In this podcast episode, Felix takes us on a fascinating journey into the world of “connected lifts,” also known as elevators. These lifts have been intertwined with technology for longer than we might think. With the emergence of telephones, lifts started gaining the ability to call for help when stuck, evolving into a system where they can report maintenance issues and usage data over the internet.
The episode explores the tech components found in modern lifts, such as call buttons, door sensors, and APIs. Beyond convenience, these advancements improve maintenance efficiency and security. Cameras and AI are now used to identify parts needing repair, making the maintenance process more streamlined.
Security also takes centre stage, with discussions about using swipe cards and smartphone apps for lift access. However, the potential risks associated with these innovations are debated, questioning if the convenience is worth the expanded attack surface. A noteworthy highlight is the introduction of automatic software updates for lifts, reflecting a forward-thinking approach to elevator technology. This feature not only enhances performance but also contributes to market innovation.
Safety remains a top priority, and the podcast provides insights into the mechanisms that ensure secure lift operation. Controllers monitor lift speed, brakes, and shock absorbers, all of which play a crucial role in passenger safety.
We delve into the vulnerabilities that could be exploited in connected lift systems. It highlights how attackers, if on the same network, could potentially manipulate these systems to misdirect lifts, causing them to stop on unintended floors, exit through the wrong doors, or even simulate emergency stops. While attacking such systems may require expertise and knowledge, the simplicity of the Modbus protocol could make it an attractive target for experienced attackers looking to disrupt lift operations.
Moreover, the episode discusses the changing landscape of lift security, noting that while traditional network segregation has been a protective measure, the rise of hyper-connected lifts connected to the cloud and smartphones introduces a myriad of new attack vectors. The integration of various technologies, such as Bluetooth connections and building management systems, significantly broadens the potential attack surface. This shift prompts a call for more robust security practices beyond mere network segregation, urging the industry to adopt comprehensive security measures, intrusion detection systems, and robust monitoring to safeguard against potential cyber threats.