When The Front Door Becomes a Backdoor: The Security Paradox of OSDP
summary
Demonstrates that properly configured OSDP readers still allow practical attacks: a man‑in‑the‑middle on RS‑485 (tested with Melon and a laptop) uses an unencrypted PD busy message to stall and replay valid entry frames for timed door openings, while firmware extraction, netcat/SSH debugging and a custom fuzzer uncover three zero-day vulnerabilities (including two heap overflows) that enable remote code execution on controllers and a serial‑to‑Ethernet LAN pivot; prototype tools and exploits are built and reliably reproduce the failures.
AI-written summary · about
chapters (10)
- 0:00Introduction to OSDP security
- 1:30Access control architecture
- 4:31OSDP protocol overview
- 7:41Tamper protection and bypass
- 11:56Secure channel mechanics
- 16:49PD busy message attack
- 20:40Complexity and new risks
- 22:37Serial to IP network attack
- 28:39Fuzzing framework and bugs
- 33:15Mitigation and conclusions
related talks
40mBadge of Shame: Breaking into Secure Facilities with OSDP
46mNakatomi Space: Lateral Movement as L1 Post-exploitation in OT
36mAlarm.DISARM - Remotely Exploiting & Disarming Popular Physical Security System from Public Internet
22mAttacking SDN Infrastructure: Are We Ready for the Next-Gen Networking?
37mOpen Sesame! The full story behind opening a smart lock
29mBackdooring of Real Time Automotive OS Devices
48mAbusing Software Defined Networks
24mThe CSOs myopia