4 ms·

Aiphone door entry systems can be ‘easily’ bypassed thanks to NFC bug

22 points by tallanvor 4y ago

tallanvor 4y ago
This one literally hits close to home since our building uses them and has been dealing with break-ins recently. --I don't think the thieves around here are smart enough to figure out how to exploit this vulnerability vs just ringing numbers until somebody lets them in, but we can't know for sure yet.
- noja 4y ago
  When does your door camera come on? Won't you see who is doing this?
  - tallanvor 4y ago
    Most people here don't have a screen to see who's at the door - it was a pretty significant cost to upgrade to that. As a result, not every floor even has the necessary hardware installed for people to install them after the fact.
edf13 4y ago
It's laughable really - it is how "hacking" is pictured in low budget movies... a device firing every combination at the lock!
- deleted 4y ago
  [deleted]
wuiheerfoj 4y ago
‚NFC bug‘… that’s very generous of TechCrunch haha
UltraViolence 4y ago
A company named "Aiphone"?! I can't believe Apple isn't suing them for similarity in name to iPhone.
- showerst 4y ago
  They're a 70 year old company, with over 50 years in North America...
eska 4y ago
Are they unable to patch a rate limit into it? It also seems incredibly incompetent to create a password system that doesn't have a rate limit as a basic precaution against brute force attacks to begin with.
- tallanvor 4y ago
  There's no way to update the firmware on these devices, at least not without soldering on a connector first.
ht85 4y ago
4 digits. Amazing.
manofmanysmiles 4y ago
The researchers missed a great opportunity to make the app look like John Connor’s debit card and access card hacking tool in Terminator 2!
Tiki 4y ago
This reminded me of a hack/cheat someone implemented for a video game called Rust (Rust is a multiplayer survival FPS where players can build bases). The game has code locks on doors, 0000-9999. What the person did was isolate the network packet sending one attempt at the code lock, and the using networking tools and a bit of automation, sent a stream of all possible permutations towards the server. Apparently people who were in the vicinity of a person employing this cheat heard a steady stream of beeps (each attempt did a short beep noise), and then inevitably the combination was found and the lock was cracked... if I recall correctly it took less than 6 minutes for it to go through all attempts and gain access to another player's base, and their treasures. After the developers heard of it, they implemented rate limiting and a small amount of 'shock' damage to the player to resolve the issue.

22 points by tallanvor 4y ago

This one literally hits close to home since our building uses them and has been dealing with break-ins recently. --I don't think the thieves around here are smart enough to figure out how to exploit this vulnerability vs just ringing numbers until somebody lets them in, but we can't know for sure yet.

noja 4y ago
When does your door camera come on? Won't you see who is doing this?
- tallanvor 4y ago
  Most people here don't have a screen to see who's at the door - it was a pretty significant cost to upgrade to that. As a result, not every floor even has the necessary hardware installed for people to install them after the fact.

edf13 4y ago

It's laughable really - it is how "hacking" is pictured in low budget movies... a device firing every combination at the lock!

deleted 4y ago
[deleted]

wuiheerfoj 4y ago

‚NFC bug‘… that’s very generous of TechCrunch haha

UltraViolence 4y ago

A company named "Aiphone"?! I can't believe Apple isn't suing them for similarity in name to iPhone.

showerst 4y ago
They're a 70 year old company, with over 50 years in North America...

eska 4y ago

Are they unable to patch a rate limit into it? It also seems incredibly incompetent to create a password system that doesn't have a rate limit as a basic precaution against brute force attacks to begin with.

tallanvor 4y ago
There's no way to update the firmware on these devices, at least not without soldering on a connector first.

ht85 4y ago

4 digits. Amazing.

manofmanysmiles 4y ago

The researchers missed a great opportunity to make the app look like John Connor’s debit card and access card hacking tool in Terminator 2!

Tiki 4y ago

This reminded me of a hack/cheat someone implemented for a video game called Rust (Rust is a multiplayer survival FPS where players can build bases). The game has code locks on doors, 0000-9999. What the person did was isolate the network packet sending one attempt at the code lock, and the using networking tools and a bit of automation, sent a stream of all possible permutations towards the server. Apparently people who were in the vicinity of a person employing this cheat heard a steady stream of beeps (each attempt did a short beep noise), and then inevitably the combination was found and the lock was cracked... if I recall correctly it took less than 6 minutes for it to go through all attempts and gain access to another player's base, and their treasures. After the developers heard of it, they implemented rate limiting and a small amount of 'shock' damage to the player to resolve the issue.