SimpliSafe Alarm System Replay Attack
blog.ioactive.com
blog.ioactive.com
In his blog post, Andrew said he didn't bother to reverse-engineer the protocol because if you can replay a "disarm" command with the correct PIN, that's everything you need. That's probably true, but it could also profit an attacker to record someone's PIN in case they use it for other things. And depending on the limits of the Simplisafe base station, you could potentially brute-force a "disarm" from every possible device ID - most likely, you'll eventually use the ID of a keyfob associated with the system, so it will disarm. Then you'd have control without the user ever entering their PIN.
These things are largely academic, I think. It's been known for a while that you can just jam the system by transmitting at 433MHz while you kick down the doors or whatever. Very cool anyway.
On the other hand, now I can build my own sensors and add them to my system, if I want. Or build a repeater so I can finally have a keypad in my garage. :)
I think there are a lot of people interested in learning more about the process of attacking RF systems from an SDR.
What SDR did you use?
Did you reverse the hardware or the software on the endpoints to figure out how to configure the SDR?
How did you get started with this?
What other tooling did you have?
Like Andrew, I looked up the FCC ID to find the right frequency for Simplisafe. I used a RTL2832 USB device ($25, from Amazon) and SDRSharp on Windows to record the signals. I used Audacity to look at the raw recordings and figure out that it was on-off keying, with a pulse length of about 5 microseconds.
I fed those raw recordings into a Gnuradio program I built (on Kali - I had trouble setting it up on Ubuntu so I gave up and just used a Kali image). I realize now that Gnuradio can interface directly with an SDR, but at the time, I already had all the recordings saved, so I just worked with those. I wanted to use Gnuradio's fancy clock sync module to convert the pulses directly to symbols, but I couldn't get it to work. So I used a threshold detector instead, with a rate limiter, so the output consisted of strings about 120 1s or 0s per pulse. I wrote a Python script to convert those into a text representation with just a single 1 or 0 for each pulse.
It was easy enough to identify a preamble that comes with each transmission, and then most of my effort went into comparing like transmissions from different devices (e.g. "door open" from my three door sensors), or different messages from the same device (e.g. "door open" vs. "door closed" from the same sensor). If their encoding scheme is a standard or well-known one, I certainly wasn't able to find it. It took a lot of frustrating dead-ends to finally figure it out.
With that done, I wrote more Python code to decode a recorded transmission, or put together a transmission representing any device ID I want, any message I want, etc. I used an Arduino and a cheap 433MHz transmitter/receiver device ($5 from Amazon) to send my transmission, and my base station heard and acknowledged it. I haven't done much more with it since then.
It does illustrate (duh) that by not encrypting their wireless coms, their system is vulnerable to straightforward reverse-engineering of the RF protocol.
It also illustrates that this vector isn't much of a threat for your average burglar.
However, between the two threats, it wouldn't take a genius entrepre-thief to make a simple device and sell it to thieves (like the ones that exist for some cars).
A million customers someone said?
So one way you can help their security is
1) Don't publicize easy to follow step-by-step ways of how to do this. There's a big difference between disclosing a security issue and giving non-technical people an easy way to bypass a security system. The fact that a security weakness is known and publicized doesn't help xx% of thieves who don't have the resources to implement it. It does help the aware customer to make changes to their security and demand a fix from the vendor.
2) Responsibly disclose to Simplisafe like the linked post did is best. If they don't respond, then post what you were able to do in a similar manner. Going through ioactive would be a great idea as they're familiar with this process.
To give a comparison, consider all the NSA spying leaks and then consider that show host (John Oliver I believe) who went around asking people questions in a way that made them much more informed of what the implications of spying was, and in doing so changed their reaction.
Alternative is using github pages with something like jekyll.
There's no such thing as perfect security via alarm. However, if a company refuses to even respond to someone reporting a vulnerability, then the public should be informed.
As a simplisafe customer, I will be contacting them and demanding a fix to this vulnerability or full refund.
I actually never seen this happen.
I think the basic problem most alarm systems have is that wireless systems are generally vulnerable, and wired systems are an order of magnitude more difficult/expensive to install. I don't think there is a straightforward solution to this problem.
The Simplisafe vulnerability is still considerably difficult for an average burglar to use. I would be fairly surprised that any burglar would use it, as there are so many more attack vectors that could be exploited.
* Wireless system
* Active heartbeats saying "no alarm", with proper crypto (eg. signed message which contains a monotonic sequence number)
* If the sensor detects a problem, it sends an alarm message
* If the sensor is jammed and "no alarm" heartbeats can't get through, it's treated as an alarm.
The only unavoidable problem I can see would be that someone with a jammer could always jam your signal to generate alarms on demand.
The DOS with a jammer seems like less of an issue. Sure it's a fun prank, but police seem to respond aggressively to that sort of prank.
2) Can I get the crypto keys you're relying on by buying the hardware myself and dumping the firmware? What about by ripping an exterior sensor off the wall? What about by social engineering you into giving me an invoice with the serial number on it?
3) What happens if I power-cycle your building? Do the sequence numbers start over?
4) How are you going to communicate the alarm condition to anyone who can help? If I cut your phone/internet lines? If I bring a cell phone jammer?
Not an expert either, but I remember a fascinating chapter of a security engineering textbook from HN years ago talking about what goes into the design of robust alarm systems. The process is largely driven by the high-end valuables insurance industry, which has standards/certifications for the alarms you must buy to enjoy their protection. I'll see if I can dig it up.
Wireless isn't inherently impossible to secure, but it must be done very carefully.
[1] http://www.betaboston.com/news/2014/05/21/simplisafe-raises-...
"Thanks for writing in. As our systems use wireless technology, there is an understandable concern over the potential to hack or jam our signal.
Much of it comes from a certain video online that fails to depict the equipment used or the number of attempts made to compromise that signal. While any wireless system is susceptible to this type of attack from a sufficiently savvy and motivated intruder, our systems can be backed up with with a land line or an internet connection for no additional cost.
Also, this type of attack represents such a small percentage of total break-ins that the FBI does not even keep a count. This is because the majority of break-ins are a quick forced entry and not the sophisticated type of attack that requires diligent planning as well as highly illegal and cost-prohibitive equipment.
Assuming an intruder has the requisite technology, he would need to know the frequency ranges he needs to jam, and also know the layout of your home beforehand, as he would have to avoid motion detectors even in the unlikely event that he bypassed a door sensor.
Furthermore, our systems use a proprietary algorithm that helps the system distinguish between everyday interference from nearby household electronics, and unusual, possibly targeted interference. Our interactive monitoring plan for $24.99/month can be set up to notify you if your system detects abnormal RF interference.
Ultimately, no system is impenetrable, and it would be unfair for us or any company to tell you otherwise, but SimpliSafe has measures in place to protect you against this type of intrusion, and with the likelihood of cellular jamming being as slim as it is, the odds are more than in your favor."
Note they are trying to sell me on their most expensive plan and that they never mentioned the attack that is referenced in the article (which I linked to)."
Time to look into a new company.
Now I read this.
Ta-da! A custom alarm system that doesnt suck.
You now have 99% of the security offered by an alarm system, go buy an ADT yard sign from Amazon and you have 99.9%
The utility of calling cops is vastly over-rated in most parts of the United States due to police response times being slow.
No, I had never had any false alarms prior to this one. I live in a moderately sized suburb, not Detroit.
But consumer electronics are generally insecure: garage doors, baby monitors, electronic door locks, even cars historically.
They all ultimately rely on security through obscurity because convenience sells. Nobody wants their garage to lock them out because the clocks got misaligned, or firmware update the clicker because the encryption protocol from the 1990s is trivially broken.
Frequency hopping would be more common, but many consumer electronics only utilise two frequencies because that is all that is allocated. So that is out. And while they could use fixed key encryption (e.g. serial number), it doesn't defend against a replay attack (and if defence is added, like a counter, it can break the system in a number of fun ways (e.g. batteries running out, signals being lost, cross-device interference, etc)).
Just, whatever you do, do NOT let some crazy internet-connected service, like XFinity Home hook up to it. All of your reliability goes out the window the second they hook up their stupid takeover devices.
A dog.
I guess anybody wanting to sell wireless IOT stuff better be advertising how their device pairing is robust or be getting heaps of criticism.
(I think it must be possible to robustly pair devices, I would be interested in discussion of why it wouldn't be possible, and in discussion of user friendly ways to do it)