Comments on: Social Engineering Your Way Into a Dorm Room http://cubist.cs.washington.edu/Security/2008/01/13/social-engineering-your-way-into-a-dorm-room/ Fri, 16 May 2008 17:08:33 +0000 http://wordpress.org/?v=2.5.1 By: Scott Wright http://cubist.cs.washington.edu/Security/2008/01/13/social-engineering-your-way-into-a-dorm-room/#comment-5157 Scott Wright Tue, 15 Apr 2008 09:27:42 +0000 http://cubist.cs.washington.edu/Security/2008/01/13/social-engineering-your-way-into-a-dorm-room/#comment-5157 This is an interesting topic. I'm not sure how much the actual door hardware has changed, but when I lived in a dorm, the universal room key was a margarine container lid with the lip trimmed off. Almost any room could be carded in less than a minute. So, changing locks wasn't the issue. They should have deadbolts, or other safeguards against carding. Also, don't forget detection is sometimes more cost-effective than prevention. Perhaps this is the case in a college dorm where tenants can change every few months. Somebody mentioned video surveillance, which may help, but would have to be more than a high corner angle in the lobby. My guess is that students of privacy protection would start to become the adversary, as they would for biometric solutions. It's a tough problem. Awareness goes a long way as both a deterrent and detection safeguard; especially for the key recovery staff of the dorm. - Scott This is an interesting topic. I’m not sure how much the actual door hardware has changed, but when I lived in a dorm, the universal room key was a margarine container lid with the lip trimmed off. Almost any room could be carded in less than a minute. So, changing locks wasn’t the issue. They should have deadbolts, or other safeguards against carding.

Also, don’t forget detection is sometimes more cost-effective than prevention. Perhaps this is the case in a college dorm where tenants can change every few months. Somebody mentioned video surveillance, which may help, but would have to be more than a high corner angle in the lobby. My guess is that students of privacy protection would start to become the adversary, as they would for biometric solutions.

It’s a tough problem. Awareness goes a long way as both a deterrent and detection safeguard; especially for the key recovery staff of the dorm.

- Scott

]]> By: Quine http://cubist.cs.washington.edu/Security/2008/01/13/social-engineering-your-way-into-a-dorm-room/#comment-4307 Quine Fri, 21 Mar 2008 17:47:49 +0000 http://cubist.cs.washington.edu/Security/2008/01/13/social-engineering-your-way-into-a-dorm-room/#comment-4307 Even the keycards are an improvement, cloning aside. With real keys, they wouldn't replace the outdoor locks every time someone lost a key, so for a whole $5 per dorm, you could get your own key that worked for any dorm you had a friend in for the rest of the year. And even changing the locks yearly was a new procedure as of 2002ish. Even the keycards are an improvement, cloning aside. With real keys, they wouldn’t replace the outdoor locks every time someone lost a key, so for a whole $5 per dorm, you could get your own key that worked for any dorm you had a friend in for the rest of the year. And even changing the locks yearly was a new procedure as of 2002ish.

]]> By: Quine http://cubist.cs.washington.edu/Security/2008/01/13/social-engineering-your-way-into-a-dorm-room/#comment-4306 Quine Fri, 21 Mar 2008 17:44:01 +0000 http://cubist.cs.washington.edu/Security/2008/01/13/social-engineering-your-way-into-a-dorm-room/#comment-4306 Believe it or not, this is an improvement over previous UW security methods. Back around 2001 (my freshman year), all they required was someone's Husky card to hold while you had the keys. So two people would go up, one would claim to be and locked out and the other one would put up his id. A record of the lockout was made, but not of the id provided. Believe it or not, this is an improvement over previous UW security methods. Back around 2001 (my freshman year), all they required was someone’s Husky card to hold while you had the keys. So two people would go up, one would claim to be and locked out and the other one would put up his id. A record of the lockout was made, but not of the id provided.

]]> By: Will http://cubist.cs.washington.edu/Security/2008/01/13/social-engineering-your-way-into-a-dorm-room/#comment-4281 Will Fri, 21 Mar 2008 13:27:34 +0000 http://cubist.cs.washington.edu/Security/2008/01/13/social-engineering-your-way-into-a-dorm-room/#comment-4281 Most of the ease of cracking these processes stems from how often people in college lock themselves out and how much more time it would take to ensure that you are who you say you are. Your own room break-in required you to forge a signature and pose as someone else. This is pretty serious and schools are not exactly the police if u know what I mean. The job of campus security is different from the police. The ultimate goal is not always perfect it is mainly to maintain the good image of the school. Most of the ease of cracking these processes stems from how often people in college lock themselves out and how much more time it would take to ensure that you are who you say you are.

Your own room break-in required you to forge a signature and pose as someone else. This is pretty serious and schools are not exactly the police if u know what I mean. The job of campus security is different from the police. The ultimate goal is not always perfect it is mainly to maintain the good image of the school.

]]> By: Karl Koscher http://cubist.cs.washington.edu/Security/2008/01/13/social-engineering-your-way-into-a-dorm-room/#comment-4240 Karl Koscher Thu, 20 Mar 2008 20:09:21 +0000 http://cubist.cs.washington.edu/Security/2008/01/13/social-engineering-your-way-into-a-dorm-room/#comment-4240 HFS has some strange policies. While I've never lived in the dorms, I've heard that if you check out a vacuum cleaner, you leave your Husky Card with them and they loan you another card to use the elevators. I'm guessing that those cards never expire, and give you access to all sorts of things. They're certainly not hard to clone (you can read them with the final CSE 370 project), so if you happened to clone one, you could potentially have dorm access for a very long time. HFS has some strange policies. While I’ve never lived in the dorms, I’ve heard that if you check out a vacuum cleaner, you leave your Husky Card with them and they loan you another card to use the elevators. I’m guessing that those cards never expire, and give you access to all sorts of things. They’re certainly not hard to clone (you can read them with the final CSE 370 project), so if you happened to clone one, you could potentially have dorm access for a very long time.

]]> By: lazer epilasyon http://cubist.cs.washington.edu/Security/2008/01/13/social-engineering-your-way-into-a-dorm-room/#comment-1921 lazer epilasyon Thu, 21 Feb 2008 00:12:14 +0000 http://cubist.cs.washington.edu/Security/2008/01/13/social-engineering-your-way-into-a-dorm-room/#comment-1921 yes very nice point thanks. yes very nice point thanks.

]]> By: ashok http://cubist.cs.washington.edu/Security/2008/01/13/social-engineering-your-way-into-a-dorm-room/#comment-182 ashok Fri, 01 Feb 2008 16:32:29 +0000 http://cubist.cs.washington.edu/Security/2008/01/13/social-engineering-your-way-into-a-dorm-room/#comment-182 I am tired of all the security questions, IDs and password. Why don't we ave biometric systems. I just stick my finger in the hole and it recognizes me through my unique finger print. Done! I am tired of all the security questions, IDs and password. Why don’t we ave biometric systems. I just stick my finger in the hole and it recognizes me through my unique finger print. Done!

]]> By: Sharon Denham http://cubist.cs.washington.edu/Security/2008/01/13/social-engineering-your-way-into-a-dorm-room/#comment-181 Sharon Denham Fri, 01 Feb 2008 16:27:15 +0000 http://cubist.cs.washington.edu/Security/2008/01/13/social-engineering-your-way-into-a-dorm-room/#comment-181 Security seems to be an on ongoing problem; it seems that each time we find the solution to the problem a new one arises!!!! Security seems to be an on ongoing problem; it seems that each time we find the solution to the problem a new one arises!!!!

]]>