start	end	text
1580	6640	Sam and I spent a while on this research project, and we found eight vulnerabilities in the
6640	12620	access control panel that manages and is connected to these card readers, and we can use it to
12620	15500	essentially force them to open the doors for us.
15500	19760	By triggering these vulnerabilities over the network that they're connected to, we can
19760	24120	choose to lock or unlock the door, and we can avoid all detection, even with the logging
24120	26560	systems that are meant to capture those attempts.
26560	30280	This guy's just kind of a dumb thing that's connected to the strike in there. It opens
30280	34480	and closes electronically. The actual panel is behind the board here. It's typically
34480	38460	going to be in a server closet in a facility, but it's wired through the building and connected
38460	41520	into the door just like we have in our demo system here.
41520	46720	The panel itself that controls this remotely is what we are actually hacking, and I'm calling
46720	50500	up Sam. I'm standing here, and I can't get into the door, and Sam's remotely connected
50500	55280	to the network with his laptop, and he's running our exploit on that network, which is connecting
55280	59300	to the door panel back in the server closet or wherever in the building it is.
59300	63440	It's triggering those vulnerabilities. He's exploiting it, and actually, the way that
63440	67400	we wrote the exploits, it'll call back to us, the attackers, on the laptop we're running
67400	71600	it from in the parking lot or wherever it is, and we can actually complete the exploit
71600	76120	remotely. So we don't have to be really within physical proximity at all to get this.
76200	80460	Hackers will do that all the time. They'll take internet-connected devices that are completely
80460	85040	unrelated to this door, right? A router or a firewall is not related to this door, but
85040	89600	if it has a vulnerability that gets you in the virtual door on the network, now all
89600	93760	of a sudden we have a way to attack this device. We've exploited a command-injection vulnerability
93760	98760	in the controller for the hosting of the device, and that vulnerability actually allows us
98760	105200	to connect to the door itself. So if we do more than a door hack, what you'll see now
105200	110700	is if we listen carefully to the door, it's now unlocked remotely over the network, and
110700	114120	we can open it and go in. So Sam just ran that from the parking lot, and now I'm in
114120	118960	the secure facility. So we're running locally from the controller right to here. The on-guard
118960	122860	server actually never even knows that we've gone into or out of this building with our
122860	126280	hacks. It could be 2 in the morning, nobody's going to be in here, why isn't anyone in?
126280	132060	This panel that we actually found vulnerabilities on has over 20 OEM partner vendors that were
132060	135680	vulnerable to the same issue, and that's, we're talking tens of millions of controllers
135680	141880	at sites worldwide, the vast majority of the Fortune 100 companies, the install base of
141880	146000	these devices is massive. How many of them are actually vulnerable? Well, that depends
146000	149780	on the version of the board they're running and whether they've updated or patched the device.