3 ms·

I assume this is one of those systems where a potential entrant types a code, and the systems calls a pre-provided number for the occupant of the unit who provi

I assume this is one of those systems where a potential entrant types a code, and the systems calls a pre-provided number for the occupant of the unit who provided the code to the entrant? The common denominator on the PSTN is listening for inband DTMF within a G.711 "encoded" stream. The "security" in this system is the condo entry phone device dialing out to the PSTN (via some mechanism) to the destination number, which is routed via SS7 to the proper owner. This security mechanism is somewhat similar to those used by two-factor systems that send SMS via SS7 to destination numbers. It's not without fault, there have been many demonstrated attacks against the SS7 network.

cperciva 9y ago
Sorry, I should have specified more. This is a "potential entrant selects the person they're trying to visit; system phones the pre-programmed number for that occupant; occupant talks to the visitor and presses a button to let them in". In my building, I have to press 6 to make the door unlock. Could a vistor play a very loud "touchtone phone 6" into the microphone and make the system think that the occupant pressed that number?
- mulmen 9y ago
  That would require the audio signal to be a single channel right? That or the residents phone would have to be very loud. I'm not sure but I think phones operate on a dual channel (tx/rx) setup which is what allows all participants to talk simultaneously.
  - cperciva 9y ago
    I was thinking echoing. I don't know how loud a button tone needs to be for the entryphone system to accept it as an instruction to unlock the door.
mulmen 9y ago
To be clear, it uses a similar mechanism to 2FA messages to place the call but there is only one authentication factor in this case. My question is what kind of trouble can I cause by calling the inbound number from my call box? It picks up so presumably it is listening to something. Also, how is the physical security of these devices? Are they managed from the keypad or is the control inside the building in a secure area? How does the FD get in?

cperciva 9y ago

Sorry, I should have specified more. This is a "potential entrant selects the person they're trying to visit; system phones the pre-programmed number for that occupant; occupant talks to the visitor and presses a button to let them in". In my building, I have to press 6 to make the door unlock. Could a vistor play a very loud "touchtone phone 6" into the microphone and make the system think that the occupant pressed that number?

mulmen 9y ago
That would require the audio signal to be a single channel right? That or the residents phone would have to be very loud. I'm not sure but I think phones operate on a dual channel (tx/rx) setup which is what allows all participants to talk simultaneously.
- cperciva 9y ago
  I was thinking echoing. I don't know how loud a button tone needs to be for the entryphone system to accept it as an instruction to unlock the door.

mulmen 9y ago

To be clear, it uses a similar mechanism to 2FA messages to place the call but there is only one authentication factor in this case. My question is what kind of trouble can I cause by calling the inbound number from my call box? It picks up so presumably it is listening to something. Also, how is the physical security of these devices? Are they managed from the keypad or is the control inside the building in a secure area? How does the FD get in?