Picking Electronic Locks Using TCP Sequence Prediction

Architecture and Background

Picking Electronic Locks Using TCP Sequence Prediction Ricky Lawshae Network Technician, Texas State University As networked building access systems become more and more popular, the security of using RFID, magstripe, and biometrics as authentication mediums is constantly under scrutiny. But what about the security of the access system itself?

Vulnerability Analysis

Is it possible to unlock a door by sending a spoofed command to it over the network, bypassing the need for an authentication medium entirely? (SPOILER ALERT: Yeah, it is.) Ricky Lawshae works as a network technician for Texas State University in beautiful San Marcos, Texas.

Exploitation and Demonstrations

He has been the technical lead on their electronic building access system for more than three years. Coupled with his life-long passion for hobby-hacking, he has managed to gain a unique perspective on the building access industry as a whole.

Remediation and Defensive Strategies

He is a relative newcomer to the scene, but has no shortage of enthusiasm, and is always willing to talk to anyone about hacking, door access, comic books, or whatever else the beer makes him say. Ricky currently holds both an OSCP and a GPEN certification. For copies of the slides and additional materials please see the DEF CON 17 Archive here: