Adventures with Neighborhood Gates (Summer, 1999)
-------------------------------------------------
By jaundice

This article will attempt to enlighten you a little on those security gates
found on gated communities, office buildings, etc.

The way most of these gates are set up is that there are two lanes: one for
residents, and another for visitors. The residents have either a magnetic
entrance card of some sort, or a numeric code. The visitors must either have a
default entrance code (not likely), or must dial the house of the person whom
they wish to visit. The dial box varies with different models most will give a
list of last names with corresponding three or four digit codes. When you find
the name of the person you wish to visit, you dial pound followed by the three
or four digit code in most cases. The box then calls that house and you have a
time limited two-way conversation with that person. They may allow you entrance
by pushing a number on the keypad, which opens the gate (the number nine in
this case). Most gates have a default entrance code. I've heard "911" works on
most gates. There is also a default code for postal workers, delivery people,
emergency vehicles, etc.

While visiting friends who live in a gated community, they told me that they
had picked up the phone number for the front entrance gate on their Caller ID.
This model also had a great feature on it: video access. There was a camera no
bigger than a dime built into the call box. We could actually tune a television
set into channel 18 and have a visual on who was at the gate. I was curious
about the number that the box used to call out with. When we called it back we
got a carrier, but when dialed with any terminal program, it would send back
indecipherable gibberish. After a few minutes of playing with the number, we
found that it would do something strange. When a visitor at the gate would dial
the three digit code to call out and we dialed the box at the same time, it
connected! The line was somehow patched through to that person, and we would
have two way voice contact, with a visual on our end. Of course, you can use
your imagination as to what you could do to a person who is waiting at a gate
for entrance, and you have total control as to whether or not they get in.

There was one problem though. The time was limited, and unless we were very
quick on the redial, we didn't have a very good chance of connecting at that
magic moment when both we and they dialed. The number would ring twice, and on
the third ring the carrier would pick up. At this time we were intent on
controlling the gate completely. We took a walk out to take a look at the call
box, and in addition to the names list, the name of the company who
manufactures the system. With the quest for gate programming software in mind,
we hit the Net. Of course this company had a web site, and some downloads.
Though they didn't have the programming software for the dial-up connection,
they had a pretty useful FAQ. This FAQ had codes to establish two way voice
connections with the person every time (hit pound when the carrier picks up).
It also had a code to lengthen the connection time. With the video option you
had the chance to view the expressions of the people at the gate. Let's just
say that we had total control over who was or was not going to visit the
complex.

We were curious as to what kind of password protection it had, and if there was
a backdoor. According to that FAQ, the box had a six-digit code in order to
edit the names list on it. It would allow three tries, followed by a three
minute delay. It said that if you forget your password, all you need is the
serial number of the box. You call them and tell them the serial number, and
presto, there's the password! We didn't go as far as to pry the cover off the
box to find a serial number, but hey, if you re willing to do that...

To make a long story short, we abused the video call box for four days
straight. They eventually just shut off the video channel, which took a lot of
the fun out of messing with people. The box, however, is all hardwired so they
can't deny you access to it without some work. These things won't work on all
gate systems, but I can assure you that they aren't that different from model
to model. Have fun!