The Door Was Already Open

The talk examines a widely deployed access control platform used in residential and mixed-use buildings. The speaker began after realizing he had left default credentials on a panel he had installed. He found that the controller answers unauthenticated discovery probes, disclosing its model, firmware and serial number, and that the management software's passcode is numeric only.

Authentication has no rate limiting, lockout or logging, and the packets sent during login are static, so guessing can be automated. The speaker scanned the internet and found tens of thousands of responding buildings, with default credentials granting access to more than half of the randomly sampled systems. Once connected, the software can download a building's database in plain text, including resident names, unit numbers, phone numbers, access credentials and access history. It can also read other panels on the same network and change door states or schedules. A recorded demo, run on a client system with permission, showed these steps.

The vendor was contacted and was initially unresponsive, then said similar risks had been raised internally before. An update reportedly allowed letters in passcodes only on new hardware, with no firmware fix for installed systems. The takeaway is that architectural choices such as unauthenticated discovery, static protocols and proprietary design create systemic exposure, not just isolated bugs. Practitioners should keep such panels off the internet, change default credentials, and push building owners to review their access systems.