One of the coolest features available on the various Mircom panel models is the ability to set a keyless
entry code for access to the building. Are you into Urban Exploration? Want to gain access to a building for a little break
and enter? Hate when you lose the keys to your building and get stuck waiting for someone to enter the building to let you in?
All of these reasons are good enough reasons to set a keyless entry code. To enter the Keyless Entry Login Menu, enter the
following code: 9998. Some older models use 0001. If you have not managed to successfully bypass the administration menu
in all its 10 to 12 digit hard-to-hack glory, then you will not be able to set your own keyless code. The next best thing is the
ever time consuming Brute Force Attack!
With a 4 digit keyless entry code, you have 10,000 possible combinations to try. When you enter the login ID (9998 or 0001) you will be asked
for a pin code. When you get the pin code wrong, there will be a 3-5 second delay before you are brought back to the main menu which shows
"Enter the dial code" on the screen. Try obvious combinations first: 0000, 1234, 2004, 9999, etc. If those don't work, work your way up;
there is a high probability you will get the correct keyless entry code before trying all 10,000 combinations - unless of course the administrator
didn't set a keyless entry code. Those silly bastards.
Other ways to open the door for keyless entry:
I've thought of two other ways to get access without physically breaking the door open or waiting for someone else to let you in. The first way:
I noticed that in some cases misconfigured or inactive extensions for all of the Mircom Panel models will give you a 0+ operator. In my
case Telus is the telco. If you social engineer a 0+ TOPS/TSPS operator into transferring you to a number (tell them your telephone keypad
is jammed and it's urgent), such as a cell phone, you could then answer that cell phone and press '9'. The DTMF "9" key triggers the Mircom
box which in turn opens the door when pressed. The other way to gain access for keyless entry is by blasting DTMF "9" into the voice mail
message of your cell phone or landline beforehand and then when the time is right, social engineer a 0+ operator and have them transfer you
to that telephone number. The problem with the second trick is that you might have problems with remote-controlled voice mail systems, such
as most versions of Audix/Octel/Meridian Voice Mail System which stops recording when you hit any DTMF key on the telephone. Old-school tape
recorders which allow you to record anything (including DTMF) will work fine enough indeed.
Even MORE ways to open the door for keyless entry:
(Added 12/11/04, suggested by CYB0RG/ASM)
Tried tested and true. This trick requires either a cell phone that can generate loud and accurate DTMF, or a tone dialer with a fresh set of batteries. In order to make this trick work, you have to call up any random extension available on the Telephone Access Panel. When the call rings through you may either press DTMF "9" before the call is completed, or after someone or something (voice mail) picks up. Be sure to place the cell phone or tone dialer against the speaker of the access panel for the best results. If the door opens, you will hear a short echo of the DTMF 9 emitting from the panel, then a short buzzing sound for up to 5 seconds. This means the door has opened!
A successful door entry hack is shown below in this photograph: