ZKSoftware ZEM500 Authentication Bypass - Update

A Brief Update To The Original Post on ZKSoftware ZEM500 Authentication Bypass

First things first, I am now on a sabbatical, pursuing alternate avenues for pleasure, not profit... I am semi-retired from security on my own terms... ;)

Username & Password for the device was "root:solokey" in 2013...

I believe that in addition to getting root, you could play with firmware, packets and the device's OS (busybox) if you are inclined to explore every filetype including elf, bat and sh files for getting a better understanding. You could ALSO use tftp / ftp, ssh or telnet to upload and download files (for reverse engineering the elf files). Firmware for the device comes in gzip or tgz (tarred-gzip) format.

I am NOT very sure or updated on the vulnerability as such. It may have been reported and fixed by now (I saw THIS in 2013) - I could be wrong, too... Since some vendors don't fix the vulnerabilities quickly.

Good luck playing with the device!

Cheers,
Kish

ZKSoftware ZEM500 Authentication Bypass

############################################
# ZKSoftware ZEM500 RFID Card Reader
# Date: 22.11.2013
# Vuln: Authentication bypass / Abuse of Access
###########################################

In a world which relies on technology heavily, the use of software and/or hardware to track people at office / work isn't new. It is actually quite old and a lot of systems are vulnerable. This is just my observation of ZEM500 hardware on a limited scope of attack.

Typical connectivity diagram from the ZEM500 Hardware to the network...

ZEM500 by ZKSoftware (Sold by ESSL India) is a biometric fingerprint cum smart card system to authenticate and maintain user attendance in corporate offices. The authentication (employee name, employee password) is encoded in a smart card like any other system. The ZEM500 runs a Linux kernel 2.4x. The device runs busybox linux and its based on fingerprinting.

Port Scan of the ZEM 500,

Telnet to ZEM 500,

Malformed packet for ZEM500 using Scapy,

Observing the traffic with Wireshark was not amusing and revealed employee login / log out details... For obvious reasons of confidentiality and safety, I won't post it online!

eSSL Time Track - Hardcoded Password,

Apart from the above mentioned authentication bypass, you can download a copy at www.esslindia.com/install/eTimeTrack.zip  to manage the software like a normal administrator would. eSSL resells the hardware in India. The management software has a hardcoded password for Windows and SQL Authentication. Weak Encryption, anyone?

Default install includes SQL Express for the management software. The software can be used to manage, maintain and fetch reports from the system.

The ZEM500 has WiFi capability and I never hooked my system to the firewire... Food for thought? ;))

Cheers,
Kish