A single default password exposes access to dozens of apartment buildings

A security researcher says the default password shipped in a widely used door access control system allows anyone to easily and remotely access door locks and elevator controls in dozens of buildings across the U.S. and Canada. Hirsch, the company that now owns the Enterphone MESH door access system, won’t fix the vulnerability, saying that the bug is by design and that customers should have followed the company’s setup instructions and changed the default password. That leaves dozens of exposed residential and office buildings across North America that have not yet changed their access control system’s default password or are unaware that they should, according to Eric Daigle, who found the dozens of exposed buildings. Default passwords are not uncommon nor necessarily a secret in internet-connected devices; passwords shipped with products are typically designed to simplify login access for the customer and are often found in their instruction manual. But relying on a customer to c ... Read full article.