Alarmed & Dangerous: Exploiting Vulns in EMS Systems, McKeegan Curran, TAPS Team, Caterpillar

Discovery via a Fraternity Fire Panel

Keegan Curran found a critical IDOR while proxying his fraternity's upgraded fire-alarm mobile app with Fiddler. Changing the site-number parameter in API calls returned other customers' data within minutes, despite the app's outdated codebase and infrequent security updates.

Exposed Sensitive Data

Vulnerable responses leaked customer addresses, lockbox combinations, and digital-lock codes for fire and security systems. Because POST, PUT, and DELETE were equally affected, attackers could modify—not just view—remote system state without authentication beyond a valid app session.

Abuse Scenarios at Scale

Curran mapped roughly 597 vulnerable sites in Davenport, over 14,000 in Iowa, and 269,000 across North America including hospitals, schools, power plants, and Fortune 50 facilities. Attackers could trigger immediate emergency dispatch, place alarms in test mode to suppress real events, or induce alarm fatigue before physical intrusion.

Remediation Timeline

Reported in July 2024 through a local intermediary because the vendor lacked a formal bug-bounty program, the vendor patched quickly given the potential for mass false dispatches and critical-infrastructure impact. The talk underscores how overlooked physical-security SaaS APIs can threaten public safety.