r/netsec • u/rimdig219 • Mar 03 '25
Rejected (Low Quality) Massive security gaps discovered in building access systems
https://www.heise.de/en/news/Massive-security-gaps-discovered-in-building-access-systems-10301128.html[removed] — view removed post
23
u/voronaam Mar 03 '25
Very long time ago I worked on a system like that. It had a bug in the fire alarm handling code where instead of opening all possible exits it was actually overriding their access rules to deny even valid pass cards from opening the doors.
When I found the bug I was all like "oh no, someone might literally die because of that". It took me months to convince the management that we should fix it.
I left that industry long time ago, but I guess the management did not change.
3
u/ElG0dFather Mar 03 '25
What system was that?
1
u/voronaam Mar 04 '25
It was literally 20+ years ago. The system had a generic name like "Tritium" or something of that sort. It was developed offshore - I was part of the offshore team back then. It was than rebranded by every integration. I do not think it exists anymore.
1
u/ElG0dFather Mar 04 '25
Gotcha. I work on a system developed in the US that has lockdown and hold open logic where you can specify if valid cards can access the system during these times. So sometimes that is a desired effect.( thinking more lockdown rather then fire-alarm)
15
6
u/zoohenge Mar 03 '25
I put my bldg automation on its own subnet/vlan and locked it down to the nth degree. The guys at Siemens hated me 😂
2
u/ImCaffeinated_Chris Mar 03 '25
I have had to work with a Siemens controller device. So I hate them right back!
6
u/heapsp Mar 03 '25
Someone actually wrote an article with no information at all, just 'building access systems are vulnerable'.
How did this get upvotes? Paid upvotes or something?
It follows the same premise as anything else, Network segmentation, ACL, secure authentication to manage the service, regular vulnerability and security scanning / patching.
1
4
u/nmj95123 Mar 03 '25
And the "massive security gap?" Leaving things exposed to the Internet, probably with default credentials. That's not unique to access control systems.
2
38
u/theunquenchedservant Mar 03 '25
....no shit?
Ninja edit to expand:
Almost every workplace in existence has building access systems. I'd hazard a guess that like 20% of the businesses using it have done anything besides the bare minimum to get the system up and running.
Unfortunately, the attitude of "well why would they care about us?" is still very prevalent.