############################################
# ZKSoftware ZEM500 RFID Card Reader
# Date: 22.11.2013
# Vuln: Authentication bypass / Abuse of Access
###########################################
In a world which relies on technology heavily, the use of software and/or hardware to track people at office / work isn't new. It is actually quite old and a lot of systems are vulnerable. This is just my observation of ZEM500 hardware on a limited scope of attack.
Typical connectivity diagram from the ZEM500 Hardware to the network...
ZEM500 by ZKSoftware (Sold by ESSL India) is a biometric fingerprint
cum smart card system to authenticate and maintain user attendance in
corporate offices. The authentication (employee name, employee password) is encoded in a smart card like any other system. The ZEM500 runs a Linux kernel 2.4x. The device runs busybox linux and its based on fingerprinting.
Port Scan of the ZEM 500,
Telnet to ZEM 500,
Malformed packet for ZEM500 using Scapy,
Observing the traffic with Wireshark was not amusing and revealed employee login / log out details... For obvious reasons of confidentiality and safety, I won't post it online!
eSSL Time Track - Hardcoded Password,
Apart from the above mentioned authentication bypass, you can download a copy at www.esslindia.com/install/eTimeTrack.zip to manage the software
like a normal administrator would. eSSL resells the hardware in India. The management software has a hardcoded password for Windows and SQL Authentication. Weak Encryption, anyone?
Default install includes SQL Express for the management software. The software can be used to manage, maintain and fetch reports from the system.
The ZEM500 has WiFi capability and I never hooked my system to the firewire... Food for thought? ;))
Cheers,
Kish
