Security alarm system feeling of security or cause for alarm? - - PowerPoint PPT Presentation

▶
security alarm system feeling of security or cause for
SMART_READER_LITE
LIVE PREVIEW

Security alarm system feeling of security or cause for alarm? - - PowerPoint PPT Presentation

Aug 28, 2022 205 likes •651 views

Security alarm system feeling of security or cause for alarm? Kirils Solovjovs https://kirils.org/ Au Author or Author Lead researcher at Possible Security, Latvia Hacking and breaking things Network fmow analysis

slide-1
SLIDE 1

Security alarm system — feeling of security or cause for alarm?

Kirils Solovjovs https://kirils.org/

slide-2
SLIDE 2

Author Au Author

  • r
  • Lead researcher at Possible Security,

Latvia

  • Hacking and breaking things

– Network fmow analysis – Reverse engineering – Social engineering – Legal dimension

  • Follow me on twitter / @KirilsSolovjovs
slide-3
SLIDE 3

What’s new? What’s n s new?

  • Alarm systems
  • Paradox intro
  • Radio specs for remote ✅
  • Attack tool development ✅

– M5Stack ✅

  • First steps in frmware reverse engineering ✅

Skip to page 14 if you’ve seen previous presentations

slide-4
SLIDE 4

Security alarm systems Sec ecurit rity alarm alarm s system ems

slide-5
SLIDE 5

Security alarm systems Sec ecurit rity alarm alarm s system ems

slide-6
SLIDE 6

3998 3111 9309 1400 8248 4584 9450 5617 6550 8245 6979 9878 6101 4971 1294 9576 5005 2789 3013 3627 6856 5132 4920 5076 7500 7065 0643 9302 1744 3725 8432 1275 1128 1497 8657 9264 3013

What could go wrong? What cou

  • uld go
  • wr

wron

  • ng?
slide-7
SLIDE 7

Does this provide a feeling of security? Does Does this is provid ide a e a fee eelin ing of

  • f sec

ecurit rity? y?

slide-8
SLIDE 8

INTRO

slide-9
SLIDE 9

Paradox security systems Parad adox se x securit rity y system ems

  • Canadian company, founded 1989
  • Modular security alarms

– SPECTRA SP

  • Expandable Security Systems

– EVO

  • High-Security & Access Systems

– MAGELLAN

  • Wireless Security Systems
slide-10
SLIDE 10

Main components Main Main com

  • mponents
  • master

heart on the system – “motherboard”

– panel

  • ancillaries

– battery – power supply – siren

slide-11
SLIDE 11

Main components Main Main com

  • mponents
  • combus slaves

provide two-way communication

– keypads – modules

  • expansion
  • printer
  • listen-in
  • etc.
slide-12
SLIDE 12

Main components Main Main com

  • mponents
  • zone interrupt devices

input, measures resistance chaining ⇒

– magnetic sensors – PIR sensors – panic buttons – etc.

slide-13
SLIDE 13

16.5 V ⏦ 12 V ⎓ battery COMBUS RTC 3V battery RS485 memkey voice dialer

EVO192 EV EVO192 192

slide-14
SLIDE 14

RADIO

slide-15
SLIDE 15

Remote REM2 Remot

  • te REM2

REM2

  • Two-way comms!
slide-16
SLIDE 16

Opening it up Open enin ing i it up

TDA5255 433-435MHz PIC16LF548A

slide-17
SLIDE 17

There it is There i e it is is

slide-18
SLIDE 18

We gotua go closer We g e gotu

  • tua g

a go c

  • clos
  • ser

er

  • ~ 433.9MHz, Tx and Rx share the same channel

– same packet sent in short bursts (8 times) – 1 reply from panel

slide-19
SLIDE 19
slide-20
SLIDE 20

… … … closelier clos losel elier ier

  • 1-level ASK
  • bit length = 200µs
slide-21
SLIDE 21

Structure Stru ructure

  • init = 1111
  • synchronization preamble = 010101010101010101010101
  • packet length – init (4b) + preamble (24b) + data (112b)
  • to be continued elsewhere :-)
slide-22
SLIDE 22

ATTACK TOOL

slide-23
SLIDE 23

M5Stack M5S M5Stac ack

slide-24
SLIDE 24

M5Stack M5S M5Stac ack

slide-25
SLIDE 25

COMBUS COMB MBUS

slide-26
SLIDE 26

Electrical layer El Electrical al la layer er

  • combus – 4 wire bus

– black = GROUND – red = POWER – yellow = CLOCK – green = DATA (keypad)

slide-27
SLIDE 27

Signal layer Sign ignal al layer er

  • 40ms between packet bursts
  • 1 clock cycle = 1ms; signal = 1kHz
slide-28
SLIDE 28

Full signal encoding Full ll sign signal en encod

  • din

ing

  • CLOCK = high

– slave pulls down to send “1”

  • CLOCK = low

– master pulls up to send “1”

  • ----M-M-M-M-M-M-M-MsMsMsMsMsMsMsMsMsMsMsMsMsMsMsMsMsMsMsMsMsMsMsMsM---
slide-29
SLIDE 29

300 Ω 4.6 kΩ (still needs finetuning)

Hardware setup Hardwar are setup

slide-30
SLIDE 30

01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16 17 18 19 20 21 22 23 master E2 14 10 0B 0F 37 05 00 01 5D 00 0C 13 38 1B slave 00 02 00 00 00 02 20 00 00 00 FF 5A 22 00 00 00 00 D5 23 79 E2 00 00 00 C8 B6 00 command checksum unused channel-request

Packet structure Pac acket structure

slide-31
SLIDE 31

Checksum Ch Checksum

checksum <- 0 for i in @command to @checksum - 1: checksum <- (checksum + *i) % 100

slide-32
SLIDE 32

Payloads Payload yloads

  • No encryption used
  • Text as fxed length (often 16 chars) ASCII strings

– 0x20 = fller

  • Numbers usually packed BCD

– “0” is 0b1010 = 0xA – no encryption, but hey, at least we got obfuscation!

slide-33
SLIDE 33

DEMO ONE

slide-34
SLIDE 34

Spoofjng data / keypad emulatjon Spoofj

  • ofjng

g data a / keyp ypad ad em emula latjon tjon

  • But why?

– Slowly bruteforcing stuf – Protocol fuzzing – Replay attacks – Open source keypads?

  • OK. Can we?

– Sure we can!

slide-35
SLIDE 35

DEMO TWO

slide-36
SLIDE 36

FIRMWARE INTRO

(Look for a conference near you!)

slide-37
SLIDE 37

CHIPS CH CHIP IPS

STM M41T56, RTC, 56B NVRAM STM 24512WP, EERPOM, 64KiB, page=128b STM 4256BWP, EERPOM, 32KiB, page=64b RENESAS R5F36506, MCU, ROM 128KiB+16KiB, flash 4KiB, RAM 12KiB

slide-38
SLIDE 38

Now what? Now w what?

+

+ coding missing support

slide-39
SLIDE 39

SUMMARY

slide-40
SLIDE 40

EVO192 EV EVO192 192

“Digiplex and Digiplex EVO systems provide the highest level of protection for banks, high-security military and government sites, luxurious residential homes and any place where maximum security is essential.”

– https://www.paradox.com/Products/default.asp?CATID=7

slide-41
SLIDE 41

Results Res esults

  • Attack tool based on M5Stack created

– active keypad emulation support

  • (Some) RF attacks tested
  • Firmware reverse engineering unlikely, however EEPROM

can be read

slide-42
SLIDE 42

Further research Further er rese sear arch

  • Make attack tool even more modular & more functional

– Find the right resistors!

  • Continue testing RF attacks
  • Pull confguration (including codes) from EEPROM
  • COMBUS over radio (MG?)
slide-43
SLIDE 43
  • Links. Q&A?

Lin

  • Links. Q&

Q&A?

Slides on https://kirils.org/ Tools on https://github.com/0ki/paradox I’m on https://twitter.com/KirilsSolovjovs