IoT Home Alarm System Can Be Easily Hacked and Spoofed (cybergibbons.com) 123
An anonymous reader writes: In the never-ending series of hackable, improperly protected IoT devices, today we hear about an IoT smart home alarm system that works over IP. Made by RSI Videofied, the W Panel features no encryption, no integrity protection, no sequence numbers for packets, and a predictable authentication system. Security researchers who investigated the devices say, "The RSI Videofied system has a level of security that is worthless. It looks like they tried something and used a common algorithm – AES – but messed it up so badly that they may as well have stuck with plaintext."
I'm not surprised (Score:5, Insightful)
There's no licensing or aptitude testing necessary to operate a security company. Anyone can form a business and call it a security business, and often people that have no technical background will do it because there's a market to be served, even if they should not be the ones serving it.
Re: (Score:3)
Re: (Score:3)
90% of all ADT alarms installed use the zipcode as the installer/backdoor access code.
95% of all alarms installed by companies use the house address as the default code for the customer at install time and NEVER have the code changed.
Alarm systems typically are only used for notification to the homeowner that they need to call the insurance company for a claim.
Re: (Score:2)
Re: (Score:3)
Re: (Score:2)
No licensing required... but how about making them liable? I'm not a big fan of a litigious society of ambulance chasers (or lawyers in general), and I don't think IT or "security" firms should pay damages for every single thing that can possibly go wrong, but in a case of gross negligence like leaving default passwords or having no encryption whatsoever on links, they should be at least held liable for damages suffered.
When one relatively faceless organization works with another relatively faceless organization it requires the victim-company to have someone on staff who cares about the problems with enough seniority and clout to make a big deal of those problems. If that person doesn't exist then nothing will be done about it.
Re: I'm not surprised (Score:1)
This is how they have a product designed for security guaranty a profit to the investors. Hire a chinese factory to mass produce some crap hobbled together in a nice new shiny package with "SECURITY" stickers all over it. Include an 'instruction manual' detailing the tedious process of actually using it, but never once actually hire anyone who knows anything about security, which is of course where all the value is supposed to lie.
Tbh it is not that difficult to build and install a secure system, but you mu
Re: (Score:2)
A fundamental feature of security is that it is opposed to convenience. Adding convenience subtracts from security. Passwords are inconvenient, dongles are inconvenient, PINs for the debit cards are inconvenient, little metal keys to the front door are inconvenient. But if you want to sell to customers then you need to increase convenience. The result is that if customers are not specifically asking for security and verifying the security actually exists, companies aren't going to bother too much about
Re: (Score:2)
It's also a startup mentality. Get an entrepreneur with zero skills, but with an "idea". Then watch as a company is created to turn that idea into a product despite the lack of competence to create such a product. That's because the goal of a company is to make money. Without customer or inevestor demand there is no need for quality.
Re: (Score:2)
I see a market here, for selling tools to burglars to hack these crappy alarm systems.
Re: (Score:2)
Re: (Score:2)
1. Find someone with enough stuff that they feel like they need an alarm system. 2. Find someone stupid enough to buy a hackable alarm system that's part of the IoT. 3. Jackpot!
Maybe it will take an actual exploit and burglary to change things. But apparently, despite all the talk about how easy it is, that has not yet happened. Hackers tend to have an aversion to physically showing up at their targets.
Re: (Score:2)
Maybe people need to form teams like the TV Show "Person Of Interest", one is the hacker/brain, the other is the muscle. One hacks, the other boosts... Profit!
Re: (Score:2)
Do you actually believe that non of these vulnerabilities have been exploited in the wild? Seriously? Because I assure you that there have been plenty of actual exploit and burglaries.
Re: (Score:2)
Do you actually believe that non of these vulnerabilities have been exploited in the wild? Seriously? Because I assure you that there have been plenty of actual exploit and burglaries.
Please provide some examples. I have doubts about your "assurance". Just one resl report would siffice.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Is this really as typical as it seems? (Score:3)
.
Are the developers of such devices really this incompetent?
Are they really so focused on jumping on the IoT revenue bandwagon that they give the actual security of their devices a passing glance, if that?
Some of these security lapses seem to border on criminality...
Re: (Score:2)
Are the developers of such devices really this incompetent?
My guess would be that they were told to implement it in a certain way. They may have had objections but were overruled by managment.
Are they really so focused on jumping on the IoT revenue bandwagon that they give the actual security of their devices a passing glance, if that?
Yes. I find this is the most plausible explanation: "Make it work on the interwebs! By next week!"
Re: (Score:2)
They may have had objections but were overruled by managment.
In my experience, that would be a correct assessment.
Re: (Score:2)
To the consumer, incompetence by managerial decree is impossible to differentiate from incompetence technical design.
The product's security is shit. Why it's shit is irrelevant.
So, sure, blame whoever you want. The key thing is here that as many people as possible should be told the product is so terribly insecure as to defeat its entire purpose.
Unless, of course, actual sec
Re: (Score:2)
The purpose of the system is to keep you from being robbed. Until burglars learn that a sticker like "security by X" is a joke, they'll move on to a house with no sticker. So there's probably still some value for now.
Re: (Score:2)
Just buy the sign. It's probably MORE secure because regular burglars will by-pass because you have a system.....and hackers will spend half a day trying to hack into a non-existent alarm system.....hopefully enough time for someone to come home and notice them so they get scared off.
Re: (Score:2)
"The purpose of the system is to keep you from being robbed."
Wrong. The purpose of he system is to make money.
"Until burglars learn that a sticker like "security by X" is a joke, they'll move on to a house with no sticker. So there's probably still some value for now."
Oh, you meant the purpose... of the customer. Well, a friend of mine did exactly that: he put a sticker of a reputed security company on his door and done with it. Same security level at a lower cost.
Re: (Score:2)
"So, we've got an IoT module, so let's plug it into a home security system and see if we can sell it."
Re: (Score:1)
IoT is new and comes along at a time when the technology it sits on top of is also relatively new.
We do not yet know how to make truly secure systems. Even really smart people have trouble with this because there just aren't enough examples yet of systems "done right".
Re: (Score:2)
Security is new? These security devices fail because they make unacceptable tradeoffs generally from rolling their own implementation. There is a reason for standards. In the move from NO/NC devices these guys are trying to get device lock in. Reality is a pir motion sensor is a few bucks but they realy want to sell one for 50. If they conform to a legit standard like zwave they would have to work with other bits of kit and thus compeat. Zigbee is a cluster because it does not define a high level and
Re: (Score:2)
Zigbee is a mess at the low level too. Industry consortiums can create standards without ever having experts involved.
Re: (Score:2)
For physical security including access and lockout, having *any* wireless sensor is downright stupid, nevermind if it is zwave, zigbee or $FOO-FROM-2025. Wireless listeners can be DOSed very easily, very cheaply and very reliably.
Dumb NO/NC wired listeners are incredibly hard to DOS and require actual breaking and entering to achieve. And when you do, you only manage to kill a single sensor at a time. When you flood the airwaves with junk signal of the correct wavelength, you effectively shutdown the liste
Re: (Score:2)
In general at the home level security is for the discount on your homeowners policy, unless the insurance companies stop giving that for wireless installs not much will change. Reality is the quick smash and grab will be in and out before anybody shows up response times in the 5+ minutes give a lot of leeway.
Hate to break it to you but wired alarms are easily defeated with stock cellphone jammers and some wire cutters, no internet/landline and no cell phone means no way to alert anybody outside a local sir
Re: (Score:2)
...We do not yet know how to make truly secure systems...
While that could be debated from now until doomsday, I'll take a different approach...
.
We do know how to create systems that are very significantly more secure than the insecure garbage that is currently being sold.
The fact that many (most?) IoT companies don't even meet a minimum level of security is bordering on criminality, imo.
Re: (Score:2)
Re: (Score:2)
Just how many banks do you think there are in the world? You seem to think there are few or none. There are many, many truly secure systems. There are also many more hacks who don't understand security, but want to get in on the IoT wave early in the game; competence be damned.
Re: (Score:2)
Re: (Score:2)
Re: (Score:3)
New technology market deployments go in stages, including the following:
1) The underlying technology becomes available and financially viable. The window opens.
2) An explosion of companies introduce competing products and try to capture market share. They are in a race to jump through the window.
3) There is a shakeout: A handful become the dominant producers and the rest die off or move on to other things. The window has closed.
We've seen this over and over. (Two examples from a
Re: (Score:2)
Give it some time and you'll see better security - either from improvements among the early movers or new entrants who took the time to do it right and managed to survive long enough to get to market.
...or there will be some public exploit that makes the news and suddenly makes it a priority over some really cool demo-able feature that has to be added before the next trade show.
Re: (Score:1)
I worked for this sort of small company. Three tech staff, two bosses - one highly "agile" (read: massively over-caffeinated), one indifferent. Bosses negotiate contracts from wherever the hell they can, all manner of areas, so long as they think they can make money. The first you hear about the new product is when they send you an email saying "do this by *insert ridiculously short deadline*" and you have entirely too little time to research, learn, price and implement something you are entirely unfamil
Re: (Score:2)
You confuse "developers" with "management" and "architects". The developers almost never have any control over the product except to implement it as directed from above. If the management never hired security experts then there won't be any security of note. If the architects never considered security then it won't exist. Many of these companies probably just had someone at the board meetings wave their hands saying "yes, yes, our developers will add security, now let's not worry about such details and
Re: (Score:2)
Mooo?
WTF??? (Score:3)
So, the makers of the "W Panel" are lazy, incompetent people who have no business making a security system? Or they're greedy, cheap people who have no business making a security system?
Blah blah blah Insecurity of Things written by people who are either incompetent or indifferent to security, yet another product which is more marketing than substance, and yet another product which sounds like it's utterly useless.
Tell you what, can we assume all IoT shit is broken, defective, and insecure ... and then only have the stories when someone builds one which isn't?
Yet another product created purely by the marketing and sales people, and stunningly incompetently done at the tech level.
They make know something about video. But apparently they don't know a damned thing about security. This is worse than vaporware ... this is a product which is so utterly unfit for the purposes it's being sold for as to be dangerous.
Re: (Score:2)
All of the Sturm und Drang aside, these sorts of devices are probably OK for much of their intended use - getting some pics of the the teenage lowlife that trashes your apartment looking for something to fence. These people are not even going to unplug the phone or power. They're going to grab and run.
No, it won't protect your million dollar stamp collection from the Ukrainian mafia boss who has been salivating about some particular bit of old paper. It's not designed for that. Of course, adding some r
Re: (Score:2)
No, I'll make this explicit: this is a web-cam, pretending it's a security/alarm system.
Buy a nanny cam. Buy a better door lock. Buy a dog.
I very much doubt a typical alarm company is providing you with something which is broken on the level of this thing
Re: (Score:2)
Re: (Score:3)
Re: (Score:2)
I've not been to DEFCON in a while, three years ago actually, is "Spot the Fed" still a thing? One year a few of us made an effort to get 'em all in photos without being noticed and we'd compare and contrast and had special names for 'em. I don't remember the points value we had but we'd made a bit of a drunk-game out of it.
Re: (Score:2)
is "Spot the Fed" still a thing?
I didn't see it there. Attendance has grown so dramatically that I think it would be easy for a fed to blend in now.
If I want IoT I'll make it myself. (Score:4, Funny)
Re: (Score:2)
But since IoT vendors will never sell device that let me run my own software stack, I won't be buying the devices. But hey, you all have fun!
I'm sure they're really going to miss a handful of sales from some nerds. Meanwhile, they'll be raking in money from millions of laypeople who have no idea that ROT13 isn't a secure algorithm. You think a typical roofer or grocery store clerk can tell the difference?
Re: (Score:3)
Also, the HDMI CEC on the Raspberry Pi allows me to control basic features of my A/V system remotely (my TV and receiver are not internet-enabled). Rea
CERT/CC listing (Score:2)
[BUZZWORDOFTHEDAY] security system can be hacked (Score:2)
It's usually* not [BUZZWORDOFTHEDAY]'s fault, it's usually the fault of incompetent, cheap, or lazy people.
The same thing can happen with yesterday's [BUZZWORDOFTHEDAY] and the same thing will probably happen with tomorrow's [BUZZWORDOFTHEDAY]. Sigh.
----
*Sometimes it is the fault of [BUZZWORDOFTHEDAY]. In that case, it might actually be "news for nerds," assuming [BUZZWORDOFTHEDAY] is a tech-related buzzword.
The IoT of now and the future. (Score:4, Insightful)
This just goes to show you that even with a security-centric product like an alarm system, even basic security features cannot seem to be prioritized over cost or first to market.
Expect thousands more shitty products that lack even the most basic security to hit the IoT market before consumers pull their head out of their a...ah, what the hell am I thinking? Consumers have never given a shit about security or privacy.
It's the very reason shitty IoT is thriving.
Re: (Score:2)
You know, looking at their company history [videofied.com], I'd say they're a video-centric product, which some ass in marketing decided to start selling as a security-centric product.
Re: (Score:3)
...before consumers pull their head out of their a...ah, what the hell am I thinking? Consumers have never given a shit about security or privacy.
Exactly. Just look at how popular Facebook is.
Re: (Score:1)
Levels of Security (Score:2, Insightful)
I'm quite tired of the hi-tech this-security-is-hackable discussion. Of course it's hackable. Everything is. That this product doesn't require ethan hunt just makes it worthless for bank vaults.
I highly doubt that this product is being sold as a replacement for secure systems. It's being sold as a supplement to, wait for it, a lock and key.
It's better than the fake camera with the blinky light.
This isn't slashdot-worthy news. There are lesser products out there. That's never news.
Re: (Score:2)
I'm quite tired of the hi-tech this-security-is-hackable discussion. Of course it's hackable. Everything is.
If you think so and can prove it, then you can earn $1000 and eternal fame by hacking DJB's qmail. Over 15 years and still hasn't been hacked.
That this product doesn't require ethan hunt just makes it worthless for bank vaults.
Even then, there are different levels of "hackable." Some things (like uefi) take six months of work to hack, but that's not what we're talking about here. Some of these IoT devices literally are running their own wifi server, with an open telnet port. When I say open, I mean it doesn't even have a password. This is how much these companies care about security.
We'r
Re: (Score:2)
I'm quite tired of the hi-tech this-security-is-hackable discussion. Of course it's hackable. Everything is.
If you think so and can prove it, then you can earn $1000 and eternal fame by hacking DJB's qmail. Over 15 years and still hasn't been hacked.
Actually, it has been hacked, and it's relatively easy to do.
Functional decomposition is a really poor way of abstracting complexity, when it's being used in isolation, and does not include mandatory boundary layer order and direction of operations over said boundary.
I really don't need to spend $1,000 worth of my time to argue with DJB, when he'll happily argue with anyone for free.
Re: (Score:2)
Actually, it has been hacked, and it's relatively easy to do.
[citation needed]
Re: (Score:2)
Actually, it has been hacked, and it's relatively easy to do.
[citation needed]
http://marc.info/?l=qmail&m=14... [marc.info]
Re: (Score:2)
Re: (Score:2)
Functional decomposition is a really poor way of abstracting complexity, when it's being used in isolation, and does not include mandatory boundary layer order and direction of operations over said boundary.
but I'm not entirely sure what you meant. Could you clarify? What other option is there besides functional decomposition?
Re: (Score:2)
btw, I'm pretty sure you have an interesting point here when you said this:
Functional decomposition is a really poor way of abstracting complexity, when it's being used in isolation, and does not include mandatory boundary layer order and direction of operations over said boundary.
but I'm not entirely sure what you meant. Could you clarify? What other option is there besides functional decomposition?
DJB's philosophy is to minimize individual attack surfaces by reducing code complexity. This has three components, of which DJB himself is a proponent of two of them. I'm not sure whether this is because he doesn't realize that it's a consequence of his implementation paradigm, or whether he simply thinks it's too obvious to talk about. These are the components:
(1) Reduce complexity by separating the problem domains into individual processes. This separates necessary privilege escalations from other cod
Re: (Score:2)
I'm not going to write an entire paper here on Slashdot.
You already kind of did lol. This is good stuff though. I have some follow-up questions if you don't mind:
1) How are you aware of (and able to control) lower-level things like the page size, or which functions go into which groups of pages?
2) Why is it called "container-in-a-mailbox?"
3) you wrote, "Most modern (predominantly research) security architectures" who is doing this research, and where can I find it?
As part of this, you define an interface contract: you are permitted to call down to the interfaces below yourself, and you are permitted to call across, within the same layer to auxiliary functions, but under no circumstances are you permitted to call upward.
That would ruin (or improve) a lot of modern OO techniques.
The reason I like DJB's work is
Re: (Score:2)
I'm not going to write an entire paper here on Slashdot.
You already kind of did lol. This is good stuff though. I have some follow-up questions if you don't mind:
1) How are you aware of (and able to control) lower-level things like the page size, or which functions go into which groups of pages?
In a general, hand-wavy fashion, things like page size are an attribute of the compilation environment, and do not vary.
In practice, there are some older MIPS systems and the original NeXTStep which would "gang" 4K pages into 8K pages, and of course there's the Intel variety of superpages, depending on operating mode and contents of CR4, and the PSE bit being set, with or without the PAE bit being set, to give you either 4M or 2M pages. There are also some other architectures that allow even weirder varian
Re: (Score:2)
This wouldn't entirely preclude layering violations, but it would certainly make them more difficult. That would improve security, but whether it improved the techniques?
Here I was referring to the fact that dependency injection and callbacks and closures often make code hard to read. Java code with threads and closures with mutable variables can be inscrutable sometimes....increasing the amount of time it takes to add features (or find bugs) by an order of magnitude or two. (Of course you can use dependency injection and callbacks and still have readable code, but a lot of times that doesn't happen).
3) you wrote, "Most modern (predominantly research) security architectures" who is doing this research, and where can I find it?
Wow. Pretty much everyone in OS software who cares?
IBM and Microsoft are players, OpenBSD is, for some types of things. Apple is; Linux people (though I think it was a DARPA project run by IBM?) were the first to implement ASLR; I think Apple was the first to ASLR absolutely everything? And to do page level executable signature verification in the paging path? Though I think they mostly did it for DRM reasons, rather than to be helpful to users. I think compiler stack probes came from the LLVM folks?
I know about ASLR and page level executable signature verification lol (an
Re: (Score:2)
Re: (Score:2)
(Also, the world would be a better place if Microsoft and other large companies apologized every time they released software with a security flaw)
Re: (Score:2)
Do you really just run one qmail system and that's it? No client end, no other servers, no other services, no passwords, nothing?
The other systems should be made securely. DJB showed it's possible to write highly secure software. But fwiw it's not uncommon to only run one service on a server, especially now with VMs making it so cheap to do so. And passwords are archaic, we don't even use them with git anymore.
Re: (Score:2)
No, it's more like having a window on your house with a big red button on the outside that says "press to open".
Re: (Score:2)
Match the tech to the threat (Score:2)
If you want to protect against them, get a metal door or a large dog (always the best deterrent). If you want a home security system and you think that your attacker will have disabled it
Re: (Score:2)
Use a third party firewall (Score:2)
Because it's third party, you know they can't put any special back doors allowing their company access to your equiptment.
http://techcrunch.com/2015/11/... [techcrunch.com]
Re: (Score:2)
Why is everyone trying to sell me a bridge? (Score:2)
You, Sir, appear to be in dire need of a bridge. And it just happens to be your lucky day. I have a terrific one for sale, for a very reasonable price indeed!
Why is everyone trying to sell me a bridge? The specification clearly calls for a switch...
If you have an IOT alarm.... (Score:3)
Then you are a moron. Relying on the cloud for anything important and time sensitive is 100% foolish and borderline stupid.
It's great for toys like Smartthings and Hue lights. but only a complete moron will rely on their internet and the cloud service for something like an alarm system.
Watershed event (Score:2)
Dumb ideas that are cheap persist. That is, until there's a watershed event that puts all the stupid into sharp relief. We haven't had such an incident for IoT; give it time.
Thanks to movies and TV, people think that encryption is something you "bypass" by letting somebody who looks nerdly typing furiously in front of 3 or 4 screens in an office with lots of glass and neon lights. When it's exploited by thugs who downloaded an exploit and stole their stuff by using their security system to verify that they
Re: (Score:2)
homekit (Score:2)
I'm thinking of investing in devices that connect via Apple's Homekit system. I read that a strength of these is that the protocol puts a good layer of security on all the communications. Any opinions / thoughts on this?
Re: (Score:2)
The IoT of hype .. (Score:2)
What about others like ADT? (Score:2)
Do I assume they have the same weak security problems too?
Always indicative of incompetent management (Score:1)
I have some level of expertise in this field. I've been involved with numerous start-ups and IPO's. I can assure you that this is completely and 100% all due to incompetent management. Without any question or doubt.
EnduranceRobots.com is looking for enthusiasts (Score:1)