3 ms·

I'm very interested in this space. Had a "break-in" at my storage/office warehouse recently, and my camera-based alarm system failed me. It really wouldn't hav

by creeble 11y ago

I'm very interested in this space. Had a "break-in" at my storage/office warehouse recently, and my camera-based alarm system failed me. It really wouldn't have mattered because it was a smash-and-grab that was over before the cops could have responded anyway. I think the basic problem most alarm systems have is that wireless systems are generally vulnerable, and wired systems are an order of magnitude more difficult/expensive to install. I don't think there is a straightforward solution to this problem. The Simplisafe vulnerability is still considerably difficult for an average burglar to use. I would be fairly surprised that any burglar would use it, as there are so many more attack vectors that could be exploited.

ekimekim 11y ago
Forgive my naivety (and I'm fully aware of IT people's tendency to declare all other fields "easy" and "why don't you just"), but why wouldn't the following work? * Wireless system * Active heartbeats saying "no alarm", with proper crypto (eg. signed message which contains a monotonic sequence number) * If the sensor detects a problem, it sends an alarm message * If the sensor is jammed and "no alarm" heartbeats can't get through, it's treated as an alarm. The only unavoidable problem I can see would be that someone with a jammer could always jam your signal to generate alarms on demand.
- jessaustin 11y ago
  I think we need more detail here concerning how sensors would get provisioned and (especially) de-provisioned. Also aren't many sensors on battery power? If so, battery failure mustn't trip the system-wide alarm. The DOS with a jammer seems like less of an issue. Sure it's a fun prank, but police seem to respond aggressively to that sort of prank.
- superuser2 11y ago
  1) An attacker (/ RF noise) can induce false alarms frequently enough that you no longer take the alarm seriously. 2) Can I get the crypto keys you're relying on by buying the hardware myself and dumping the firmware? What about by ripping an exterior sensor off the wall? What about by social engineering you into giving me an invoice with the serial number on it? 3) What happens if I power-cycle your building? Do the sequence numbers start over? 4) How are you going to communicate the alarm condition to anyone who can help? If I cut your phone/internet lines? If I bring a cell phone jammer? Not an expert either, but I remember a fascinating chapter of a security engineering textbook from HN years ago talking about what goes into the design of robust alarm systems. The process is largely driven by the high-end valuables insurance industry, which has standards/certifications for the alarms you must buy to enjoy their protection. I'll see if I can dig it up. Wireless isn't inherently impossible to secure, but it must be done very carefully.
vvanders 11y ago
Part of the problem is that Renter's/Homeowner's insurance won't pay out if there's no signs of a "forced entry". Cases like above would mean that insurance wouldn't cover anything lost.

by creeble 11y ago

ekimekim 11y ago

Forgive my naivety (and I'm fully aware of IT people's tendency to declare all other fields "easy" and "why don't you just"), but why wouldn't the following work? * Wireless system * Active heartbeats saying "no alarm", with proper crypto (eg. signed message which contains a monotonic sequence number) * If the sensor detects a problem, it sends an alarm message * If the sensor is jammed and "no alarm" heartbeats can't get through, it's treated as an alarm. The only unavoidable problem I can see would be that someone with a jammer could always jam your signal to generate alarms on demand.

jessaustin 11y ago
I think we need more detail here concerning how sensors would get provisioned and (especially) de-provisioned. Also aren't many sensors on battery power? If so, battery failure mustn't trip the system-wide alarm. The DOS with a jammer seems like less of an issue. Sure it's a fun prank, but police seem to respond aggressively to that sort of prank.
superuser2 11y ago
1) An attacker (/ RF noise) can induce false alarms frequently enough that you no longer take the alarm seriously. 2) Can I get the crypto keys you're relying on by buying the hardware myself and dumping the firmware? What about by ripping an exterior sensor off the wall? What about by social engineering you into giving me an invoice with the serial number on it? 3) What happens if I power-cycle your building? Do the sequence numbers start over? 4) How are you going to communicate the alarm condition to anyone who can help? If I cut your phone/internet lines? If I bring a cell phone jammer? Not an expert either, but I remember a fascinating chapter of a security engineering textbook from HN years ago talking about what goes into the design of robust alarm systems. The process is largely driven by the high-end valuables insurance industry, which has standards/certifications for the alarms you must buy to enjoy their protection. I'll see if I can dig it up. Wireless isn't inherently impossible to secure, but it must be done very carefully.

vvanders 11y ago

Part of the problem is that Renter's/Homeowner's insurance won't pay out if there's no signs of a "forced entry". Cases like above would mean that insurance wouldn't cover anything lost.