Box of Secrets: Discreetly modding an apartment intercom to work with Apple Home

I had the same problem and I've searched for ready made solutions for over an year before I found a guy that reverse-engineers and builds ready-made boards to install in my intercom for less than 30 euro.

I'm unsure if I should post the link or not as it's specific to Romania, but I love how janky the buids are: https://www.olx.ro/d/oferta/automatizare-interfon-electra-cu...

I have a similar Apple HomeKit integration to my apartment door system in a much simpler way;

When you buzz the apartment from the intercom it connects to a dedicated landline phone, That landline is setup to automatically go straight to voicemail, and then the voicemail message is just a recording of the tone required to open the door.

Then I have a smart power socket that the landline phone gets its power from - which I can toggle in the home app.

So if you turn on the power socket and dial the apartment code at the entrance, it buzzes you straight in. Or turn the power socket off and it doesn't.

I’m actually pretty surprised how bad the intercom ecosystem is these days.

Why aren’t there more ‘semi dumb’ Ethernet or wifi products that just let you announce that dinner is ready? It doesn’t need to be a fully ruggedised commercial system like this one or a fully integrated cloud managed solution like ring.

The cheap no name wireless ones can’t handle comms between rooms, let alone across a house.

The security implications aren’t insurmountable - you could use pairing codes if there are multiple on the network.

I’ve accepted that it’s a niche market, and that the only solution is to use Asterix with a some cheapo voip phones.

Part of the plan: Write firmware for an unfamiliar microcontroller. Also part of the plan: Don't spend the entire vacation...

I love the future so far.

This reminds me of another annoyance I have. We have a wall mounted thermostat using batteries at the cabin. It controls how much water is let through from the central heating to the floors by sending some radio signal. I would like to be able to control this remotely, for instance to turn on heating a day before arrival. But the only way to do this is to buy a new unit connected to the pipes as well and upgrade the whole thing, which was quoted like $2k++ and need their app and their subscription. But why can't something just mimic the radio signals? That already works today! Why do I have to rebuild the whole heating setup for this? So stupid when technology locks you in without need.

I'm tempted to have a remote controlled screw driver that can twist the knob remotely or something.

For some European intercoms, there is Doorman [0]. Their authors reversed engineered the protocol used by Koch and built an ESP32 + Home Assistant solution that works quite nicely (including board). The "party mode" [1] was a life saver for me when doing events on the rooftop.

[0] https://doorman.azon.ai/ [1] https://doorman.azon.ai/guide/features/ring-to-open

I built something similar! https://michael.stapelberg.ch/posts/2021-03-13-smart-interco...

> I bought the cheapest compatible BTicino intercom device (BT 344232 for 32 €) that I could find on eBay, then soldered in 4 wires and added microcontrollers to make it smart. It now connects to my Nuki Opener Smart Intercom IOT device, and to my local MQTT Pub/Sub bus (why not?).

Frank's guests just need to get the Doorking 16120 default key and start letting themselves in.

Edit: undergrad shenanigans from ten years ago:

Our university student-run electronics lab had an issue: technically anyone with a student card was allowed on premises at any given time, but the department only gave us a small set of keys that we had to share with the rest of the student associations. Obviously we needed a solution.

We did some snooping and found that the request-to-exit button wire was running on a cable tray alongside all the other wiring and plumbing, as the lab was in the basement. We picked a suitably dark, inconspicuous spot and wired up a Raspberry Pi driving a transistor and in turn a relay which we then wired in parallel with that button. Users could then connect to the local lab wifi and then SSH into the device. Login shell was replaced with a script that pulsed the GPIO line for half a second and subsequently caused the door to open.

We never got caught and apparently all the evidence was destroyed when the building was renovated a few years later.

This is a good way to breathe new life into existing tech for your smart home ecosystem. My setup mainly consists of Philips Hue lights at the moment, which. I have hooked up using Openclaw, I'd love to add more smart functionality and like an intercom, thermostat and digital lock, but the current devices are stuck in the past, so cant do much at the moment.

Great, the esp32 will probably never be discovered. Because when the landlord decides to fix the original problem, the whole unit will probably be replaced.

When I was shopping for an intercom system for my 8 unit building I purposely went for the dumbest system I could find. I wanted it as a foundation and isolated from the rest of the world. I also wanted no cameras.

Here is the installation documentation I have the 4-wire system. I installed it using Cat-5 and standard 548B wiring layout. The rest of the electronic door locks uses the Identiv Liberty key fob system. This was the only system I could find that allowed self-hosting.

I wouldn't mind another layer of integration that would add smartphone access control. The way the 2 systems are currently deployed I could ignore the TekTone side and just integrate the key fobs with the smartphones. I think this might already be possible be possible as the key fob readers already react to the NFC radios on my smartphone.

https://www.tektone.com/pdf_files/manuals/IL826_PK543A_insta...

I ended up using https://eu.switch-bot.com/products/switchbot-bot -- just have a finger robot push the button

Of course it had to mention Claude and Rust haha.

That aside, I enjoyed this read and it's such a niche thing that there is almost no way they'll step on the toes of another resident wanting to do the same thing

Was always wanting to do something like this before they swapped ours out for a SaaS+hardware butterfly mx thing.

Those Doorkings have had to get replaced at so many buildings in Seattle now that criminals figured out how easy they were to override.

I use a Ring Intercom Audio for a similar use. Works surprisingly well, I wish someone would clone the hardware and make an open version so Jeff didn't listen in every time someone rings my doorbell or buzz himself in whenever he wants.

No native apple home - homebridge handles that.

I did similar in my apartment in Amsterdam but a little more low-tech. I soldered the relay on an Esp8266 directly to the unlock button on the intercom PCB in my apartment. Worked flawlessly for years

Fun. I did this recently with mine. There's now a discreet USB cable running down from behind it...

Backdooring common property with questionable technology? Sad.

It's a little sad that, having realised that the simplest route for the hardware was the best, a simple route for communications wasn't explored. I suspect that cramming in a complex stack wasn't the best or quickest solution.

Confessing to felonies, in writing, under one’s real name is wild.

Here’s hoping nobody decides to bother them about this. I’m not a lawyer but this appears to this layperson at the very least a CFAA violation by accessing the router and resetting its root password, as well as possibly criminal mischief as well as whatever stealing AC power is.

You couldn’t pay me to do a writeup like this, and I’d be wearing gloves the whole time.

Related, I'm still upset at the lies told by landlords regarding phone number privacy in buzz-in intercoms. I've been told multiple times at multiple apartment buildings, "don't worry, while the system will call your phone when someone taps your entry code, your phone number won't be revealed". And then you sign the lease, get a delivery from Instacart in your new place, and find that your 'private' number is blasted out loud, heard a whole city block away, in a loud-ass DTMF tone sequence.

BS.

Tldr: he found the wire to the solenoid. Cool stuff. Do the easy thing! The rabbit hole avoidance was impressive. Like an escape room of sorts. Questionable legality notwithstanding.