16 ms·
How to Hack an ADT Alarm System
- Someone1234 12y agoWhat isn't clear from the article is if the wireless channels were encrypted or not. Right now they're just using brute force to flood the channel which is going to cut off the panel from the sensor(s) regardless. I cannot see an easy way to mitigate this. Even if it has anti-jam it is going to just shift the frequencies which you could also likely jam. I guess the panel could increase its output power to try and compensate, but all that does is increase the equipment cost of an attacker, not really stop it completely. So I guess the main take-away from this is to go wired, not wireless for security system installs. However it is unclear if security systems really do much of anything anyway (as police often ignore home alarm calls as they're more often than not false alarms). You're better off just spending the money on higher fencing with trellis skirting, motion flood lighting, and fake signs that say "protected by FakeCo Security." It won't cost you $30/month for the rest of your natural life and offers the same deterrent. Most smash & grabs are 10 minute affairs. Some robbers will happily continue to rob with an alarm going off, since they know the response time won't be close to 10 minutes.
- useful 12y agoOn the first page of the class action, "ADT's wireless signals are unencrypted and unauthenticated, and can easily be intercepted and interfered with by unauthorized third parties" I think rolling your own ZigBee security system is more safe (and cheaper).
- SEJeff 12y agoI prefer Insteon, which is wireless like Zigbee, but more jam resistant as it also operates over the power lines in your home to form a mesh. Even if the wireless access is blocked, much of the devices can be directly plugged in, and as a result, would still send critical security events to the controller.
- joezydeco 12y agoI've always been curious if powerline protocols like Insteon and X10 were jammable by injecting noise into the neutral leg of the circuit. In most neighborhoods with above-ground power lines, it's incredibly easy to access the neutral wire.
- adanto6840 12y agoOr just cut the power to the home, arguably just as easy no? I think if your being targeted like that then you probably have bigger issues to deal with though...
- donutz 12y agoIs it the case that if the power is out, that such devices can't communicate over the powerlines, even if they have their own backup power?
- SEJeff 12y agoNo, because they send modulated signals over the copper power cables. Therefor, if they had their own backup power and were operating over the powerlines, they would work.
- SEJeff 12y agoIf someone is jamming your power lines AND rf / wireless, you're under a full on assault. You're unlikely to defend against someone invested that much in breaching your home easily. Although a Springfield Armory XD45 makes a wonderful backup :) As does this sign in my rear window: http://img3.etsystatic.com/il_570xN.284053143.jpg http://img3.etsystatic.com/il_570xN.284053143.jpg
- michaelt 12y agoPart of the reason wireless alarms use weird RF designs is they try to get a basic 9v battery to last for 3 years or more. Getting that sort of battery life out of ZigBee would be difficult.
- hga 12y agoOr in the building I'm currently living in, the IR motion sensors are powered by cylindrical lithium batteries of roughly the same volume that have an observed lifetime in service of perhaps a dozen years before needing replacement.
- S_A_P 12y agoWhile I think this sort of research is useful- I dont think this is anything that will affect people in real life. This is more the makings of a plot from the movie "Taken". If someone wants to rob your house, they will break in and probably be in and out before police can respond. A thief isnt going to jam your alarm systems radio and pull some elaborate hack to steal your laptop or flat screen tv.
- SEJeff 12y agoPeople said the exact same thing about RF car fobs years ago. It is only a matter of time before the technology comes down in price and the software for doing this type of thing becomes more common. Never say never.
- Someone1234 12y agoAnd they were largely right. Cars are laughably insecure by computing standards, but yet stolen cars are at a low (when you adjust for total cars). They're also targeting pre-digital cars still on the road, if you look at the DMV's "top stolen cars" list, they're almost all 1990s cars or older. You read a few stories about the "Russian maffia" having key fobs which can unlock modern cars, but these are few and far between. Even the more common ODB-II port key reset method is fairly rare, but gets heavily reported when it does occur. So I'm going to use the same example, but use that example as evidence that this won't become common: just like cars, and garage door openers.
- cones688 12y agoThis is becoming a massive issue in London with the met actively conceding that gangs have the codes for JLR cars such as Range Rovers. http://www.standard.co.uk/news/london/pull-over-all-range-rovers-in-kensington-police-are-told-in-crackdown-on-spate-of-thefts-9979074.html http://www.standard.co.uk/news/london/pull-over-all-range-ro...
- sk5t 12y agoInteresting... a 25% year-over-year spike in thefts is huge and certainly suggests new theft tools are greasing the rails.
- SEJeff 12y agoSo just like with computer security, I'm a fan of both passive and active security for my home. Their website is straight out of 1990, but Burglargard is a bullet resistant effectively smash-proof invisible coating that can be applied to all windows in your home: http://www.burglargard.com http://www.burglargard.com The nice thing about it is that if you have them install it, it comes with a lifetime no yellow, no peel, full replacement warranty. If you opt to install it yourself, it is much cheaper (Approximately $1 per sq foot), but no warranty, so not as useful. Also, make sure to get 6" or longer screws to put into external door frames. It ensures the frame is anchored to studs and makes ripping it out via a typical kick the door in attack much more difficult. Stuff like the haven lock (http://www.havenlock.com http://www.havenlock.com) also really helps make it more difficult to kick in the door. Note that these things make a break-in demonstrably more difficult, but they won't prevent it. I see an alarm system as a more passive security device, much like an intrusion detection system. "Hey someone broke in" means someone still broke in. I'm more of a fan of trying to make the act of breaking in in addition to ensuring I have a decent idea if someone does. Defense in depth doesn't just apply to computers, it is a way of thinking :)
- Someone1234 12y agoBurglargard looks pretty cool. But I'd definitely have to re-evaluate fire exits before I installed, the last thing I'd want is for the entire family to burn to death because I was trying to save a few thousand dollars in property which is insured and replaceable. Door frames and window frames are a common source of intrusion, but if your frames are made out of wood then I don't know if the 6" screws are going to save you, the wood is often a source of failure rather than coming unscrewed. It just splinters away. As to Havenlock: many back doors are slide, and can be bounced out of their runs. It might help on the few which are swing doors rather than slide (at least around here). I think the whole app thing is kind of dumb, it is just a wedge, and still requires drilling into the floor.
- djrogers 12y ago<quote>Burglargard looks pretty cool. But I'd definitely have to re-evaluate fire exits before I installed, the last thing I'd want is for the entire family to burn to death because I was trying to save a few thousand dollars in property which is insured and replaceable.</quote> If your fire exit strategy currently relies on the ability to break a window, you've already failed at fire safety. You need to be able to OPEN a fire exit in an emergency, not MAKE one...
- vonmoltke 12y agoIs this article trying to say that jamming can be used to temporarily blank sensors without the controller realizing they have dropped off the system? If so, actually using this for practical nefarious purposes would still be fairly complicated, because you would need to have the system in a pristine state for x seconds every y seconds.
- pflats 12y agoFor houses with lots of windows and bigger pets, one of the more ubiquitous sensors is the acoustic glass break sensor. You only need to jam that one for a few seconds to get in.
- vonmoltke 12y agoI have two of those; in fact, my house has all "perimeter" sensors and no motion. What you describe only works if the sensor is non-latching. A latching sensor will trigger the alarm as soon as it reconnects. AFAIK, most glass breaks are capable of latching, though most are not set up to do so. Changing the setting is trivial. Alarm companies have put quite a bit of thought over the decades into anti-tamper measures. I suspect the reason the "hole" described in the article exists is because someone felt the other AT measures would cover it adequately enough for typical usage.
- blueskin_ 12y agoIt's possible to configure most motion sensors to not detect pets by adjusting the height they scan at and/or their sensitivity (most say they won't detect pets under a certain weight). Not to mention that if there is any evidence of a large dog (cats being too small to trigger any decent motion sensor), a "Beware of Dog" sign is just as much a deterrent to break-ins as an active alarm.
- carlmcqueen 12y agoTo this article's credit, ADT when counter-advertising people thinking about leaving (source: me everytime they raise their price on my aged featureless system) is that alarms made on a cellular signal instead of a land line can be jammed with 75 dollar cell phone signal jammers. They stand on the bedrock that their existing systems can't be manipulated like that. While this article makes it clear that this is not a cheap or unsophisticated hack, depending on the value of what you have in your home this kind of hack can very much be worth the price of admission especially when free and explained on the internet.
- blueskin_ 12y agoThat's why relying on a single link for anything is a bad idea - if a system is known to use a landline, it's trivial, especially as in most parts of the US phone lines are aboveground, to cut the phone line before breaking in.
- rachelbythebay 12y agoImportant detail: that $15 rtlsdr stick cannot transmit.
- JosephRedfern 12y agoHowever, something like the HackRF can - and while not cheap (~$300), it's still accessible.
- quadrature 12y agoAnother important detail, If you're just flooding a certain frequency you do not need an SDR to transmit, you can easily build a cheap $5 transmitter for that frequency.
- userbinator 12y agoWhy does an alarm system, installed presumably permanently on an immovable house, even need to be wireless? A wired system would basically be immune to this (and if the wires are physically cut by an attacker, it will alarm.)
- sethhochberg 12y agoEase of installation, primarily.
- pdx 12y agoInexpensive installation in already constructed homes.
- rtkwe 12y agoIf the systems used wires installation would become a much longer and more expensive process for existing houses. The installers would have to run wires from all over the house to the central box which in many houses would require cutting into the walls.
- StillBored 12y agoWhile everyone is saying ease of install, and its true, its not really that hard to hardwire a system in most houses. In fact, my previous house was hardwired by a central security group contractor in about 3 hours for nothing more than a 3 year monitoring contract (@~$20 a month, 6 years ago). Sure I didn't get sensors in all my windows, but I did get them in the doors, along with motion sensors that covered 90% of the square footage of the house, monitored smoke detectors, garage door controllers, and a bunch of other crap. Probably close to $500 worth of DSC hardware. Alarm monitoring is like printing money. The fact that ADT charges as much as they do, and installs such a craptasic system has always amazed me.
- tptacek 12y agoIs it worth trying to foil this attack? My understanding from talking to alarm installers is that wired alarms, which are more common, are trivially defeated by burglars, and that really the point of having an alarm is simply to avoid being the only person on your block that doesn't have one.
- jonathanjaeger 12y agoTo defend alarm systems a bit here, not all burglars are that sophisticated (so it's not trivial). As a teenager I came home from school after a break-in and the novice burglars had scurried off on account of the alarm system and had barely taken a thing.
- tptacek 12y agoSure, but then the idea is, to deter complete novices, all you need is prominently placed signs and decals.
- jonathanjaeger 12y agoTrue in part, but that didn't stop these thieves from smashing the window and stealing a little bit of stuff before running away in fear (we had prominent signs). An actual working alarm helps, but I suspect the signs do most of the legwork. Fortunately the thieves got caught and were forced to pay compensation years later.
- fabulist 12y agoI think if the alarm isn't able to communicate (through wired means or otherwise) with its sensors or its back end for a suitable period of time, it should be functionally equivalent to detecting a break in. That is; the alarm should sound, and the alarm company should call the cops (it'd have to be pretty difficult to accidentally lose contact, however.) The entire point of an alarm is it goes off if something bad happens; not being able to go off is a bad thing.
- 12y ago
- IgorPartola 12y agoOr, you know, just cut the landline to the house. Phone lines go down often enough that security monitoring centers cannot respond to every incident. If your system stops sending the keep-alive, they assume it's just that the line's been cut. There are of course cell based backups now, but those can be blocked with a pretty standard cellphone jammer too. Or, just run in and smash the panel. If you do it quickly enough, it won't send the signal. Or, get a ladder. Most systems do nothing to protect the upstairs of a two story house. Residential security systems are for show and to get discounts on homeowner's insurance. I'm pretty sure the sign up front deters more people than the actual system.
- hga 12y agoAlmost none of these are true for where I currently live, the only thing lacking, which it pretty much has to given the reality of invoking the police on wild goose chases, is action beyond the building when the phone line goes down. But in that case the local alarm most certainly goes off ... but not very often at all! AT&T at least here is near rock solid. Do you think insurance companies would give discounts unless the benefits were per their actuaries real? I'm sure the sign does a lot of good, but it's just part of a system of defense in depth which starts there (or perhaps not living in a bad neighborhood).
- IgorPartola 12y agoMy theory is that the discount is precisely because of the sign. I am convinced that that part does 99% of the work at actually deterring crime. The local alarm won't do anything once you are in the building: just go and turn it off. In fact, get a shirt with the ADT logo, then go rob a house. Nobody will question it.
- blueskin_ 12y agoThe first can be countered with a system that uses mobile as a primary or backup. Some systems, e.g. alarm.com ones send a signal to the monitoring centre when an entry door is opened, then if no disarm signal is sent (e.g. the control panel was destroyed), they treat that as an alarm and dispatch police. It's also possible and done by some companies to hide the main control panel somewhere unobtrusive (and mute its speakers) and just place a remote panel by entry points as well as a remote speaker. As for upstairs, that's people being foolish. Myself, I would never accept one that didn't protect upstairs entry points just to save a little bit of money. As they say, a fool and his money^H^H^H^H^Hsecurity are soon parted.