The "Badlock" vulnerability

I don't think Metze can be blamed (or take credit) in any way for that website. It was created by his employer, but that's as far as his involvement goes I believe :-). The credit (or blame) for badlock.org rests entirely with SerNet.

Oh, yes, totally. The word 'original' in my response was to indicate where this all started at all.

Turnstiles are not magic. I live in a city with a popular football (soccer) team and so large perhaps slightly drunken groups of fans are often to be found in the city's railway stations. If I sit and watch for a few minutes as they arrive, I will invariably see, first, a group approaches the person on duty at the stations gate line, they provide a distraction, perhaps they demand kisses, or want the employee to wear a silly hat or advise them on how to reach a distant place. While they do this, two people enter the turnstile with one ticket, the barrier opens, both push through at once, an attentive employee would see this clearly illegitimate behaviour and have the opportunity to demand to see both tickets, but the employee is distracted. A fan travels for free. Physical access control always has a human element, and humans are fallible.

Actually the turnstile is generally a bad sign. That means so many people are passing through that you're not even trying to identify them any more and instead rely on the physical token, usually from HID corporation.

One of the annoying things about me as an employee (or indeed customer) is that I insist on trying things the corporation claims to do but actually just wrote down in a security policy manual and forgot about. As I've written before, I'm the person who phones a sysadmin to ask if the encryption keys are supposed to have changed rather than just clicking past the warnings. So whereas a lot of people have a superficial idea that their workplaces are "secure" I end up actually knowing the (usually dismal) truth about places I work or routinely visit.

I have worked in one (1) place where the turnstiles worked and the policy was enforced. Everybody there disliked it, but at some point something bad enough had happened that managers actually cared. I have had to get a senior manager to come vouch for my manager to get them into the building, which is a good sign. Of course that place also had a strict no cameras rule, but if you care about security you may have seen hidden camera footage from inside it, taken by a reporter who'd been hired for an entry-level job and thus had a legitimate access card. That footage cost them a not inconsiderable amount of money. So, they were sincerely trying but it's hard to call it an unqualified success.

I have worked in at least six other offices or buildings which had turnstiles but either tailgating was widespread or security staff routinely waved people through without properly checking their ID. So those turnstiles were theatre only. I have no doubt whatsoever that I could visit those places today and plug something into a Cat5 network port without being arrested and probably without even being asked any awkward questions despite not having any valid ID.

However I have worked at two very small offices where everybody knew every other employee by name and face, where to get into the building required that somebody get up, come open the front door and let you in. _That_ is a scenario in which it's hard to exploit something like Badlock. A grey hat physical penetration guy once told me that a good sign for an actual secure environment is that the people working there have to do their own cleaning - if they don't it means a contract cleaner (laughably "vetted" by someone whose goal is to pay as little as possible and avoid annoying the client) has physical access out of hours. Being small though, none of those places used Active Directory and so they weren't vulnerable to anything like Badlock.

Good point. I'll look into what we can do to allow users to disable this. Don't suppose you'd like to log a bug on this at bugzilla.samba.org ? That would help me remember (I'm out next week giving at talk at Vault).