Avoiding Bluetooth Security Vulnerabilities with your Access Control System

Bluetooth is a useful technology not just to connect your electronic devices but also to let you in and out of a secure building. Many access control systems use Bluetooth signals to recognize authorized users and allow them in. However, any system using Bluetooth or Bluetooth Low Energy (BLE) should actively defend against the known vulnerabilities of the system.

Just as Windows can get a virus, a Bluetooth system can get hacked. Microsoft is always updating their software to avoid these problems and protect Windows, and your access control system should be aware of and protect your access control system from known vulnerabilities. Here’s what you need to know about avoiding Bluetooth security vulnerabilities with your access control system.

Known Bluetooth Vulnerabilities

These are three known vulnerabilities of Bluetooth and BLE that any access control system should design against:

• BLESA: These are spoofing attacks against reconnections in BLE systems or when your phone in an access control system gets close enough to the building to again connect to the system.
• BLURtooth: These attacks take advantage of the cross-transport key derivation (CTKD) built into every Bluetooth system. Initially meant to save time, hackers can use this ability to gain a key to the system.
• KNOB attack: This attack is a little more complicated, essentially involving a brute force attack against the keys. It is a manipulation of the entropy negotiation and can allow hackers to read and change information sent through Bluetooth.

All of these attacks are essentially a way for a hacker to intercept, read and modify a Bluetooth signal, bypassing the encryption that normally ensures the system’s integrity.

Secure Bluetooth Access Control with PDK

Bluetooth can provide a convenient way to use a smartphone as an access credential, but convenience should not come at the expense of security. CLAD installs ProdataKey (PDK) access control systems, which support Bluetooth Low Energy (BLE) mobile credentials as part of a broader commercial access control platform.

With the PDK Access app, a mobile device can communicate with a compatible access control reader using BLE, allowing an authorized user to unlock a door with their smartphone. Unlike a conventional physical key or basic proximity credential, a mobile credential is associated with the user’s device and can be managed digitally through the access control system.

Security Beyond the Bluetooth Connection

A secure access control system depends on more than the wireless connection between a phone and a reader. The communication between readers, controllers, credentials, and the access control platform also needs to be protected.

PDK’s Red access control hardware supports Open Supervised Device Protocol (OSDP), which provides bidirectional encrypted communication between compatible readers and controllers. PDK’s Red Readers V2 also support high-security credentials using MIFARE DESFire EV3 encryption in addition to Bluetooth, proximity, and mobile credentials.

This gives businesses the flexibility to select credentials appropriate for different users and security requirements. Depending on the system configuration, a facility can use mobile credentials, high-security cards or fobs, PINs, or a combination of credential technologies.

Is Any Access Control System Completely Secure?

No access control technology should be treated as invulnerable. Physical security, credential management, network security, properly configured hardware, and ongoing system administration all contribute to the security of an access control system.

That’s why CLAD looks at the complete opening rather than treating the reader as a standalone security device. A well-designed system may include secure readers and controllers, electrified door hardware, commercial-grade locking hardware, properly configured credentials, and access permissions appropriate for the facility and its users.

PDK systems also allow administrators to manage access digitally through PDK.io. If an employee leaves the organization or a credential should no longer have access, permissions can be changed or revoked without mechanically rekeying every affected door.

If you’re considering mobile credentials or upgrading an older card-access system, CLAD can evaluate your existing doors and help design a commercial access control system appropriate for your building’s security and operational requirements.