How Your Security System Could Be Hacked

When it comes to burglary, we often imagine individuals who use brute force or common tools to break into your doors and windows (see how to use a credit card to open a door), take all your valuables, and then attempt to run away before police arrive. Our existing security systems are designed for for those kind of criminals. But with the rise of smart security systems, what if criminals have learned to bypass your system and disable your alarms?

Although FBI has yet to release reports of burglars who actually hacked a security system to break into a house, it is worth knowing that there our technology today is not 100% fail proof. That’s likely because police departments don’t report that type of information or don’t have any evidence to know that’s what happened even if it did. That's why it's so important to layer your security controls with supplemental things like perimeter alarms or driveway alarms and hardening your doors.

This post will review some of the popular home security systems that have been hacked and how the companies responded to the vulnerabilities.

We have summarized a list of breached security systems and how the companies handled the issues:

If you're reading about these security systems and wondering what the other options are, we've got your back!  We put together a comprehensive comparison of security systems at https://24-7-home-security.com/home-security-system-comparison-tool/

IOActive, security consulting firm from Seattle, confirmed that Simplisafe can be hacked by recording wireless transmissions between its system components. The researchers from the firm tested the devices in August 2015 using external microcontrollers and some codes to be able to listen to the wireless transmissions from Simplisafe’s system components. An intruder only needs to set-up the device about 100 feet from your home, and record the code whenever you disarm the system. The data packet is then transmitted to the hacking device. From then on, the hacker can simply resend the data packet to the Simplisafe device to disarm the system anytime.

On the other side, Simplisafe says the hacking method is unlikely to happen as none of their customers ever reported burglary connected to unexplained disarm events. The company also promised to update their hardware to incorporate upgradeable firmware so that customers can be protected from hacking events like this. We could find no confirmation the fix ever happened.

With the rise of connected smart homes, more and more security systems are being exposed, and iSmartAlarm is no exception. It was discovered that a hacker can simply bypass the system’s authentication to turn off the alarm, allowing intruders to break into your home without a trace. The flaw of the system was verified by Ilia Shnaidman in 2017, the Head of Security Research from BullGuard’s Dojo.

The company designed the components such as the sensors, locks and cameras to connect to an app via the internet. A hacker can then exploit the SSL certificate validation, authentication and access control of the system. So if an intruder knows the flaws of the system, he can simply use it to disable your alarms and break into your home anytime.

iSmartAlarm has not addressed the specific issues but promised to improve their firmware to protect the system from hacking incidents. If you are a user of the security system, you are advised check for updates regularly and take off any stickers containing information about your devices.

https://dojo.bullguard.com/dojo-by-bullguard/blog/burglar-hacker-when-a-physical-security-is-compromised-by-iot-vulnerabilities/

Cybersecurity researcher Logan Lamb discovered early 2014 a security flaw from Vivint by using a friend’s 2GIG Go!Control panel. Using a SDR (software-defined radio) device, he was able to bypass the system by suppressing the alarm at will.

Logan exposed that even though we have modern designs for the security systems today, the technology used behind these systems were still from the 90s. The wireless communications failed to encrypt or authenticate signals which allow him to send his own signals to the control panel and do things he wishes.

Sophisticated SDRs can simply interfere with the transmissions, falsely turn your alarm off, or jam your system from 65 to 250 yards away.

With these findings, it means that a tech-savvy burglar can simply disarm your system to get your stuff without a trace or a prankster can control your devices and even watch you while you’re asleep without your knowledge.

Vivint has investigated the case and promised to come up with plans to fix the vulnerabilities. However, they have also mentioned that range and battery performance can be affected if encryption will be implemented in their communication systems. Considering that it is unlikely for burglars to use Logan’s method to break into homes, they’ve decided that using encryption was not worth it.

In case you've changed your mind with Vivint, you can read our post about what happens if you break contract with Vivint.

https://www.forbes.com/sites/kashmirhill/2014/07/23/how-your-security-system-could-be-used-to-spy-on-you/#2c9f77451817

Logan Lamb was also able to play around with an ADT security system using another system. The problem he has discovered was almost same with Vivint - the failure to encrypt sent signals which makes intruders intercept signals, send commands, and manipulate the control panels to turn the alarms on and off. Despite using different hardware designs, the system was basically no different from other wireless systems that can be easily hacked.

Wireless systems depend on radio frequency signals to transmit signals from the sensors to the control panel. A tech-savvy intruder can manipulate this using a SDR so he can turn on or off the alarms whenever he wants to. And what’s even more alarming is that anyone can buy an SDR as cheap as $10 on Amazon.

ADT was dismissive about the findings and claimed that they have never received a report of a hacking incident using this method. Despite this, ADT settled a $16 million class action lawsuit to resolve allegations regarding the company’s failure to disclose the product’s vulnerabilities due to lack of encryptions.

https://www.forbes.com/sites/kashmirhill/2014/07/23/how-your-security-system-could-be-used-to-spy-on-you/#2c9f77451817

https://topclassactions.com/lawsuit-settlements/closed-settlements/826358-adt-home-security-hacking-vulnerability-class-action-settlement/

Swann is an Australian firm that sells security systems to almost all countries, including the US. However, just like the other security systems exposed, it was not exempted from the vulnerability allegations.

Silvio Cesare from Qualys discovered that Swann security systems can be hacked due to unencrypted communication signals. This enables hackers to intercept signals, send commands, and play with the control panels. Moreover, Cesare was able to capture stored passwords using a microcontroller, creating another flaw that an intruder might use to disarm the system.

On top of that, Pen Test Partners researchers Andrew Tierney, Chris Wade and Ken Munro, University of Surrey professor Alan Woodward, Scott Helme BBC hacker, and independent researcher Vangelis Stykas were able to switch video feeds from Swann security cameras. This was easily done since the cameras use its serial number to connect to their cloud service. The API would be able to authenticate you but at the same time allow you to view particular cameras whether you’re authorised or not.

Another discovery was that resetting your camera will not remove the SSID and pre-shared keys of the previous wireless networks the device was connected. If somebody else will get your camera (for example, you’ve decided to sell or give it to someone else) it’s possible that the next user can access details from your network.

Swann was able to fix the serial switching problems. They were also willing to update their firmware to solve the factory reset and PSK issues. Thus, users need to make sure that their firmware and apps are updated regularly to the latest versions. As for the security system, Swann has yet to make a statement regarding the unencrypted communication.

https://www.wired.com/2014/07/hacking-home-alarms/

https://www.helpnetsecurity.com/2018/07/26/swann-security-cameras-spying/

As mentioned, security systems doesn’t fully guarantee 100% protection. Most security systems today are still dependent on radio frequencies for communication which, without proper encryption and obfuscation of commands, can still be accessed by criminals. Unfortunately, most security companies are dismissive of the vulnerabilities since it is unlikely burglars would be smart enough to hack your system. But for researchers, this statement is still debatable and a subject of concern. After all, anyone with an internet connection can learn how to do it in a few minutes.

For your reference, we have listed below some of the security systems that we believe are the least vulnerable to exploitations or, at least, have never been reported for hacking issues (however, if you do have some news or info reporting any hacking issues of these systems, do let us know in the comment section):

• Frontpoint
• Link Interactive
• Protect America
• Nest Secure
• Abode
• AT&T Digital Life
• August Smart Lock Pro

https://www.cso.com.au/article/619748/home-security-system-hacking-everything-need-know/

https://www.cnet.com/topics/smart-home/best-smart-home-devices/best-home-security-devices/