Two questions follow every connected elevator around: who can talk to its computers, and who's allowed to fix them? Both have been answered in public, once by a security advisory and once by a federal judge.
The short version
- In 2018, KONE published an advisory for its Group Controller (KGC), the computer that runs group dispatch. It listed four CVEs, CVE-2018-15483 through -15486, in versions 4.6.4 and earlier, fixed in 4.6.5. The worst was rated 9.6 (critical).
- The catch for an attacker: they had to be on the same LAN as the controller. KONE says the group controller isn’t essential to the elevator control system and the bugs didn’t affect elevator safety. The issues were reported by Sebastian Neuner of Google’s security team.
- In September 2015, a federal court in Pennsylvania ordered Otis to provide a functioning Otis Maintenance Tool for Elevonic 401 controllers, plus manuals, overlays, and code lists, within 24 hours, so another company could service a county’s elevators.
- Safety-related elevator software has its own standard: ISO 22201-1:2017, for programmable electronic systems in safety-related applications for lifts, known in the trade as PESSRAL.
Case file 1: the group controller
Remember the stack from Floor 3? Hall calls and kiosks feed a group controller, which decides which car goes where. In destination-dispatch buildings it also knows who is allowed on which floor. That makes it a juicy target, even though it’s nowhere near the brakes.
KONE’s advisory, first published September 5, 2018, lists:
That’s a textbook operational-technology story: a building computer running services like FTP with no login, reachable by anything on the same network. The fix was a software update that KONE rolled out to controllers in the field.
The honest framing matters. KONE’s assessment says the vulnerabilities did not create safety risks, because the group controller isn’t part of the safety system (Floor 2). What’s at stake is availability and dispatch: a group controller that’s down or tampered with can’t hand out cars properly. That’s the same line the whole industry draws: the cloud and the dispatcher can fail, but the safety chain has to stop the car on its own.
"Same LAN required" is only comforting if the elevator's LAN isn't your office LAN. Put elevator gateways and group controllers on their own segment, and ask the maintenance company how they get patched. KONE fixed this one by updating field units, which means somebody had to know those units existed.
Case file 2: the maintenance laptop
On Floor 5 we covered the right-to-repair fight over proprietary service tools. Here it is in a court record. In County of Berks v. Otis Elevator Company (E.D. Pa.), the court granted a petition for special relief and ordered that, within 24 hours, Otis provide Berks Elevator with:
- a functioning Otis Maintenance Tool capable of servicing Otis Elevonic 401 controllers,
- all Elevonic 401 owner’s manuals, service manuals, and service bulletins,
- manuals and bulletins for the hydraulic elevators,
- all OMT overlays, OMT manuals, operating instructions, and code lists,
- and anything else needed to service the elevators in the county’s Services Center and Courthouse.
It’s one case about specific buildings, not a ruling that every Otis tool must be open. But it shows how concrete the problem is: without the tool and the code lists, a qualified mechanic standing in front of the controller can’t read what it’s saying.
Case file 3: software that’s allowed to be a safety device
Older elevators did safety with switches and relays. Newer ones can use electronic safety systems, but only under rules written for exactly that. ISO 22201-1:2017, Programmable electronic systems in safety-related applications, Part 1: Lifts (elevators), is the lift-specific standard. It sits alongside the general functional-safety standard, IEC 61508.
The point for a curious reader: the software that decides “stop now” lives in a completely different world from the software that picks your car or draws the cloud dashboard. It’s designed, tested, and certified differently, and a firmware update to it can’t be treated like a routine app update.
The conference record
The best-known public talk is DEF CON 22’s Elevator Hacking: From the Pit to the Penthouse (Floor 5). DEF CON 27 in 2019 added WillC’s Phreaking Elevators, whose title nods to old-school phone phreaking, a fun companion to Floor 7’s elevator phone. As always here: public talks, no how-to.
What we didn’t find: a publicly documented ransomware attack that stopped passenger elevators. If one surfaces with a real incident report, it goes here.
Sources
- KONE: KONE Group Controller (KGC) vulnerability advisory (first published September 5, 2018)
- Justia: County of Berks v. Otis Elevator Company, order granting petition for special relief (2015)
- ISO 22201-1:2017, programmable electronic systems in safety-related applications for lifts
- IEC 61508-1:2010, functional safety
- DEF CON 27: WillC, Phreaking Elevators (video)