physical security -

Aiphone door entry systems can be ‘easily’ bypassed thanks to NFC bug • ZebethMedia

By zebethcontrolPosted on November 10, 2022Posted in government, physical security, Security, vulnerabilityNo Comments

A security research firm says it discovered an “easily” exploitable vulnerability in a door entry security system used in government buildings and apartment complexes, but warns that the vulnerability cannot be fixed. Norwegian security company Promon says the bug affects several Aiphone GT models that use NFC technology, often found in contactless credit cards, and allows bad actors to potentially gain access to sensitive facilities by brute-forcing the door entry system’s security code. Door entry systems allow secure access to buildings and residential complexes, but have become increasingly digitized, making them vulnerable to both physical and remote compromise. Aiphone counts both the White House and the U.K. Parliament as customers of the affected systems, according to company brochures seen by ZebethMedia. Promon security researcher Cameron Lowell Palmer said a would-be intruder can use an NFC-capable mobile device to rapidly cycle through every permutation of a four-digit “admin” code used to secure each Aiphone GT door system. Because the system does not limit how many times a code can be tried, Palmer said it takes only minutes to cycle through each of the 10,000 possible four-digit codes used by the door entry system. That code can be punched into the system’s keypad, or transmitted to an NFC tag, allowing bad actors to potentially access restricted areas without having to touch the system at all. In a video shared with ZebethMedia, Palmer built a proof-of concept Android app that allowed him to check every four-digit code on a vulnerable Aiphone door entry system in his test lab. Palmer said the affected Aiphone models do not store logs, allowing a bad actor to bypass the system’s security without leaving a digital trace. Image Credits: Cameron Lowell Palmer / Promon Palmer disclosed the vulnerability to Aiphone in late June 2021. Aiphone told the security company that systems manufactured before December 7, 2021 are affected and cannot be updated, but that systems after this date have a software fix that limits the rate of door entry attempts. It’s not the only bug that Promon discovered in the Aiphone system. Promon also said it discovered that the app used to set up the door entry system offers an unencrypted, plaintext file that contains the administrator code for the system’s back-end portal. Promon said that could allow an intruder to also access the information needed to access restricted areas. Aiphone spokesperson Brad Kemcheff did not respond to requests for comment sent prior to publication. Relatedly, a university student and security researcher earlier this year discovered a “master key” vulnerability in a widely used door entry system built by CBORD, a tech company that provides access control and payment systems to hospitals and university campuses. CBORD fixed the bug after the researcher reported the issue to the company.

SecuriThings is bringing order to IoT device management with $21M investment • ZebethMedia

By zebethcontrolPosted on October 13, 2022Posted in edge devices, Enterprise, IoT, physical security, SecuriThings, usvpNo Comments

As companies deploy more security devices like cameras, access control systems, intercoms and many other tools throughout their organizations, they are often disconnected from traditional IT, and may lack any way of managing the equipment in a systematic way. SecuriThings has built a solution to solve this problem with a platform that helps building operations understand and control what’s happening on physical security devices across a company. Today the company announced a $21 million Series B. Roy Dagan, company CEO and co-founder, says that while companies are spending inordinate amounts of money on this equipment, they often don’t know if they are even working because they lack visibility. “We built the ultimate system to help them automate the management of these devices at scale, and really provide the equivalent of an IT type of system for managing these kinds of devices,” Dagan told ZebethMedia. The system automates a bunch of management tasks that are typically done manually including firmware upgrades, managing certificates and rotating passwords. What’s more, it can help find and troubleshoot issues with these devices as they happen. “It can also perform things like root cause analysis. So we can tell when an issue occurs, and we can tell you what’s at fault,” he said. “You may think it’s a [camera], but it’s actually a switch and it’s affecting 15 [cameras], which are all down. And that’s a problem because while building operations manages the broken cameras, the broken switch is under the purview of IT, and they need to know about it to fix it. SecuriThings includes ways to communicate with IT about these issues. “You can collaborate with your counterparts in IT. So it can be integrated with ServiceNow or other ticketing systems…and that helps you also start working better with the rest of the enterprise,” Dagan said. He believes that in spite of the economic uncertainty we are seeing, his company is well positioned to deal with it. “One of the cool business outcomes is really around cost reduction. Because if you look at the enterprise, and you look at the amount of spend they have today on these devices, and the way things are done manually and reactively, it’s almost a no brainer. The cost savings are huge,” he said. While he wouldn’t discuss revenue growth, he said the company currently has dozens of customers using the platform and the number of customers has grown over 300% year over year. The startup currently has 70 employees with plans to add more with the new investment. He says that being diverse is built into the company’s values. “So it’s just part of our culture, and it’s core to the company. It really is, and just looking at stats that we have today where 40% of leadership is female, and 40% of the company is female…But then also our HR team is constantly evaluating the numbers and looking at different opportunities and how we create that diversity even more,” he said. Today’s investment was led by U.S. Venture Partners (USVP) and participation from Swisscom Ventures existing investors Aleph, Firstime VC and Cresson Management. The startup reports it has now raised a total of $39 million.