CFL Electronic Security Forensics 3 — Questions and Answers
Question 1: A forensic examination of an IP-based access control door controller reveals its default administrator credentials were never changed. What class of vulnerability does this represent?
- Zero-day exploit
- Default credential vulnerability (Correct answer)
- Man-in-the-middle attack
- Buffer overflow
Correct answer: Default credential vulnerability
Unchanged default credentials are a well-known configuration vulnerability that allows any attacker with knowledge of the device model to gain administrative access.
Question 2: During investigation of a commercial burglary, the forensic locksmith determines the electric strike was released without a credential. Which method should be examined FIRST?
- RFID relay attack
- Loiding the strike with a credit card or shim (Correct answer)
- GPS spoofing of the controller
- Firmware update exploitation
Correct answer: Loiding the strike with a credit card or shim
Electric strikes with inadequate dead-latch or latchbolt engagement can often be loided (shimmed) with a flexible tool, bypassing the electronic control entirely — the simplest and most common mechanical bypass.
Question 3: What is the forensic significance of a 'Request to Exit' (REX) sensor activation recorded in an access control audit log during a suspected intrusion?
- It proves a valid credential was presented
- It indicates the door was opened from the inside, suggesting an accomplice or prior unauthorized access (Correct answer)
- It shows the door alarm was triggered
- It records that the door was locked remotely
Correct answer: It indicates the door was opened from the inside, suggesting an accomplice or prior unauthorized access
REX sensors release the door latch from the secure side, so a REX event without a corresponding entry credential suggests someone was already inside or the sensor was manipulated.
Question 4: An OSDP (Open Supervised Device Protocol) reader is found to have been replaced with a counterfeit unit. What is the PRIMARY security advantage OSDP has over Wiegand that this attack was likely designed to circumvent?
- Higher card read speed
- Bidirectional encrypted communication between reader and controller (Correct answer)
- Support for longer cable runs
- Lower power consumption
Correct answer: Bidirectional encrypted communication between reader and controller
OSDP v2 provides AES-128 encrypted, bidirectional communication, making wire tapping attacks ineffective — attackers therefore substituted the reader itself rather than tapping the wires.
Question 5: When documenting an electronic lock for a forensic report, which data should be recorded from the lock's firmware?
- The color of the lock housing
- Version number, manufacturer, and last update date (Correct answer)
- The type of batteries installed
- The door thickness specification
Correct answer: Version number, manufacturer, and last update date
Firmware version, manufacturer, and update history establish the security patch level and can identify known vulnerabilities or whether unauthorized firmware modifications were made.
Question 6: A power line analysis of an access-controlled door reveals voltage spikes correlating exactly with unauthorized entry events. What attack technique does this pattern suggest?
- Signal jamming
- Power analysis attack or power disruption bypass (Correct answer)
- Bluetooth sniffing
- Social engineering
Correct answer: Power analysis attack or power disruption bypass
Deliberate power disruption (e.g., cutting power briefly) can cause fail-safe locks to unlock, and the correlation of power anomalies with entry events is strong forensic evidence of this attack method.
Question 7: In forensic chain of custody for electronic access control evidence, why must a forensic image be made of an access controller's memory before powering it down?
- To preserve battery life
- Volatile memory (RAM) containing recent event logs is lost when power is removed (Correct answer)
- To prevent the firmware from updating automatically
- To capture the current time displayed on the controller
Correct answer: Volatile memory (RAM) containing recent event logs is lost when power is removed
Access controllers often store recent events in volatile RAM that is permanently lost when powered down, making memory imaging before shutdown critical to preserving transient forensic evidence.
CFL Electronic Security Forensics 3
A forensic examination of an IP-based access control door controller reveals its default administrator credentials were never changed.
What class of vulnerability does this represent?