Knock knock. Who's there? Betta! Betta who? Betta check your access control edge devices

The talk examines edge computing, where devices such as access control cameras make identity decisions and drive door hardware on premises instead of sending data to a distant cloud. The presenters argue that these devices carry more responsibility than typical IoT cameras, yet look nearly identical to them, so buyers often underestimate the risk. They selected four access control products from major vendors and examined their network traffic, APIs, hardware and actuator links.

The findings were mostly basic weaknesses rather than new bug classes. Several management APIs used unencrypted HTTP and accepted a reusable session token tied to a device serial number, which let the team create users, promote one to administrator, and swap enrolled face data for their own. One cloud service exposed guest lists, deleted-user records and employee photos. A device that polls its server received the full user database, including credentials, to anyone on the same network. Without certificate pinning, a fake server could be set up in a few dozen lines. In another system, a relay opened doors through an unauthenticated TCP command reachable from the network, and exposed cabling could trigger the lock directly.

The takeaways centre on encrypting traffic, verifying server certificates, authenticating APIs, isolating device networks, protecting cables and keeping Android-based firmware patched. Auditing for unusual activity also matters. The researchers disclosed the flaws through a coordinated process, and vendor responses varied. Their message was that edge devices need the same security basics as any other networked system.