Mythbusters: Locks & Alarms

[Thorn]

Who watched the Mythbusters this week, and who was surprised in any way by the results on the fingerprint readers or the IR or sonic motion detector? Knowing the propensity for detecting flaws in locks/security around here, I figured a few of you must have seen it, and was wondering what the reactions were of other viewers.

Briefly, in case you didn't see it:
Fingerprint laptop "password" controller: Forget it. If you can get a decent latent fingerprint of the person, you own the laptop.
Fingerprint door lock, with "life detecting" technology: Ditto. Forget about it. If you can get a decent latent fingerprint of the person, you can walk through the door.

Both of these confirm what myself and other forensic examiners have noted in the past. The door lock, despite using "life detecting" technology, failed laughably. Either the company's marketing people are running the show and were telling outright lies, or their engineering section failed in testing or some other spectacular some way. By the way, while Jamie and Adam's techniques did work, the took the LONG way around. It was pretty obvious that they hadn't spent any time around a latent finerprint examiner. I was surprised they didn't get someone from the SFPD's Forensic Lab's Fingerprint Division to help them.

Sonic motion detector: Moving very slowly, a la Sneakers, defeated it. Soft, apparently sonic-absorbing materials made into suits or covers didn't defeat it, and were detected almost immediately. The surprise for me was seeing it defeated via a simple bedsheet held up by Kari.

IR motion detector: This worked despite the MB's best efforts. Heating the room, moving in different ways, cooling the external body temp, wearing different clothes and materials.

(Crossposted from the NS Forums.)

[TheCotMan]

Re: Mythbusters: Locks & Alarms

From Gummi Bears (2 and /.) to crime-kits with laminates to play dough (/.) and then back to gelatin with a master's thesis on the topic. (/.) --
Surprise at these devices being beaten shouldn't be much of a surprise.

What is funny, is how these same articles are brought up on /. along side other articles where businesses are trusting the flow of money to biometric systems.

One of the better reviews of biometric systems had some good wisdom to provide: (Paraphrased.)
Biometrics should be only one of several pieces of data to be used to verify a person is who they claim and validate them for access, and should not replace physical security (people with weapons) -- actually, many pieces of biometric hardware (just like simple locks) can be defeated with physical access and no physical presense to observe these devices being properly used.

Sadly, I don't remember where I read that.

[caffeine20]

Re: Mythbusters: Locks & Alarms

This was an awesome episode. I was horrified at some of the methods they used to bypass these supposed high tech security devices. just a note though, for those of you that have comcast cable tv, i found this episode within on demand under discovery.

i have to admit that when he used the peice of paper to open the door with the fingerprint scanner i almost shat my pants in awe.

definately one of the best episodes ive seen of mythbusters.

ide be interested in knowing who these companies hire to test the security of there devices and if there are third party companies who review and test products in a non biased environment.

[bascule]

Re: Mythbusters: Locks & Alarms

Makes me wonder how long until people realize that the overwhelming majority of door locks are worthless...

[renderman]

Re: Mythbusters: Locks & Alarms

One of the better reviews of biometric systems had some good wisdom to provide: (Paraphrased.)
Biometrics should be only one of several pieces of data to be used to verify a person is who they claim and validate them for access, and should not replace physical security (people with weapons) -- actually, many pieces of biometric hardware (just like simple locks) can be defeated with physical access and no physical presense to observe these devices being properly used.

Sadly, I don't remember where I read that.

All a part of the 3 pillars of authentication: Something you have, something you know, something you are. A smartcard with a PIN that requires your thumbprint as well is a fairly secure system.

Unfortunatly, the shmoo put it best: Something you lost, something you forgot and something you carved off with a circular saw (paraphrased, I think the last one was 'something you were')

These systems will always have a bypass mechanism that could be exploited for those cases when users are users and do something dumb.

[Deviant Ollam]

Re: Mythbusters: Locks & Alarms

Makes me wonder how long until people realize that the overwhelming majority of door locks are worthless...

i don't like to predict broad trends and watershed moments in technology since such predictions often fail... but the whole "bump attack" method (as i've said before) might just have the potential to wake up more people than we've ever seen keyed into security matters in the past. it's simple (both to understand and to perform) and it's a real "crowd reaction" sort of demonstration. (blunt forces, loud bangs, coupled with instant access) far more impact upon the viewer than simply picking a lock with tools, eventhough the latter may be much more elegant and skillful attack.

chances are this won't appear on most people's radar, but with each news report comes more raised eyebrows. hell, the recent CBS piece featuring marc tobias and i, some lock guy in florida contacted me asking if they could use my talk slides and images in a lecture before a neighborhood watch group. the word is spreading, just very slowly.