IBM Finds Security Flaws in Visitor Check-In Systems

IBM Finds Security Flaws in Visitor Check-In Systems

“We found that you could break out of the kiosk and interact with the underlying Windows operating systems, and from there do things like drop malware or open up the database,” said Daniel Crowder, research director at the IBM X-Force Red security unit.

  • By Jessica Davis
  • Mar 05, 2019

Researchers from IBM have found security flaws in some digital systems used in office buildings to let visitors check in and get access badges. According to the researchers, some of the devices used with these systems have flaws that could leave facilities insecure.

“We found that you could break out of the kiosk and interact with the underlying Windows operating systems, and from there do things like drop malware or open up the database,” said Daniel Crowder, research director at the IBM X-Force Red security unit.

By accessing the database, a hacker could learn who else was visiting the office—which could be sensitive information—or allow them to impersonate expected visitors to enter offices without permission.

“Knowing, for instance, that the CEO of a related company has been visiting every day for the last few weeks would be valuable intelligence to collect,” Crowder said. “Depending on what data the visitor management system stores, there may be an opportunity for identity theft as well.”

According to Crowder, these visitor management systems are mostly designed to be used without an attendant, but their deployment can vary from site to site.

Research on these visitor check-in systems was conducted by two college interns with guidance from the X-Force Red team. The researchers investigated the devices’ software, but did not probe any cloud-based visitor tracking tools.

Affected systems include Lobby Track Desktop, EasyLobby Solo, EVisitorPass, Envoy Passport and The Receptionist for iPad.

According to Crowder, IBM notified the system vendors of the vulnerabilities so that they could be patched as needed before IBM disclosed the issues.

About the Author

Jessica Davis is the Associate Content Editor for 1105 Media.

Featured

  • Collaboration Made Easy Using a Work Management Platform

    Effective collaboration between security operators, teams and other departments is critical to the smooth functioning of organizations. Yet, as organizations grow in complexity, it becomes more difficult for teams to coordinate with each other. This is compounded by staffing shortages, turnover and ineffective collaboration tools. Read Now

  • Creating a Safer World

    Managing and supporting locks and door hardware within a facility is a big responsibility. A building’s security needs to change over time as occupancy and use demands evolve, which can make it even more challenging. Read Now

  • Creating More Versatility

    Today, AI has become top of mind for most security professionals. It is the topic of conversation in the technology world and continues to transform the way data is used to make important business decisions. Read Now

  • Report: 78 Percent of CISOs Seeing Significant Impact from AI-Powered Cyber Threats

    Darktrace recently unveiled its 2025 State of AI Cybersecurity report. The findings reveal that 78% of Chief Information Security Officers (CISOs) surveyed say that AI-powered threats are having a significant impact on their organizations, a 5% increase1 from 2024. While an increasing number of CISOs report feeling a significant impact from AI threats, more than 60% now say that they are adequately prepared to defend against these threats, an increase of nearly 15% year-over-year. However, insufficient AI knowledge and skills and a shortage of personnel and talent continue to be listed as the two top inhibitors to a successful defense. Read Now

Most   Popular

New Products

  • ComNet CNGE6FX2TX4PoE

    The ComNet cost-efficient CNGE6FX2TX4PoE is a six-port switch that offers four Gbps TX ports that support the IEEE802.3at standard and provide up to 30 watts of PoE to PDs. It also has a dedicated FX/TX combination port as well as a single FX SFP to act as an additional port or an uplink port, giving the user additional options in managing network traffic. The CNGE6FX2TX4PoE is designed for use in unconditioned environments and typically used in perimeter surveillance.

  • HD2055 Modular Barricade

    Delta Scientific’s electric HD2055 modular shallow foundation barricade is tested to ASTM M50/P1 with negative penetration from the vehicle upon impact. With a shallow foundation of only 24 inches, the HD2055 can be installed without worrying about buried power lines and other below grade obstructions. The modular make-up of the barrier also allows you to cover wider roadways by adding additional modules to the system. The HD2055 boasts an Emergency Fast Operation of 1.5 seconds giving the guard ample time to deploy under a high threat situation.

  • Mobile Safe Shield

    Mobile Safe Shield

    SafeWood Designs, Inc., a manufacturer of patented bullet resistant products, is excited to announce the launch of the Mobile Safe Shield. The Mobile Safe Shield is a moveable bullet resistant shield that provides protection in the event of an assailant and supplies cover in the event of an active shooter. With a heavy-duty steel frame, quality castor wheels, and bullet resistant core, the Mobile Safe Shield is a perfect addition to any guard station, security desks, courthouses, police stations, schools, office spaces and more. The Mobile Safe Shield is incredibly customizable. Bullet resistant materials are available in UL 752 Levels 1 through 8 and include glass, white board, tack board, veneer, and plastic laminate. Flexibility in bullet resistant materials allows for the Mobile Safe Shield to blend more with current interior décor for a seamless design aesthetic. Optional custom paint colors are also available for the steel frame.