Cardkey Security Systems Rendered Useless by an Android App

For the past several weeks we have heard a lot of chatter about how vulnerable the Android operating system is when it comes to protecting users from viruses and malware, but Ian Robertson has turned the tables by developing an Android app to expose a completely different type of security risk. The app, called Caribou, can render door locks using an IP-based cardkey system (the type used at many office buildings, apartment complexes, and hotels) useless in one click and a matter of seconds.

The user need only obtain the IP address of the network the security system is operating on and Caribou brute-forces the rest. Once the PIN is cracked, doors are unlocked in sequence and remain unlocked for 30 seconds. No, it might not be as scary at first glance as a virus infecting your smartphone, stealing your data, and running up your bill, but in the wrong hands the technology could give crooks a one up on physical security systems. This is exactly the point Mr. Robertson wants to get across: Shore up those home and business security systems, because the next person using this technology might not have such a benevolent reason to do so.

[via AndroidCentral]

25 Comments

THAT.IS.AWESOME

Coolest thing I’ve ever seen done on Android.

Unsecured wifi?

Ah, it’s the old access the cardkey system, unlock all available doors in sequence, allow 30 seconds for entry, and then re-lock all those same doors using Caribou on Android trick.

Very glad this application is NOT available to the public.

@ari-free

Wonder if this could be used on cars

#mike
Yeah, all you have to do is get the IP address of the network your car is using….oh wait.

I always forget my cardkey for work. But I always have my Droid handy. I need this app!

cool, but any good IT system admin would keep the security system off the standard IP network. It should always be closed, but cool trick!

So either the security system is using a public IP, or has a WiFi signal that this phone was somehow connected to first? Both scenarios seem pretty unrealistic. Cool trick though.

@cweb hotels do not hire good system admins. Nor should sysadmins be doing this, net admins should. Hotels do everything the crappiest and cheapest way possible.

I need this app… Love the music in the video :-P

Sounds like breaking an entering. But very cool. I wouldn’t do it without authorization.

Why’d he bother hiding the ip address?

$50 straight to whoever can find me this app. I’m locked out of my dorm all the time, as my roommate constantly takes and loses my keycard. I’ll pay in PayPal, I’m serious.

All the naughty things I could do if I had this…

Where can I get it?

Under the new laws of the land, Homeland Security might take an interest in this and render the developer in a little hot water!
–
That’s the paranoid part of the post… ;)
–
Now… lol, where the hell do I get my hands on this so I can try it out where I work, lmao!