How to Hack an ADT Alarm System

http://ipvm.com/report/hack-adt-alarm-system

by rhodesbe • 11 years ago

78 68 11 years ago

Someone12343• 11 years ago

What isn't clear from the article is if the wireless channels were encrypted or not. Right now they're just using brute force to flood the channel which is going to cut off the panel from the sensor(s) regardless.

I cannot see an easy way to mitigate this. Even if it has anti-jam it is going to just shift the frequencies which you could also likely jam. I guess the panel could increase its output power to try and compensate, but all that does is increase the equipment cost of an attacker, not really stop it completely.

So I guess the main take-away from this is to go wired, not wireless for security system installs. However it is unclear if security systems really do much of anything anyway (as police often ignore home alarm calls as they're more often than not false alarms).

You're better off just spending the money on higher fencing with trellis skirting, motion flood lighting, and fake signs that say "protected by FakeCo Security." It won't cost you $30/month for the rest of your natural life and offers the same deterrent.

Most smash & grabs are 10 minute affairs. Some robbers will happily continue to rob with an alarm going off, since they know the response time won't be close to 10 minutes.

useful• 11 years ago

On the first page of the class action, "ADT's wireless signals are unencrypted and unauthenticated, and can easily be intercepted and interfered with by unauthorized third parties"

I think rolling your own ZigBee security system is more safe (and cheaper).

SEJeff5• 11 years ago

I prefer Insteon, which is wireless like Zigbee, but more jam resistant as it also operates over the power lines in your home to form a mesh. Even if the wireless access is blocked, much of the devices can be directly plugged in, and as a result, would still send critical security events to the controller.

michaelt• 11 years ago

Part of the reason wireless alarms use weird RF designs is they try to get a basic 9v battery to last for 3 years or more.

Getting that sort of battery life out of ZigBee would be difficult.

S_A_P• 11 years ago

While I think this sort of research is useful- I dont think this is anything that will affect people in real life. This is more the makings of a plot from the movie "Taken". If someone wants to rob your house, they will break in and probably be in and out before police can respond. A thief isnt going to jam your alarm systems radio and pull some elaborate hack to steal your laptop or flat screen tv.

SEJeff5• 11 years ago

People said the exact same thing about RF car fobs years ago. It is only a matter of time before the technology comes down in price and the software for doing this type of thing becomes more common. Never say never.

Someone12343• 11 years ago

And they were largely right.

Cars are laughably insecure by computing standards, but yet stolen cars are at a low (when you adjust for total cars). They're also targeting pre-digital cars still on the road, if you look at the DMV's "top stolen cars" list, they're almost all 1990s cars or older.

You read a few stories about the "Russian maffia" having key fobs which can unlock modern cars, but these are few and far between. Even the more common ODB-II port key reset method is fairly rare, but gets heavily reported when it does occur.

So I'm going to use the same example, but use that example as evidence that this won't become common: just like cars, and garage door openers.

_nullandnull_• 11 years ago

While I think this sort of research is useful- I dont think this is anything that will affect people in real life.

Minus the part where ADT is having to defend themselves against a class action suit. I'd consider that "real life".

jimkri2• 11 years ago

Well I think there's a lot more places that someone would do something like this. Like a country club that is full of valuables could be a big target, especially if there are a lot of trophies or sports equipment.

fabulist3• 11 years ago

They might be willing to invest the time and money to become proficient at this attack, if they believe they'll be able to use it on several high-value heists -- think jewelry shops or museums, if you knock over a handful of those without causing a fuss you could make many times your investment.

SEJeff5• 11 years ago

So just like with computer security, I'm a fan of both passive and active security for my home.

Their website is straight out of 1990, but Burglargard is a bullet resistant effectively smash-proof invisible coating that can be applied to all windows in your home: http://www.burglargard.com

The nice thing about it is that if you have them install it, it comes with a lifetime no yellow, no peel, full replacement warranty. If you opt to install it yourself, it is much cheaper (Approximately $1 per sq foot), but no warranty, so not as useful.

Also, make sure to get 6" or longer screws to put into external door frames. It ensures the frame is anchored to studs and makes ripping it out via a typical kick the door in attack much more difficult. Stuff like the haven lock (http://www.havenlock.com) also really helps make it more difficult to kick in the door.

Note that these things make a break-in demonstrably more difficult, but they won't prevent it. I see an alarm system as a more passive security device, much like an intrusion detection system. "Hey someone broke in" means someone still broke in. I'm more of a fan of trying to make the act of breaking in in addition to ensuring I have a decent idea if someone does.

Defense in depth doesn't just apply to computers, it is a way of thinking :)

Someone12343• 11 years ago

Burglargard looks pretty cool. But I'd definitely have to re-evaluate fire exits before I installed, the last thing I'd want is for the entire family to burn to death because I was trying to save a few thousand dollars in property which is insured and replaceable.

Door frames and window frames are a common source of intrusion, but if your frames are made out of wood then I don't know if the 6" screws are going to save you, the wood is often a source of failure rather than coming unscrewed. It just splinters away.

As to Havenlock: many back doors are slide, and can be bounced out of their runs. It might help on the few which are swing doors rather than slide (at least around here). I think the whole app thing is kind of dumb, it is just a wedge, and still requires drilling into the floor.

djrogers• 11 years ago

<quote>Burglargard looks pretty cool. But I'd definitely have to re-evaluate fire exits before I installed, the last thing I'd want is for the entire family to burn to death because I was trying to save a few thousand dollars in property which is insured and replaceable.</quote>

If your fire exit strategy currently relies on the ability to break a window, you've already failed at fire safety. You need to be able to OPEN a fire exit in an emergency, not MAKE one...

donutz2• 11 years ago

How well does Burglargard hold up at the edge of the window? Sure, I can imagine it would slow down even a burglar who knows it's there, but a few hits at the edge of the window seems like it would let the burglar peel the glass (held together by the film) away from the frame?

BryanB554• 11 years ago

It is definitely a possibility that your glass will pop out of the frame depending on the type of window and frame. There are a lot of other security window laminates other than burglargard. 3M makes a "safety and security film" that is the same thing and they offer a few different frame reinforcement options. One option commonly used is a silicone caulk that adheres the film to the frame to prevent the glass from being forced out in one piece.

XorNot• 11 years ago

And literally all of this won't help if you leave your house and leave a door unlocked, which is the far more likely scenario - the one time we got robbed, that was exactly what happened.

Had we not left the door unlocked, chances are people wouldn't have tried a daylight robbery.

Reasonable security measures are also an important part of computing.

shanemhansen• 11 years ago

This. Having an accurate threat model is very important. I was robbed once before I had a security system. Someone attempted to rob me after I had a security system, but was scared away. After I installed cameras, nobody ever tried to rob my house.

Frankly my threat model was drug addicts looking for a quick score and/or neighborhood kids up to no good. My security system had many flaws, but my threat model doesn't include a sophisticated attacker with a 1k-4k piece of jamming equipment.

BryanB554• 11 years ago

I do some work in personal protection inside and outside of the home and there are really quite a few simple things you can do to better protect your home from a break in or home invasion.

First, make sure you have a solid wood or metal door with a deadbolt. Second, reinforce all exterior door frames with door jamb armor, a large metal plate that covers your door jamb and 3 1/2 in screws that secure it into the frame. [1]

There's quite a few other window security films on the market. 3M is probably one of the best. [2]

You'll want to look into securing your glass to the window frame so it doesn't just pop the glass out in one piece. Some windows make that easy to happen and some secure the glass in pretty well. 3M has a few attachment systems that hold the glass in the frame. One easy option is a silicone sealant called Dow Corning 995. It's an incredibly strong silicone that bonds the security film to the window frame. [3]

And finally get a gun and learn how to use it. You can tell me how much you hate guns but when a insane machete-wielding man kicks in your front door, a phone in your hand dialing 911 is not going to stop him in time: https://www.youtube.com/watch?v=5bsAMSQ13bY

[1] http://armorconcepts.com/EZ-Armor/

[2] http://solutions.3m.com/wps/portal/3M/en_US/Window_Film/Solu...

[3] http://www.amazon.com/gp/product/B000L00N0Q/ref=oh_aui_searc...

ceejayoz5• 11 years ago

You can tell me how much you hate guns but when a insane machete-wielding man kicks in your front door...

How common of an occurrence is that for you?

vonmoltke2• 11 years ago

Is this article trying to say that jamming can be used to temporarily blank sensors without the controller realizing they have dropped off the system? If so, actually using this for practical nefarious purposes would still be fairly complicated, because you would need to have the system in a pristine state for x seconds every y seconds.

pflats• 11 years ago

For houses with lots of windows and bigger pets, one of the more ubiquitous sensors is the acoustic glass break sensor. You only need to jam that one for a few seconds to get in.

vonmoltke2• 11 years ago

I have two of those; in fact, my house has all "perimeter" sensors and no motion. What you describe only works if the sensor is non-latching. A latching sensor will trigger the alarm as soon as it reconnects. AFAIK, most glass breaks are capable of latching, though most are not set up to do so. Changing the setting is trivial.

Alarm companies have put quite a bit of thought over the decades into anti-tamper measures. I suspect the reason the "hole" described in the article exists is because someone felt the other AT measures would cover it adequately enough for typical usage.

blueskin_4• 11 years ago

It's possible to configure most motion sensors to not detect pets by adjusting the height they scan at and/or their sensitivity (most say they won't detect pets under a certain weight). Not to mention that if there is any evidence of a large dog (cats being too small to trigger any decent motion sensor), a "Beware of Dog" sign is just as much a deterrent to break-ins as an active alarm.

carlmcqueen• 11 years ago

To this article's credit, ADT when counter-advertising people thinking about leaving (source: me everytime they raise their price on my aged featureless system) is that alarms made on a cellular signal instead of a land line can be jammed with 75 dollar cell phone signal jammers.

They stand on the bedrock that their existing systems can't be manipulated like that. While this article makes it clear that this is not a cheap or unsophisticated hack, depending on the value of what you have in your home this kind of hack can very much be worth the price of admission especially when free and explained on the internet.

blueskin_4• 11 years ago

That's why relying on a single link for anything is a bad idea - if a system is known to use a landline, it's trivial, especially as in most parts of the US phone lines are aboveground, to cut the phone line before breaking in.

rachelbythebay• 11 years ago

Important detail: that $15 rtlsdr stick cannot transmit.

JosephRedfern• 11 years ago

However, something like the HackRF can - and while not cheap (~$300), it's still accessible.

quadrature• 11 years ago

Another important detail, If you're just flooding a certain frequency you do not need an SDR to transmit, you can easily build a cheap $5 transmitter for that frequency.

userbinator• 11 years ago

Why does an alarm system, installed presumably permanently on an immovable house, even need to be wireless? A wired system would basically be immune to this (and if the wires are physically cut by an attacker, it will alarm.)

sethhochberg• 11 years ago

Ease of installation, primarily.

pdx• 11 years ago

Inexpensive installation in already constructed homes.

rtkwe• 11 years ago

If the systems used wires installation would become a much longer and more expensive process for existing houses. The installers would have to run wires from all over the house to the central box which in many houses would require cutting into the walls.

StillBored• 11 years ago

While everyone is saying ease of install, and its true, its not really that hard to hardwire a system in most houses. In fact, my previous house was hardwired by a central security group contractor in about 3 hours for nothing more than a 3 year monitoring contract (@~$20 a month, 6 years ago). Sure I didn't get sensors in all my windows, but I did get them in the doors, along with motion sensors that covered 90% of the square footage of the house, monitored smoke detectors, garage door controllers, and a bunch of other crap.

Probably close to $500 worth of DSC hardware.

Alarm monitoring is like printing money. The fact that ADT charges as much as they do, and installs such a craptasic system has always amazed me.

tptacek2• 11 years ago

Is it worth trying to foil this attack? My understanding from talking to alarm installers is that wired alarms, which are more common, are trivially defeated by burglars, and that really the point of having an alarm is simply to avoid being the only person on your block that doesn't have one.

jonathanjaeger2• 11 years ago

To defend alarm systems a bit here, not all burglars are that sophisticated (so it's not trivial). As a teenager I came home from school after a break-in and the novice burglars had scurried off on account of the alarm system and had barely taken a thing.

tptacek2• 11 years ago

Sure, but then the idea is, to deter complete novices, all you need is prominently placed signs and decals.

fabulist3• 11 years ago

I think if the alarm isn't able to communicate (through wired means or otherwise) with its sensors or its back end for a suitable period of time, it should be functionally equivalent to detecting a break in. That is; the alarm should sound, and the alarm company should call the cops (it'd have to be pretty difficult to accidentally lose contact, however.)

The entire point of an alarm is it goes off if something bad happens; not being able to go off is a bad thing.

fabulist3• 11 years ago

I was thinking about this, and I realized there is a bigger problem. The sensors detected a break in, failed to report it, and apparently just forgot about it; it successfully engaged in the protocol designed to detect jamming, but didn't use that window of opportunity to report the break in.

IgorPartola2• 11 years ago

Or, you know, just cut the landline to the house. Phone lines go down often enough that security monitoring centers cannot respond to every incident. If your system stops sending the keep-alive, they assume it's just that the line's been cut. There are of course cell based backups now, but those can be blocked with a pretty standard cellphone jammer too.

Or, just run in and smash the panel. If you do it quickly enough, it won't send the signal.

Or, get a ladder. Most systems do nothing to protect the upstairs of a two story house.

Residential security systems are for show and to get discounts on homeowner's insurance. I'm pretty sure the sign up front deters more people than the actual system.

hga3• 11 years ago

Almost none of these are true for where I currently live, the only thing lacking, which it pretty much has to given the reality of invoking the police on wild goose chases, is action beyond the building when the phone line goes down. But in that case the local alarm most certainly goes off ... but not very often at all! AT&T at least here is near rock solid.

Do you think insurance companies would give discounts unless the benefits were per their actuaries real?

I'm sure the sign does a lot of good, but it's just part of a system of defense in depth which starts there (or perhaps not living in a bad neighborhood).

IgorPartola2• 11 years ago

My theory is that the discount is precisely because of the sign. I am convinced that that part does 99% of the work at actually deterring crime. The local alarm won't do anything once you are in the building: just go and turn it off. In fact, get a shirt with the ADT logo, then go rob a house. Nobody will question it.

blueskin_4• 11 years ago

The first can be countered with a system that uses mobile as a primary or backup.

Some systems, e.g. alarm.com ones send a signal to the monitoring centre when an entry door is opened, then if no disarm signal is sent (e.g. the control panel was destroyed), they treat that as an alarm and dispatch police. It's also possible and done by some companies to hide the main control panel somewhere unobtrusive (and mute its speakers) and just place a remote panel by entry points as well as a remote speaker.

As for upstairs, that's people being foolish. Myself, I would never accept one that didn't protect upstairs entry points just to save a little bit of money. As they say, a fool and his money^H^H^H^H^Hsecurity are soon parted.

How to Hack an ADT Alarm System

Related Stories