Vistor Managemen Vulnerabilities - ThreatWire Crosspost (Patreon)

By Shannon Morse 

IBMs cybersecurity team, called X-Force Red, recently published details of an investigation they did into five visitor management systems. Visitor management systems are supposed to replace security guards or reception desks, or add to them, to speed up the process of allowing people access to a building by using IoT.  

Since these systems are connected, though, that also means they are susceptible to being hacked. X-Force Red, and most notably, two of their interns named Hanna Robbins and Scott Brink, found 19 total zero day vulnerabilities in the five different devices they studied - which are offered by different companies. The products are called the Jolly Technologies’ Lobby Track Desktop, HID Global’s EasyLobby Solo, Threshold Security’s eVisitorPass, Envoy’s Envoy Passport, and The Receptionist.

Just to list off a few of the security vulnerabilities they found: these included information disclosure vulnerabilities, default admin credentials, privilege escalation bugs, and data leakage of info on visitors like their driver license numbers, SSN, and full names. 

Aside from stealing data, an attacker could use these devices to gain access to a building along with social engineering, do recon on recurring visitors, print fake badges, or commit identity theft. And while you may run across one that is not connected from time to time, these also could pose a risk as they are physically accessible by visitors and could be used as a pivot point for a network.

Of all of them, Lobby Track had the most issues, with seven total. The Receptionist had the least, with only one. All of these were disclosed and CVEs issued before the research was posted publicly. Each of the vendors is or has already issued patches. In the future, vendors should consider these techniques and strengthen their admin creds, encrypt data, and harden access to the device by not connecting them to a network or isolating them from other devices.

Support Threwatwire at Patreon.com/threatwire