Breaking into apartment buildings in five minutes on my phone
ericdaigle.ca
ericdaigle.ca
"Let's see if I can't get us in," he said. He got out of the car, walked over to the access panel and looked on top, bottom and sides. Then he punched in some numbers and the gate opened.
Turns out, so many people in gated communities and apartment complexes order things from Amazon, and other delivery services, and want front door delivery but don't give them any way to get in. Eventually, some frustrated driver who gets the code will write it on the side of the access panel to help everyone out.
"Apartments are awful," he said. "College campuses are the bane of our existence. You would think that college kids would be smart about these things but they are the absolute worst."
In my experience, and I’m generalizing a lot, the less people have the more generous they tend to be.
For an all-too-large fraction of humanity, that's the "protection" which actually matters.
Nevermind that you can wave any conductor under the gate to trigger the egress wire loop sensor, or just wait a minute or two for someone else to go through. From 6AM to 10PM the other gate is simply open, too.
Now I have to pay more for crappier fobs with worse range. It's deeply disappointing.
Given what you just said and the article you're commenting under, are you sure?
Confidence is the key, though.
If it's busy and you pull up in a nice enough car and just wait in front of the sensor gate looking annoyed, the guard will eventually just let you in
Like, the HOA just like calls the delivery companies and says "hey, here's a code to get in"
You folks are living in a fantasy land.
No wonder it's considered socially acceptable to order multiple Amazon deliveries in a week....
In the days before cell phones, a burglar alarm would dial the alarm company. The phone company likes to install the phone box on the outside of the building. The alarm is defeated by an axe to the cable going in the box.
I had a fight with the phone company at my house, as I wanted the box on the inside rather than the outside. They finally agreed on the condition that I maintain the wire to the box.
These days, of course, the alarms use wifi or a cell phone to call the alarm company.
And the crooks use RF jammers instead of axes.
If the keepalives stop coming without a proper disarm signal, a fault is raised.
Some old alarms had a weaker version of this, where they would dial the security company whenever the door was opened, and then again when the alarm was disarmed. If the second call didn't come in time, the company would instantly know that something was up.
This protected against thieves that would enter the house and smash the alarm before it had time to activate.
Here in the UK the alarms make a noise as the absolute minimum. Getting one that is "monitored" by a call center is not standard, especially one that calls the cops if it goes off or a panic button is pressed.
You can get those of course, but it costs extra. I pay something like £40-50 a month for the panic button service that will summon the police, but even then the police won't be summoned if just the alarm goes off without a panic button getting pressed (you can get that, but it is even more expensive)
Anyone with anything of value works from home at least part of the week. Why risk entering someone's actual house when you can make easy money on drugs, fraud, crypto, bicycle theft, phone snatching, or umpteen other hustles I don't even know about.
Bicycle theft especially. You could easily clear a grand or two a week with zero fear of prosecution.
The things people used to pinch like VCRs, stereos, TVs, laptops just aren't as expensive or sellable now.
That still doesn't give you the order of the key strokes.
However, for a 6-digit combination, you'd have to try out 720 combinations in the worst case, so that's already quite a bit less feasible. Although given enough time...
This is a huge misconception about GenZ. Unlike Millennials and GenX who had to hack around on PC's to figure out how to torrent, run games, build our own lans for local multiplayer, and generally avoid our parent's prying eyes. GenZ has grown up on devices. You don't modify the OS on devices. You don't hack around on devices; Apps tend to just work with little configuration. GenZ is entering the workforce with lower baseline computer / computer security skills than people think they have.
My nephew for a while was very much one of those "grew up on devices" kind of kids - until he got off of gaming on phones and tablets, and got a gaming PC. Now he's reading about technology and tinkering and stuff.
My IRQ conflict resolution skills or knowledge about himem.sys aren't really useful these days.
But I've seen genz kids do incredible things with Minecraft mods and the like that make me reminisce about quake modding.
The masses are just blindly using devices, but the masses didn't even have a PC at home 30 years ago.
Your ability to meticulously solve a problem using a systematic troubleshooting approach is always useful. You just happened to hone the skill w/ IRQ conflicts and himem.sys.
Heck I did the same. Dip switches galore. Did I know what an IRQ actually is on the OS level while solving IRQ conflicts as a kid? Heck no! Only years later when I no longer needed to did I understand what those actually are/were.
The today equivalent of learning about autoexec.bat and config.sys to not load the cdrom driver because else this one game wouldn't start because it did not have enough memory is figuring out what's behind the Steam "Start" button and where the games "live" and how you can get what you want instead of doing everything through steam.
The kids that are the today equivalent of us in the old days do exist.
It's more systems, networks, OS fundamentals... i.e. how you pull all the pieces together and make them work especially among your "non-technical" user set.
I'm sure it's the same with young people.
All that did was result in extreme frustration. My knowledge of creating game-specific boot disks to eek out 1k more memory did nothing for my ability to write software, except perhaps to appreciate having more RAM and good UX.
I don't even know how that's possible because he plays modded versions of some of his games- how you get by without knowing what a zip file works at the surface level is a mystery to me lol.
Indeed, as you say, I learned a lot about computers simply by wanting to circumvent the limitations that school admins put on the computers (especially as I wanted to utilize the full power the computers provided, as opposed to some sheltered/limited experience -- "At Ease" -- surprisingly reminiscent of smartphones/tablets today)... I went to great lengths to regain net access when my parents repeatedly revoked my access, again another huge learning opportunity.
There are some Minecraft superbrains doing incredible things, but the median level of experience and insight seems much lower.
My friends and I, as kids, knew "everything" about computers and how to operate them, and there was this base level of knowledge that pretty much every computer-owning kid had.
I remember one friend figured out himself how to hex-edit his WarCraft 1 save files, this would have been at the age of 10 or 11, with zero instruction/guidance from parents or anything. I'd be impressed today if you found a singular kid in an entire high school who can hex-edit anything, let alone game saves, despite probably every single household of every student in that school having at least one personal computer, if not more.
Simultaneously, there's an important aspect that computers and the software for them are more abstract than ever, so "hex editing" is a pretty obscure thing for someone to have any reason to do.
Regardless, being able to save the currently-open Microsoft Word document to the USB stick one just inserted is pretty much the bare minimum of technical literacy I expect from anyone who has a computer at home -- yet this is apparently not the case. I'm talking like, even on a Mac, students couldn't figure it out.
My conclusion here is that, as many people lament, there was a spike in time where computer enthusiasm was a real thing, where a relatively high % of kids wanted to "know everything about computers", but now computers are normal and boring and most people see them as "thing to launch game/chat/web on", for better or for worse (and for a wide variety of reasons).
There was no fancy intercom ability to remotely open it.
What irked me was she claimed "I just hate being on the computer", but her screen time on the phone easily crests 8 hours daily. Maybe we are just entering a similar phase to auto mechanics. In the 1950s anyone who owned a car was at least somewhat proficient in its inner workings, now many people need to consult the manual to figure out how to pop their hood.
Think about how I (and probably you) learned computers. My IBM PC has a manual that has a page just to show where the power switch is and how to use your hand to flip it. It has a diagram for what the keyboard cable looks like when it's plugged in correctly. It continues on and on and tells you how to open it and what the dip switch settings do. People always thought I was a computer wiz kid when I all I ever did was read the manuals and try out what they said.
I grew up in the 80s and we were strictly forbidden from watching TV. There were no video games in the house. I only got to see Nintendo at friends houses... and I barely understood how they could get through level after level. Tabletop RPGs were also forbidden. Encouraged: building stuff out of sticks and mud or whatever was in the yard, mandatory reading of history books, chess. In the 80s, my parents viewed computing with equal suspicion to video games. I had to really make a case that what I was doing with BASIC and Pascal and later Hypercard was educational for me... and even then I was restricted to 1 hour per day on the family computer. But I had this 16K TRS80-100 that no one considered a game or a threat... and I was already dialing BBSs at 300 baud and getting kicked off after the parents were asleep.
Um. So I've told this all to friends and girlfriends, and often they say "oh wow you were really abused" or something. I don't really fault my parents, I think it was good for me and my siblings in the end. But boredom is not the thing. Limited resources is the thing. Give a mind the ability to make the most of limited resources, and the mind will always find things of interest to stave off boredom. Boredom is the province of those with nothing to think about when not being stimulated. That's why "people who get bored are boring," as my ex used to say.
I think that is true. When we didn't have access to a proper football at school, we took used notebook papers, made a ball out of it, put that in several layers of small plastic bags (for water proofing) and tightened that in with a thick string looped to cover the surface. It served perfectly as football for a bunch of noisy kids and was easily replaceable.
Paucity provides the spark for creativity.
[0] https://www.youtube.com/watch?v=UCjSG_15kcw
[1] https://www.youtube.com/watch?v=RCh3Q08HMfs
Much less daunting and convenient to work on an engine or replace a part when you don't have to take off (and potentially break) a million other parts to get at what you want to replace and you actually have the room to see what you're doing instead of blindly groping around for something vaguely shaped like something you've only seen a picture of.
That and the absolute sheer amount of electronics in modern cars. Older cars had the absolute bear minimal amount of wiring to the point that it was entirely plausible to more or less keep the wiring schematic in your head and even (speaking from experience) redo the entire wiring harness front to back on your own with a few different colored rolls of wire from a hardware store yourself.
I can't imagine how people getting into the hobby now with newer cars feel looking at the unholy mess of endless amounts of wiring, sensors, mechanical parts all jammed together in tightly packed space efficient layouts probably designed by someone purely working on them in a digital space. On the bright side at least they have youtube and better resources on the Internet to look up how to actually do something though.
In comparison my 80’s Bronco II, I bought it from my neighbor for $300 and my dad told me I’d fix whatever broke myself if I could. Gave me a service manual that had schematics and layouts of just about every part of that car that was serviceable, and the book wasn’t even that thick considering what it detailed. I was able to pin out some repurposed Christmas lights for the dash in a pinch, and we tore down and rebuilt some component from under the hood ourselves though I don’t recall exactly what now.
Removing the wipers and windshield cowl is generally easy, just takes some extra time. Dealers/mechanics charge for time, not difficulty. So that simple 2hr job can easily be 500-600+. Still something that could be a rewarding Saturday morning project for someone who likes doing DIY type stuff.
Idk man seems like plenty of space to me. Also comes with service mode which shows all the inner working and status of components:
https://www.notateslaapp.com/news/2046/tesla-service-mode-ho...
A relative drives an old truck. This is more or less his engine bay: https://www.onallcylinders.com/wp-content/uploads/2014/11/ch...
I've walked into his garage and found him inside the engine bay with a stool, sitting down and working on something.
Where-as I drive a newer car, and this is similar to mine: https://i.redd.it/4ks75mma4pmb1.jpg
I am very fortunate that my local library maintains digital access to useful stuff.
More to the point, as cars evolve to digital control and signalling systems with associated firmware, the problems are increasingly diagnosed via the ODB or CAN-BUS and rectified at e.g. and Engine Management System level rather than at a mechanical level. This necessitates up-to-the minute sources of truth detailing the various firmware versions, caveats and advisories - much more suited to a digital medium and distribution channel.
But on the other hand, cars before the 1990s were infinitely simpler to grok and to fix than modern vehicles. The learning curve was much gentler, and really no specialized knowledge was required. Changing the timing on your engine was easier than putting together an Ikea cabinet. Now it requires specialized equipment.
The opposite is true of computers. It has never been easier to snap together a cross-platform app to do almost anything than it is today. Friendly scripting languages, APIs for access to every kind of sensor and data imaginable, and devices fast enough to run terrible code at reasonable speeds. Almost everything you would have had to do from scratch hand in the 1980s has been done for you; a huge amount of coding now is just plug and play. And basically everyone in the first world has access to the necessary equipment to write their own code.
> People don't know how to pop their hood now because they don't need to.
you don't need to figure how to create your own note taking/list making/accountancy software, you just open your favorite/default search engine, write the query and get a plethora of options, for nearly any platform under the sun, because of all the work has already been done, as you pointed out in your last paragraph.
Software engineering is weirdly harder today than it's ever been in many domains.
A cross platform app might have to support iOS, iPadOS, MacOS, Android, Windows, Linux and the Web. Music and Video apps might additionally have to support various flavours of vehicle and TV platforms too.
On the server side your friendly scripting language will probably be running in a venv in a container on a VM on a cloud. Or potentially just a venv locally keeping the containerisation for the cloud.
Back in the day, emails could be sent from my computer to your computer if I knew your IP address. Nowadays my email won't get past your spam filters unless I buy and warm up a reputable domain on a respectable IP address and adhere to the correct content standards. The precise rules for these aren't documented anywhere.
Funny enough, the ease of running a mail server and sending email back in the day is probably why it’s so scuffed these days. Email did hit a weird overcorrection though that never evened out, whereas everything else seemed to either standardize or die off (rip the days of telnet’ing into a random domain and being able to actually do things)
Sorry to be the bearer of bad news, but auto manuals haven't included such technical information for close to two decades.
Just asking coz whenever I try to talk about what computers could already do or when something was invented in the 1960s or 1970s I tend to start with "well 40 years ago..." and then I look at the calendar and notice that it's 2025 and I'm officially old now and 40 years ago was more like 60 years ago.
And my car in 2005 definitely had no such thing and it wasn't a 2005 model.
Page 393.
https://cdn.dealereprocess.org/cdn/servicemanuals/toyota/202...
Meanwhile, my friends and I can go on about the most banal computer stuff and my parents have no clue what we're talking about or why it's interesting to us. Kids probably don't either.
The devices the (grand-)kids are using are much more explorable and idiot-proofed. Nobody is going to make a single "dd" typo and erase their drive.
Alas, how does one learn if one cannot dd the wrong hard drive, wiping all the films you've spent most of the summer illegally downloading at night because you only had a dial up connection at the time.
Perhaps these purported "itoddler" peers of ours were on to something, after all...
Not all hope is lost.
I know 3rd and 4th year IT/Cybersecurity students that don't understand how to ssh into servers and the different layers of the OSI model.
I hate to sound insufferable, but I really truly believe some people are just too stupid for this field.
I'm so sick of dealing with them.
Yay job security?
Key phrase being "behind the scenes", iOS completely obscured the concept of files to its users for a long time. I don't remember how downloading files off of a website worked though.
Arguably, that's even why some gravitate towards it in the first place.
Had they actually found out about the fact that we bypassed security measures on a bootable CD-ROM that allowed us full system access, including a nifty Visual Basic launcher to install Quake and GTA, or that we figured out every computer used VNC and they all had the same password stored in plaintext in the registry (which we accessed via that bootable media), or that we figured out the same password accessed every networked printer in the county so we could print our school’s logo on that week’s rival school’s printers in barely off-white ink…they’d have had a good case.
Hey, sounds familiar!
Our school district had a policy that all new computers went to the high schools, then when those aged out and were replaced went to the elementary schools. They wanted iMacs for the elementary schools. That meant that for a couple years our high school had to have iMacs.
Of course literally everything we were trying to do, all the courses and curriculum, etc were built around Windows. So all of them were set up to dual-boot... Which is to say we didn't even need to haul in any bootable media.
Rebooted into mac, which had absolutely no respect for NTFS file permissions, and copied the SAM registry hive off. Took that home, ran the password hash through a cracker and a day later had the local admin password that was shared among all of the computers in the school.
It too was mostly used for running GTA.
There was also that time with a little light B&E and doing some network cabling under the cover of night. Though I think there's technically no statute of limitations on that so that's probably enough said.
I fear this is true with most life skills. Things are easier and it seems kids today are just handed more stuff. The freedoms and expectations in many areas are lower. Kids don't grow up due to age, they grow up due to experience. It seems we are pushing that farther down the road with each generation.
I noticed that even the generation that came after me (I was born in the 70s) produced IT engineers with a bit less skills because they've never had to mess stuff. People these days are afraid to mess with the windows registry even. I used to manually patch blocks together when I deleted a file by mistake.
These skills are getting less and less useful though now that everyone is happy to give up their privacy to big tech in return for something that 'just works' :(
I think people who grow up with computer games have a lot more exposure than normal users. Smartphones somewhat made computers irrelevant for most people.
In my area, there is a universal access key (physical) for postal service and newspaper delivery people. So if you want access to a random building, all you need to do is apply as a newspaper delivery guy, or, find one that is willing to give you that master key. To add insult to injury, that type of job is extremely low paying, so much room for abuse.
Fact is, locks and closed doors are there to make the owners feel cozy and safe. If you ever needed a locksmith service and watched them do their job, you know your appartment door is just a prop.
It doesn't matter if it took a guy 10 seconds to break your lock, if you didn't lock your house, chances are your insurance won't pay.
That code was also used at our (EMS) depots to secure the controlled drugs as well, as if none of us could have guessed it.
People live in gated communities because of what the gate represents – a very clear sign telling you and everyone else passing by that you don't belong here.
Unfortunately that caused several burglaries too including in my flat :( my alarm scared them off but still..
Because college kids write codes on the site of access panels? Wouldn't that make life easier for your friend as a delivery driver?
Because college kids don't write codes on the side of access panels? If so, why does your friend describe them as not smart? Isn't it smart to avoid writing codes?
These manufacturers’ recommendations are not acceptable. They should mandate a non-default secure password before allowing the system to be used.
Did anyone think to at least try to add OCR-ing those labels on our phones to automatically enter the wifi password?
How do you change the label on the router that got installed 8 years ago and is working fine? Especially since the owner of the cabin in the woods that you just rented for the weekend is into ... renting cabins in the woods, not geekery.
> have these complicated passwords that seem like overkill. You're probably right that they're some sort of default.
It is the default. If you find their router you'll find that overkill password printed on a label on the bottom. More enlightened ISPs give you extra stickers with the same info that you can put on the fridge or somewhere like that.
Most modern phones recognize the standard and can be used through the native camera app.
You can do that easily on iOS, I'd be surprised if Android didn't allow it as well...
Tap in the password field, tap Autofill from the popup, and tap Scan Text.
On Android User A taps on the wifi they are connected to and gets a QR code, and User B taps on the icon for scanning wifi QR codes, so one tap each once you are in your wifi settings.
* Go to Wi-Fi in the Passwords app
* Select the Wi-Fi network you want to share
* Share Network QR Code
So even then, I'd recommend changing it, or push for these companies to provide generated passwords with a much larger key space.
int foo()
{
bar();
}Needless to say, I moved.
A rock will get the job done in a fraction of the time.
It's like all those nobodies on HN who go through all kinds of software gymnastics to secure their phone against imaginary "threat actors," when a mugger is just going to keep twisting their arm behind their back until they enter their PIN.
Wait 5 minutes for someone to come in or out (most likely a delivery driver) and tailgate behind them.
A locked building door is the weakest possible form of security. It isn't holding anyone back, whether kids or homeless or whoever else.
Even if we accepted the premise that one book should be the basis of all morality, this one contains within itself contradictions, satire, sarcasm, and a community context we no longer have: with individual quotes I can make anyone look like a hypocrite.
To my mind the more interesting question is, does a singular community condemn a behavior in out-group members that they tolerate or even praise in in-group members?
New International Version (NIV): "Do not steal. Do not lie. Do not deceive one another"
King James: "Ye shall not steal, neither deal falsely, neither lie one to another."
New Living Translation (NLT): "Do not steal. Do not deceive or cheat one another"
New Century Version (NCV): "You must not steal. You must not cheat people, and you must not lie to each other"
The Holman Christian Standard Bible (HCSB): "You must not steal. You must not act deceptively or lie to one another"
Wait, what? You have to point a powered device at an IR receiver and press a button like a TV remote? I've never seen a building entry system like that!
The fobs were visible by an IR camera (including the average smartphone) and could trivially be decoded as a short bit sequence with an IR sensor wired into a microphone jack, as the bit pattern was transmitted at ~audio rates.
So what they did is add a new fake tenant with a premium 1-900 number and used the intercom to call it, earning themseleves a bit of cash. Naturally, landlords had to foot the bill.
I do appreciate the hacking around aspect, particularly with respect to old phone systems, but having a free student phone removed seems like it would be a bad thing for everyone, no?
People would walk around big cities, usually on Friday evenings, radio scanner out, trying to find one of these. They would then dial a premium-rate number, preferably on more than one line. In most cases nobody would realize that something was up until Monday morning, and if they had a way to disconnect the calls before then, not until the bill came.
You could do similar shenanigans with unsecured PBXs or insecure answering machines that had a "call my mobile if somebody leaves a message" feature.
At my last apartment my LL would only allow a single number per apartment... well I was sharing the apartment with someone else and I was sick of being the only person to get called. 30 seconds of Googling revealed the user manual for the intercom, and of course the default password of "5555" was still set on it...
I programmed both our lastnames and phone numbers to our apartment unit number. I did that in 2014 and I moved out in 2016.
To this day -- NINE YEARS AFTER MOVING OUT -- I am still getting calls whenever someone hits #25 on that intercom.
I should have done the 1-900 thing :D
Ah, yes. It's the children who are wrong.
Let's say you're a woman. A woman who lives in one of these apartment complexes. A woman with a stalker. A stalker who has threatened to kill you, multiple times. Who has shown up at your apartment, but was rebuffed by the building security.
One day you wake up and find out that a "security researcher" found a way that anyone in the world can get into the building at any time, in addition to looking up who lives at each address. And it turns out the security researcher waited only two months (including over christmas break) to try to resolve the issue in a way that would not leave the existing buildings exposed.
If I were that woman, and something happened to me as a result of this disclosure, and assuming I was still alive, I would, at a minimum, sue the shit out of that security researcher.
You are right. But remember you can be sued for anything, and further remember that suing someone doesn't mean you have good cause to win.
For corollaries, see good samaritan laws
[0]: (specifically about Texas) https://www.uslawshield.com/can-get-sued-good-samaritan-laws...
[1]: https://www.themirror.com/news/weird-news/i-cpr-crash-victim...
[2]: (More generally) https://en.wikipedia.org/wiki/Good_Samaritan_law
So it stands to reason that a white hat hacker who, in good faith, publicly releases information in an attempt to get things fixed shouldn't face negative repercussion.
If you found the nuclear launch codes, and you're pretty sure nobody else has found them, should you wait a week and then release them, because you had a good faith interest in exposing this hole? No, of course not, that'd be insane. What one should do in that situation is wait, and try to get the codes changed. You shouldn't wait forever, because someone else might find them. But you also should wait for as long as you reasonably can, because of how severe the risk of releasing is.
This risk analysis is the calculus of responsible disclosure. Any ethical security researcher should err on the side of avoiding harm, making every effort to ensure the disclosure doesn't harm unnecessarily. For most researchers, that means waiting more than 2 months over a holiday season, even if it was just a bug in a javascript library or something. Knowingly exposing the privacy and security of thousands of people is pretty fucked up, imo. I'm pretty sure they could have come up with a half dozen different ways to try and get the issue resolved, if not through the company directly, then through individual apartment complexes, law enforcement, etc.
Looking at this closer, it's actually worse than I originally thought. You can see what time everyone comes home every day, what their weekly routines are. So you know when they're gone, so you can rob their house. Or you know when they come home, so you know when you can attack them. This is fucking chilling.
I see here a desire for a random person to accept a staggering amount of your personal responsibility. Anyone under long-term active threat without defense-in-depth redundancy isn't someone I can save by waiting longer before disclosure. I am frankly amazed you expect so much from a stranger for so little benefit.
It is fucking chilling -- that the publisher would do this, in the first place, and blow him off now, too.
Why don't YOU pick up what you said, and start contacting apartment buildings and police? How many of those half-dozen ways you mentioned will YOU act upon?
Intention is important.
If their intention is to highlight that a problem exists, then sure. They should be forced to participate in resolution (at the very minimum). As for liability? No, that definitely belongs on the owners of the insecure devices.
If their intention is to show to "the bad guys" where the spots are vulnerable? Then yes, they are partly culpable.
Again, being a good samaritan (showing that a problem exists) should NOT make you liable for the problems that already existed.
> you also should wait for as long as you reasonably can
That word, "reasonably", is loaded. I think waiting a couple of months is perfectly reasonable when being stonewalled by other parties, especially the owner.
> that means waiting more than 2 months over a holiday season
Yup, sure, because thieves definitely don't operate during holiday season. And please ask Russia and the US to hold off on their nuclear war. It's called Nuclear Winter, but that doesn't mean it has to happen during Winter, right?
> This is fucking chilling.
The problem existed before the announcement was made. You think it was chilling before? Just imagine that nobody who was capable of fixing it didn't know about the problem. So it could be abused without anyone being the wiser. That is fucking chilling. It's chilling that people would be more upset about the announcement and less upset about the apartment building owners not fixing the problem in the first place. That is fucking chilling.
Secondly, if a person is determined enough to look for vulnerabilities in the access control system, they are determined to do much more.
Thirdly, public disclosure more often than not leads to enhanced security down the line, protecting both men and women alike.
If you wanted to stay alive you'd be wise to think twice about going after people who go out of their way to inform you that the security you are dependent on is not doing its job. You'd be much better off instead going after the company who was negligent enough to create the system with such obvious flaws or the landlord who subjected you to it without even bothering to read the manual.
The alternative is that researches will stop telling the public when they aren't safe and you stay ignorant while some attacker spends the 15 minutes it takes to find and try the default password.
The person who disclosed this was right to get the information out as widely as possible as quickly as possible because, as you said, some people are likely depending on those locks for their safety. Thankfully everyone who learns that this product has made them vulnerable can now take measures to protect themselves accordingly.
We'd probably agree that there could have been better ways to disclose this, ways that made it instantly clear that this product was putting people in danger, while also not making quite as easy for others to repeat the attack, but in this case you can bet that trying the default password was going to be high on the list of things people would try anyway. I think it's extremely unlikely that this security researcher was the first it.
The most important thing is letting as many people as possible learn about their risk so that vulnerable people can protect themselves ASAP and so that the negligent company/landlord feels a lot of pressure to fix the situation as quickly as possible. If you make security researchers think twice about doing that you'll only allow yourself/others to come to harm. Ignorance really isn't always bliss.
It seems she’s almost right !
I don't remember if there was a setting to stop that from happening, or if there was, whether the setting may still exist today, but that would be a good way for them to get otherwise-private URLs.
Carry a brown paper (food delivery) bag. Stand by the intercom pretending to press buttons. When someone comes in or out, tailgate behind them and say "thanks". 9 out of 10 times they'll even hold the door open for you.
My theory is this is one of the reasons so many internet-of-things devices nowerdays omit any sort of offline/local network control.
No default passwords, no ports you can forward without knowing what you're doing, all the credentials sorted out on a cloud server.
(See also: opt-in versus opt-out for retirement plans, organ donation...heck, even this from yesterday: https://news.ycombinator.com/item?id=43144611)
https://en.wikipedia.org/wiki/QR_code#Joining_a_Wi%E2%80%91F...
It doesn't have to be complicated. A random passphrase can be much simpler and include significantly more entropy: four to six words plus a six-digit number. Any password generator worth a damn can generate something like this.
(But remote ssh login is disabled by default.)
In fairness, the blame for this kind of enabling attitude is mostly attributable to me locking myself out of the building and having to buzz my long suffering neighbours at all kinds of ungodly hours. Proud moments.
It was apparently never difficult to break into buildings, physical security has always been pretty poor. Unless you have an armed guard patrolling your property, there's no real reason to believe it secured beyond the fact that most people weren't going to break in anyway, or simply can't be bothered.
If anyone wants, perhaps login, change the password and make a new client as the password or something. This is going to get bad FAST.
If something bad happens because of this…
Other people will shrug and move on after trying everything they can via the proper channels.
And then of course there are the assholes who will just do it because it entertains them.
Many people will choose to do nothing in that case, but not everyone will accept that inaction which might lead to bigger harm is preferable to action which might lead to another possible negative outcome, but at a much smaller chance.
(It's basically that dumb trolley meme, but with undetermined outcomes.)
Every choice we make can have an adverse effect on others. Take the car today instead of walking? You just might cause an ambulance to be delayed leading to an unfortunate death. The chance of that happening is negligible of course, but not absent (it never is).
The more-responsible thing might have been to also reach out to residents of individual buildings & give them time to correct the situation, rather than relying on the company (which has a vested interest in ignoring the problem) to do the right thing. But security through obscurity is not a solution.
Can't software coders ever take responsibility? And this is on the programmer who implemented this, too. You just not let your product manager do this, ever. It's 2025 already.
And this is a security product, wtf? Residents should be suing individual programmers here. OWASP was created 24 years ago. Default credentials is like number 1 on their IoT app security list. Only a moron would not defend against this. If your manager requires this, you just send him:
https://wiki.owasp.org/index.php/OWASP_Internet_of_Things_Pr...
And tell him no. If he still wants it, you just report him to Reddit or whatever. :D
Best to get it out there, at least if you're stuck in one of these buildings you can log in and change the admin password yourself till your building management does something about it.
Or are you speaking of the transactional convention, in which people can break into systems, and then are entitled to publicity for that, so long as they give the vendor advance notice?
The whole responsible disclosure convention seems an imperfect compromise, among various imperfect actors. On occasion, individuals might decide that other options are more appropriate to the specific situation, and to Perfect Tommy it.
This is not some highly-technical vulnerability only accessible to nation-states with genius engineers and million-dollar labs with exotic instrumentation and brute-force supercomputers compute pulling down many megawatts of power. The OP literally logged into an open Wifi SSID, searched for the text on the page, and scrolled to the default password. None of those steps are hard to do, any jealous ex or disgruntled employee or divorced parent fuming in the parking lot for 5 minutes could effortlessly accomplish the same thing.
I honestly think it's likely that bad things have already happened due to this vulnerability - but not due to this disclosure.
But because it was only discussed in secret, no one ever got to the root cause of the issue and the hazard continued to be out there. Now that it's public, hopefully something will be done, and relatively quickly.
The debate has long since been settled comprehensively in favor of openness.
2025-02-14: CVE-2025-26793 assigned
2025-02-15: publication
So two weeks after they don’t respond what they’re going to do with their clients this gets published? I’d hardly call that responsible.
2024-12-27: Current vendor of MESH identified as Hirsch (subsidiary of Vitaprotech Group) and contacted
They were contacted 7 weeks before publication
and
2025-01-11: Hirsch product security responds requesting details and are asked if they intend to alert clients
They responded 5 weeks before publication, and so were aware of the issue for at least 5 weeks before it was disclosed, during which time they did nothing about it
"Awaiting Analysis This vulnerability is currently awaiting analysis."
For shits and giggles, I decided to try admin/admin, and to my surprise, I was logged into this device with full control.
I immediately logged out, but I could have easily changed the password or changed their configuration, knocking them offline...
I'm sure there are legal issues surrounding that, and I have no idea what kind of devices connected to the thing, but you'd be surprised how many random internet junk is out there with default credentials.
This "manufacturer" is not doing its due diligence in any way, shape, or form. They are the ones who should face jail time for not implementing bare minimum security practices.
The idea that the guy revealing a complete lack of security is committing a crime is like saying a guy informing someone that they're naked is guilty of forcibly stripping that person. Or that telling someone there's a giant red button that drains the landlord's bank account is guilty of pressing it. Maybe they should remove the giant red button?! Or at least put it in a locked room?
We should also, as you point out, require vendors to implement minimum security standards.
Which is keeping away only the honest and polite persons.
If you bypass a very shitty lock on a house, you've likely committed a crime.
> I just tried it (via Tor) [...]
Opsec: Failed
(All of which happened in an apartment building I lived in a few years ago)
>2025-01-29: Hirsch replies stating that these vulnerable systems are not following manufacturers’ recommendations to change the default password
this is why i like the 'secure by design' or 'secure by default' responsibility being put on connected product providers, e.g. EU CRA and implied in US M-22-09.
i am always fearful of unintended consequences of regulation like this, but it does seem necessary in today's world.
Why are these admin pages web findable? Why is there a public database of them? Why have they tried so hard to make it so accessible? Why is there no security? Arrrrrgggh.
OpenWRT ships with no password at all (!) with full root access on default install. The situation is the same: they politely suggest you change it from the default (blank) password but do not force you to do so.
By this logic every OpenWRT install (and many other softwares) dating back many years should be subject to CVE.