From Packets to Physical Access: Bypassing Biometric Door Controller via Unauthenticated Protocol Communication
In enterprise risk management, a sharp divide often exists between digital perimeter defence and facility protection. Organisations deploy multimillion-dollar Endpoint Detection and Response (EDR) agents, advanced firewalls, and rigorous Zero-Trust authorisation models to guard their digital infrastructure. Yet, the physical doorways to the very server housing units are left guarded by legacy embedded hardware running unauthenticated protocols.
I found this mechanical reality completely exposed during a recent production Active Directory assessment. The terminal was sitting wide open on a flat /16 network—operating with zero network segmentation, triggering no administrative security alerting pipelines, and allowing full corporate routing from completely untrusted segments.
When an operational protocol values raw speed and historical compatibility over cryptographic assurance, the line between an internal network packet and a physical security failure completely vanishes. This write-up explores how legacy biometric access control terminals, operating via unauthenticated communication protocols over port 4370, can be completely compromised by network-adjacent operators — allowing full data extraction and the systematic bypass of physical facility constraints.
Architectural Overview: How Access Control Terminals Communicate
To understand why modern physical security systems are so frequently compromised, we have to look closely at the underlying plumbing. The bridge between digital logic and physical access control relies on communication frameworks designed in a completely different era of networking.
The Legacy Protocol Model: At the heart of many legacy access control terminals lies a reliance on proprietary, low-latency communication protocols. These protocols typically bind to specific, fixed management ports — most notoriously, UDP port 4370.
When these systems were conceptualised decades ago, the primary engineering goals were raw speed, absolute simplicity, and low processing overhead. Microcontrollers of that era had limited computational power, so design requirements favoured lightweight, unencrypted binary protocols. Commands to sync user biometrics, pull attendance logs, or trigger a door strike needed to execute instantly, without the computational burden of heavy processing layers.
[ Management Workstation ] ---- UDP Port 4370 (Plaintext Commands) ----> [ Legacy Terminal ]This engineering philosophy makes sense only when viewed through a historical lens. These systems were built to operate over dedicated, physically isolated local area networks (LANs) or point-to-point RS-232/RS-485 serial connections. In that environment, physical isolation was the security perimeter. However, as organisations modernised, these isolated networks were bridged into corporate intranets.
By operating without encryption, session management, or modern Zero-Trust principles — where every request must be explicitly authenticated and authorized regardless of origin — these protocols left a massive architectural debt unpaid. They function perfectly for performance, but they treat the network media itself as an implicitly secure zone.
The Trust Assumption Fallacy: The structural vulnerability of these legacy systems isn’t just a software bug; it is a foundational design flaw known as the Trust Assumption Fallacy.
The firmware on these terminals operates on a simple, dangerous premise: network adjacency equals administrative authorisation. In plain terms, the device assumes that if a packet successfully routes to its management port, that packet must have originated from a legitimate administrative workstation.
Because these legacy protocols lack cryptographic handshake layers — such as mutual TLS (mTLS) or robust challenge-response authentication mechanisms — there is no cryptographic verification of the sender’s identity. The terminal does not validate who is sending the command, only that the command matches the expected binary structure.
Consequently, the security model completely breaks down in modern routed environments. If an attacker gains a foothold on a corporate Wi-Fi network, compromises a VoIP phone VLAN, or finds a way to pivot across subnets, the game is over. The absence of cryptographic handshakes means that anyone who can route packets to the terminal can control it. An attacker can send unauthenticated commands to extract the entire user database, alter logs, or upload arbitrary firmware, turning a physical security barrier into an open doorway.
Reverse Engineering the Interface
Transitioning from architectural flaws to active analysis requires understanding how these systems present themselves on a network. Identifying these targets doesn’t require loud, destructive actions; instead, it relies on recognizing the distinct footprint left by legacy protocol behaviour.
Fingerprinting the Target Asset: The first step in analysing access control infrastructure is discovering and fingerprinting the target safely. Because legacy firmware stacks can be fragile, aggressive scanning can cause device hangs or unexpected reboots. Instead, discovery focuses on passive listening or highly targeted, localised scans.
Identifying these terminals typically begins by scanning for UDP port 4370, the standard port for many biometric and RFID attendance systems. Unlike TCP services that provide clear banner-grabbing opportunities upon connection, UDP services require an active query to respond. Analysts can send a simple, low-overhead probe packet — such as a basic connection initialisation primitive — to the target port.
[ Auditor/Scanner ] ---- Low-overhead UDP Query ----> [ Terminal (Port 4370) ]
[ Auditor/Scanner ] <--- Structural Binary Response -- [ Terminal (Port 4370) ]A vulnerable terminal will reply with a specific structural binary response, often containing the machine ID or firmware version in plaintext within the payload. This distinct response pattern allows for definitive asset fingerprinting without disrupting the device’s operational availability.
Programmatic Interaction via Protocol Abstraction: Interacting with these raw binary payloads directly can be tedious, requiring manual byte-shifting and packet packing. To streamline this process, security researchers rely on programmatic translation layers to bridge the gap between modern scripting languages and low-level primitives.
Get Snehil’s stories in your inbox
Join Medium for free to get updates from this writer.
Open-source libraries — most notably the zk Python module—act as an abstraction layer for these proprietary protocols. These modules unpack the complex, undocumented binary structures into clean, readable high-level code.
+-----------------------------+
| Python Script (Clean) | -> e.g., device.get_users()
+-----------------------------+
|
v
+-----------------------------+
| zk Module Abstraction | -> Translates command to hex payload
+-----------------------------+
|
v
+-----------------------------+
| Raw Binary Primitives | -> e.g., \x00\x00\x0b\xb8... over UDP
+-----------------------------+Instead of manually constructing hex streams to pull records, an analyst can call a simple method like get_users(). The library handles the underlying work: calculating checksums, formatting session headers, and parsing the incoming binary stream back into structured data like JSON. This abstraction turns a complex reverse-engineering challenge into a straightforward scripting exercise, making programmatic audit automation incredibly efficient.
Note on Protocol Quirks: Many of these abstraction libraries reveal that the protocol lacks session state entirely, meaning each command sequence effectively re-authenticates using the same static hardcoded keys or no keys at all.
Deep Dive: The Exploitation Walkthrough
With the protocol abstracted, analyzing how these architectural vulnerabilities translate into real-world impact becomes clear. When an access control terminal fails to validate session authenticity, every command sent by an adjacent client is treated as an official administrative directive.
Hardware Inventory & Diagnostic Harvesting: The initial stage of a security assessment often involves identifying device parameters to determine firmware vulnerability posture. In a secure architecture, hardware diagnostic logs are restricted to authenticated administrators. In legacy terminals, however, system metadata is exposed to any network-adjacent entity.
Because the command state machine handles device diagnostics through unauthenticated binary primitives, an analyst can query internal parameters immediately after initialising a raw UDP socket. The terminal willingly replies with deep hardware metadata, including platform architecture, MAC addresses, firmware versions, and maximum memory capacities.
from zk import ZK
TARGET_IP = "192.168.1.1"
PORT = 4370
try:
# Initialize the connection via the abstracted protocol layer
zk = ZK(TARGET_IP, port=PORT, timeout=5)
conn = zk.connect()
print(f"[+] Connection Established with {TARGET_IP}")
print(f"[*] Firmware Version : {conn.get_firmware_version()}")
print(f"[*] Platform Type : {conn.get_platform()}")
print(f"[*] Device Name : {conn.get_device_name()}")
conn.disconnect()
except Exception as e:
print(f"[-] Diagnostic harvest failed: {e}")From an auditor’s perspective, this level of information leakage is highly valuable. Gathering exact platform specifications allows for precise patch-level analysis without generating noisy network anomalies. From a defensive posture, it highlights a severe lack of data isolation — diagnostic boundaries should never overlap with public network interfaces.
Data Exfiltration (User & Credential Extraction): The true impact of the Trust Assumption Fallacy becomes apparent during user database analysis. Because the terminal’s architecture assumes that network access implies administrative trust, it permits direct queries to volatile memory or the local flash storage where credential records reside.
When a command requesting the user database is transmitted over UDP port 4370, the terminal iterates through its internal tables and returns raw data blocks. The abstraction layer parses these blocks into structured fields. This allows an auditor to extract user IDs, privilege levels (such as distinguishing regular employees from system administrators), registered RFID badge token numbers, and fallback PIN codes.
# Conceptual logic for auditing credential tables
try:
conn = zk.connect()
users = conn.get_users()
print(f"[+] Successfully extracted {len(users)} user records.\n")
print(f"{'User ID':<10}{'Name':<20}{'Privilege':<12}{'Card ID':<15}")
print("-" * 57)
for user in users:
# Privilege 3 typically denotes Super Admin status in legacy firmware
priv_str = "Admin" if user.privilege == 3 else "User"
print(f"{user.user_id:<10}{user.name:<20}{priv_str:<12}{user.card_idx:<15}")
conn.disconnect()
except Exception as e:
print(f"[-] Credential extraction blocked or failed: {e}")The Architectural Impact: The critical vulnerability here isn’t just that the data is sent over the network; it’s that the device does not require a pre-shared key or cryptographic handshake before releasing sensitive security assets. By fetching these records, an attacker bypasses the entire physical verification system, acquiring the exact digital tokens needed to clone physical access badges or log into administrative panels.
Operational Impact: The Physical Security Domino Effect
When low-level digital protocol flaws cross over into the physical world, the traditional boundaries of corporate security collapse. A failure in network packet verification directly translates to a complete failure of physical security perimeters.
Bypassing Physical Access Controls: Extracting database variables is rarely the final objective; it is the catalyst for physical bypass. Armed with the unencrypted User IDs, card indexes, and administrative privilege mappings harvested in the recon phase, an attacker can manipulate the terminal’s physical state in three ways:
- Badge Cloning: The harvested RFID token indexes can be written to blank rewritable cards using simple, low-cost hardware cloners, creating functional replicas of legitimate employee credentials.
- Administrative Takeover: By transmitting specific binary commands over UDP port 4370, an attacker can overwrite the terminal’s user privilege tables, elevating a dummy account to a “Super Admin” to alter device behavior or lock out legitimate staff.
- Direct Relay Actuation: Most critically, the legacy protocol includes testing and diagnostic primitives that allow remote administrators to actuate the terminal’s internal door strike relays. An attacker can send a single unauthenticated packet to trigger the door lock directly, physically opening the perimeter without ever presenting a card or biometric sample.
[ Attacker Packet ] -- UDP 4370 (Relay Command) --> [ Terminal ] --> [ Actuates Electric Strike ] --> ( Door Unlocks )Network-to-Physical Privilege Escalation: The true danger of the Trust Assumption Fallacy lies in its ability to facilitate seamless network-to-physical privilege escalation. In standard threat models, an attacker who gains a foothold on a corporate network — via a compromised workstation, a rogue drop-device, or weak corporate Wi-Fi — is confined to digital lateral movement.
Legacy access control terminals completely break this model. Because these devices are frequently attached to corporate subnets without micro-segmentation, standard internal network access becomes equivalent to holding a master physical key.
An attacker sitting in an office cubicle, a lobby, or even a routed adjacent VLAN can send commands directly to a terminal guarding a restricted facility. By translating digital network packets into physical access, the threat actor can walk straight into server rooms, executive suites, or secure document vaults — completely bypassing the security cameras, security guards, and heavy doors designed to keep unauthorised personnel out.
