The first critical component to any attack is an entry point. As we lock down our firewalls and sophisticated routers, it can be easy to overlook the network-connected physical access control systems. According to a study done by IBM in 2021, the average cost of a physical security compromise is 3.54 million dollars and takes an average of 223 days to identify a breach.
Carrier’s LenelS2 is a global distributor of HID Mercury access control systems, widely deployed across multiple industries including education, real estate, healthcare, transportation, and certified for use in federal and state government facilities.
Trellix's Threat Labs team uncovered 8 zero-day vulnerabilities leading to remote, unauthenticated code execution on the LNL-4420 access control panel. When combined, these findings lead to full system control including the ability for an attacker to remotely manipulate door locks. To emulate a true nation-state level threat, our team began our research without access to the system firmware. During this presentation, we will deep dive into our hardware hacking process including the challenges faced such as bypassing the bootloader, hardware-based watchdog timers, and authentication. We will describe our use of emulation and provide a detailed walkthrough of the 8 discovered zero-day vulnerabilities, describing end to end exploitation using malware we designed to control system functionality. We culminate the talk with an impressive live demo featuring full system control, unlocking doors remotely without triggering any software notifications.