A look at EAS

So far in all of my security posts, has been network and/or security related. This one speaks of a gig that I just finished from a pen-test project  that was conduct against a major retail operation.  A friend of mine,  hired me on as a augmenter to a team of pen-testers, for a  project that was currently under way.

I came on initially for network penetration testing and firewall policies review.  Since the project had a requirement for conducting site physical security  test and penetration, I was able to suggest to  the project manager ,  if we could include product security;  “as in anti-theft  preventive measures”.

This ideal was suggested to  the customer, who immediately liked it and after a 1 hour conference call, we laid out the ground rules and restrictions;

·       No armed robbery (yes I’m not joking here, no physical confrontation with anybody to include loss-prevention personnel or customers)

·       No tampering with any EAS tags

·       No tampering with any EAS monitor gear ( aka transceivers)

·       No tampering with the packing material of any device that has a embedded EAS tag

·       Items must be at least $100.00 USD or more in value to be considered for this project

 Okay that looks simple, right ?

Will let’s back up some and explain the whole EAS tags concept and retail-theft and the flaws within.

Retail theft is always a problem with a host of stores thru out the world. Product are always stolen, and various department stores are always deploying various means for reducing theft. Some install cameras thru out the store’s public and private areas, others place security guards at entrance and exits, some even place door-open-alarms if open,  and lastly others trust the EAS systems.

EAS stands for Electronic Article Surveillance and primarily & is used to track the smaller/high value products such as; a handheld electronic devices ( phone/tablets/memory/cameras/etc...) , CD/DVD, games cartridges, phones, etc….

These devices are typically coupled  to a EAS tag or embedded in the packing material of the item. They are typically less than the thickness of a  pen/pencil width and shorter than a human pinky finger in length.

How the EAS concept works;  

·        A product  that's reviewed  as being an high theft object, will under go a EAS insertion. The store
negotiate with a EAS vendor  like  TycoSensormatic ( who  at one time I was employed as contractor in their IT/network dept). The vendor will provide an assortment of tags similar to these;

·       Transceiver devices are deploy at the entrances of the retailer store doors similar to the following;

When a tagged article that‘s actively armed & passes thru a transceiver, a audio/flashing warning is emitted.  I know you have seen these devices and/or at least heard one go off. They produce a buzz, chime, or siren. And in some cases, they briefly emits  flashes or lights to alert store employees of an possible theft.

The retailer stores deploys these systems as deterrence to theft, in a way similar to how a bank installs, security guards, dye packs, cameras, bullet-proof glass and man traps, but yet banks are still always being robbed and in some case the crooks are very successful  ( makes one think ) . 

Keypoint on history:  At one time  the Chicagoland was the bank robber capital of the world , & with a bank being hit every week if nt every day, but back to the story at hand.

Will back to our tagged articles of protection, the stores tries to reduce theft, but in reality they are not 100% successful by a long shot. Most stores will not publish data on just how many goods are stolen yearly, but most choose to report only an estimated. Who really knows, we just know items are being stolen on a daily basis by both amauetur  and professional thieves.

So in this gig, my goals was to prove that this particular retailer outlet & their choice of anti-theft mechanism was fool proof or not. I was given a list of 10 stores in the greater tri-county area that I resided in. Out of these 10 sites, I picked 6 store that where going to be “hit” so to speak. And didn’t let anybody know, and that including the pen-test leads  nor customer or any of there personnel.

I can’t disclose the store name or locations, but the sites where scoped out for a few days & before my big event would take place. In those few days, I recon'd the stores, and mentally selected the merchandise that I was going to try to lift.  I also probe their EAS alarms systems to get an ideal of the employees reactions,  and to validate the EAS gear was actually working.

How I probed the stores was very easy. I purchase a few device at another store ( that where not properly deactivated )  and removed the EAS tag from that device,  and used it to trigger the 6 selected stores EAS detection systems. It took me a few tries to get a non deactivated tag from my initial purchases, but when I found a few good ones, it was simple just to walk in thru the store entrance, and with my trigger EAS tag in my front shirt pocket.  A couple of pass thru the doors, will let you know if the systems was active.

In most cases the store employees did one of the following;

• ·       hardly raised their heads or barely looked my way
• ·       wave me on my way , as if nothing happen
• ·       or did  absolutely nothing

The latter was what happen in almost eight out of ten times in my probe testing of the retail stores 6 targets locations. They did nothing, no challenge, and even to the point of no acknowledgement. I thought to myself ; “ This is going to be easy”

All but one of the six stores, had working EAS transceivers, so I skipped store #6 since the detection device was non-operative at the time of my initial probe. How often do they actually monitor the function of these devices and provide Maintenance is questionable imho.

So on the day of my big event, I dressed up in a nice causal polo & shorts, with my get out of jail paper, and drove to store number #1. It was a fall/winter day and the time was approx. 10:00AM. I strolled around in store #1 for about 30mins, looking at this and that, and loading, up my cart with big/heavy,  &  duplicate items. The goal was to lay the item(s) of theft, under these bigger items. These items where going to do one of two things;

• ·                   shield the item from the EAS transceiver
• ·                   or from visual eye sight, if it should go off

My planned worked like a charm.  My 1^st store was looted of one item that weighed under 2lbs and cost approx  $132.00 usd.

I spent maybe 1 hour in that store total. The heavier items where too much of a hassle for the checkout employee, to remove and reinsert into my shopping cart. So she just scanned one item of the numerous/many that I had. I went to my next 4 targets, doing the exact same thing, but selecting another product to lift, but using the same method as with store number 1.

In all, I was 5 out of 5, and at the conclusion of that day or work, I had  $687.82 USD of goods.  Not bad for a day of work. 

Now can get an ideal of how organized retail theft rings work, and that the goods they lift  typically ends up at a flea market, or pawn shop.  At these place they are sold for a fraction of their face value. These organized pros targets stores like mine, and by lifting small items with no serial-numbers or with very hard means for tracking.

Now you can see that EAS systems are not effective be any means. In all of the 5 stores, and not counting the one with a broken, or non-operative transceiver, I was not challenge by any store personnel. In store #5, they even had a renta-security-guard at the door, and she barely raised her head when the alarm went off, since she her attention was directed at her smartphone, and the reading of a text or email.

I will say this; 

“ the alarms did trigger in all cases, but the culture of enforcement was broken by the employees ”.

So one can say the systems operated as designed, but it was the employees fault. But overall the EAS systems was not 100% in the prevention of theft. Only the honest person would be deterred by the EAS systems. Theirs an ole saying that goes like this; “locks, only keeps out the honest persons”. Will this holds true for the EAS systems.

Stores like office-depot for example, don’t bother to waste time and money with these EAS protection devices. They choose the route of  delaying  the customer, by making him/her bring a inert display item or box to the front counter,  and to make them wait, while they call up an associated to retrieve the items of interest for purchasing.  Or they stock certain items, upfront and behind the front counter.

This is probably more effective, than a multi-thousand dollar EAS systems and the 0.05-0.15 cent bulk pricing of the EAS tag that either packaged, pinned or coupled to the device.

I hope you found this article useful. 

Ken Felix

Freelance Security Network Guy

kfelix  “ a t “ hyperfeed dot com