1
00:00:01,580 --> 00:00:15,500
Sam and I spent a while on this research project, and we found eight vulnerabilities in the access control panel that manages and is connected to these card readers, and we can use it to essentially force them to open the doors for us.

2
00:00:15,500 --> 00:00:26,560
By triggering these vulnerabilities over the network that they're connected to, we can choose to lock or unlock the door, and we can avoid all detection, even with the logging systems that are meant to capture those attempts.

3
00:00:26,560 --> 00:00:29,960
This guy's just kind of a dumb thing that's connected to the strike in there.

4
00:00:29,960 --> 00:00:31,860
It opens and closes electronically.

5
00:00:31,860 --> 00:00:34,080
The actual panel is behind the board here.

6
00:00:34,080 --> 00:00:41,520
It's typically going to be in a server closet in a facility, but it's wired through the building and connected into the door just like we have in our demo system here.

7
00:00:41,520 --> 00:00:47,260
The panel itself that controls this remotely is what we are actually hacking, and I'm calling up Sam.

8
00:00:47,260 --> 00:00:59,300
I'm standing here, and I can't get into the door, and Sam's remotely connected to the network with his laptop, and he's running our exploit on that network, which is connecting to the door panel back in the server closet or wherever in the building it is.

9
00:00:59,300 --> 00:01:00,940
It's triggering those vulnerabilities.

10
00:01:01,040 --> 00:01:12,240
He's exploiting it, and actually, the way that we wrote the exploits, it'll call back to us, the attackers, on the laptop we're running it from in the parking lot or wherever it is, and we can actually complete the exploit remotely.

11
00:01:12,240 --> 00:01:16,120
So we don't have to be really within physical proximity at all to get this.

12
00:01:16,200 --> 00:01:17,760
Hackers will do that all the time.

13
00:01:17,760 --> 00:01:22,160
They'll take internet-connected devices that are completely unrelated to this door, right?

14
00:01:22,160 --> 00:01:31,320
A router or a firewall is not related to this door, but if it has a vulnerability that gets you in the virtual door on the network, now all of a sudden we have a way to attack this device.

15
00:01:31,320 --> 00:01:40,580
We've exploited a command-injection vulnerability in the controller for the hosting of the device, and that vulnerability actually allows us to connect to the door itself.

16
00:01:40,920 --> 00:01:51,920
So if we do more than a door hack, what you'll see now is if we listen carefully to the door, it's now unlocked remotely over the network, and we can open it and go in.

17
00:01:51,920 --> 00:01:55,540
So Sam just ran that from the parking lot, and now I'm in the secure facility.

18
00:01:55,540 --> 00:01:58,400
So we're running locally from the controller right to here.

19
00:01:58,440 --> 00:02:03,180
The on-guard server actually never even knows that we've gone into or out of this building with our hacks.

20
00:02:03,180 --> 00:02:06,280
It could be 2 in the morning, nobody's going to be in here, why isn't anyone in?

21
00:02:06,280 --> 00:02:23,540
This panel that we actually found vulnerabilities on has over 20 OEM partner vendors that were vulnerable to the same issue, and that's, we're talking tens of millions of controllers at sites worldwide, the vast majority of the Fortune 100 companies, the install base of these devices is massive.

22
00:02:23,540 --> 00:02:25,200
How many of them are actually vulnerable?

23
00:02:25,300 --> 00:02:29,780
Well, that depends on the version of the board they're running and whether they've updated or patched the device.