UART Leaking Sensitive Data in dormakaba registration unit 9002
The dormakaba registration units 9002 (PIN Pad Units) have an exposed UART header on the backside. The PIN pad is sending every button press to the UART interface. An attacker can use the interface to exfiltrate PINs. As the devices are explicitly built as Plug-and-Play to be easily replaced, an attacker is easily able to remove the device, install a hardware implant which connects to the UART and exfiltrates the data exposed via UART to another system (e.g. via WiFi).
UART Leaking Sensitive Data in dormakaba registration unit 9002
The dormakaba registration units 9002 (PIN Pad Units) have an exposed UART header on the backside. The PIN pad is sending every button press to the UART interface. An attacker can use the interface to exfiltrate PINs. As the devices are explicitly built as Plug-and-Play to be easily replaced, an attacker is easily able to remove the device, install a hardware implant which connects to the UART and exfiltrates the data exposed via UART to another system (e.g. via WiFi).
If the 9002 is installed in an insecure location, it could be manipulated. Hardware access and special equipment is needed to exploit this vulnerability. Also, the manipulated device would need to be reinstalled. To mitigate this vulnerability for 9002 in insecure locations, a newer version of the 9002 (Serial number starts with: 0700039…) could be installed. Important: The version of the installed 9002 can only be checked on-site.
Configurations
Workarounds
Exploits
Credits
finder
Clemens Stockenreitner, SEC Consult Vulnerability Lab
The dormakaba registration units 9002 (PIN Pad Units) have an exposed UART header on the backside. The PIN pad is sending every button press to the UART interface. An attacker can use the interface to exfiltrate PINs. As the devices are explicitly built as Plug-and-Play to be easily replaced, an attacker is easily able to remove the device, install a hardware implant which connects to the UART and exfiltrates the data exposed via UART to another system (e.g. via WiFi).