

Very Large Magnet

I was introduced to the new secure doors to an MRI suite. No strangers, visitors, waifs or strays.

The dept lead showed me. forgot keypad number. Was about to use intercom to contact internal staff (I was allowed in anyway).

I reached up to the power isolator switch installed above the doors, turned it off and walked in any way.

Word to the wise : Do NOT walk into an MRI suite without staff escort / permission - my day job

Jaw of colleague drops. Still there to the best of my knowledge. This was 20+ years ago. Certainly not fixed in the following few years I was there.

1.5T so objects levitate and fly - GIYF

[Daedalus]

Re: Very Large Magnet

In the early days of superconducting magnets I attended a talk by one of the pioneers in their use for the related field of NMR spectroscopy, which for those outside the field, requires an extremely stable RF signal.

After the exposition of How It All Worked the presenter recounted how an unfortunately placed metal chair flew across the lab and collided violently with the apparatus.

"At this point," he observed dryly, "we lost the frequency lock".

[Anonymous Anti-ANC South African Coward]

In one of the previous buildings my company was located in, the server room had a raised floor, and an electronic lock + keypad for the server room.

Easy to bypass as the latch was visible from outside the server room. You just need a screwdriver.

If that fails, the false ceiling will also allow you access, and so will the false floor.

The wall was drywall, not brick.

sheesh.

Nowadays in the current building both server room have proper safe doors (thick steel, heavy bigjobs. No raised floors or false ceilings either.

Although we got bitten by flooding in the front server room once - luckily it never happened again as we took precautions after that one time.

And no, the servers are not in a basement either.

The only weak link is the brick wall - all you'll need is a sledgehammer and some qualitay alone time.

[Mostly Irrelevant]

I don't trust electronic locks, I haven't ever seen one that can't be exploited by simple low-tech means. All you need is a screwdriver and a hammer to get in within a minute.

[Blackjack]

Why didn't they add a second lock that needs an actual key?

[timmy 2]

server room door lock

Our server room was in a 100 year old building, only had a spring-loaded deadbolt key lock on the door (tightfitting door original to the building) that opened outwards so they decided to install a battery operated electronic lock. Sure enough the batteries died a few years later (no published battery replacement schedule), we NEED to get in there. Maintenance took a look at the door, took out hammer and pin punch and proceeded to knock out the hinge pins, then used a thin prybar to pop the door out of the frame.

yep, battery replacement maintenance schedule published a few days later.