Update on Simplisafe….

A couple of years ago I wrote this piece warning about snake oil in sales pitches.  I wasn’t able to get my hands on the hardware to do my test but I knew there were most likely going to be serious flaws. I had stated I was more than willing to do an analysis for free if sent a sample product. Honestly I kind of wish I had bought one, because this shit is gold:

It appears SimpliSafe’s systems send messages unencrypted in the clear over the air. That means it’s trivial to send spoofed sensor readings – such as back-door closed – to fool alarm control boxes into thinking no break-in is happening, and replay PIN codes from keypads to activate or deactivate security systems.

blink This shit’s a joke right? An honest to god joke. This is so blatantly bad it is obvious someone made a proof of concept and then shipped it as a product.

The only thing that is worse is their canned response to the problem:

Thanks for writing in.
Please read this information below there hasn’t been any cases or situations.

As our systems use wireless technology, there is an understandable concern over the potential to hack or jam our signal. Much of it comes from a certain video online that fails to depict the equipment used or the number of attempts made to compromise that signal. While any wireless system is susceptible to this type of attack from a sufficiently savvy and motivated intruder, our systems can be backed up with with a land line or an internet connection for no additional cost. Also, this type of attack represents such a small percentage of total break-ins that the FBI does not even keep a count. This is because the majority of break-ins are a quick forced entry and not the sophisticated type of attack that requires diligent planning as well as highly illegal and cost-prohibitive equipment. Assuming an intruder has the requisite technology, he would need to know the frequency ranges he needs to jam, and also know the layout of your home beforehand, as he would have to avoid motion detectors even in the unlikely event that he bypassed a door sensor. Furthermore, our systems use a proprietary algorithm that helps the system distinguish between everyday interference from nearby household electronics, and unusual, possibly targeted interference.

Best,
Mikaela
——————-
SimpliSafe, Inc.
[email protected]
1-888-95-SIMPLI (1-888-957-4675)

Good freaking god, that’s as bad as the incident I had with Dreamhost.

If you have Simplisafe, ditch it. You’re keys are being broadcast to the world.

 

Barron is the owner, editor, and principal author at The Minuteman, a competitive shooter, and staff member for Boomershoot. Even in his free time he’s merging his love and knowledge of computers and technology with his love of firearms.

He has a BS in electrical engineering from Washington State University. Immediately after college he went into work on embedded software and hardware for use in critical infrastructure. This included cryptographic communications equipment as well as command and control devices that were using that communications equipment. Since then he’s worked on just about everything ranging from toys, phones, other critical infrastructure, and even desktop applications. Doing everything from hardware system design, to software architecture, to actually writing software that makes your athletic band do its thing.

Quote of the Day – Tim Cook (2/17/2016)

While we believe the FBI’s intentions are good, it would be wrong for the government to force us to build a backdoor into our products. And ultimately, we fear that this demand would undermine the very freedoms and liberty our government is meant to protect.

Tim Cook – A Message to Our Customers

February 16, 2016


[First, go read the whole thing; all of it. There are different things that can be used for quotes, but that final line says it all.

If you’re having trouble understanding why they wouldn’t help the government there’s a couple different things going on here. If you read their security document for iOS there is little that can actually be done. While no one on this side of the fence is supporting the actions of those asshats that shot up a Christmas party the most common argument I’ve seen has been appeal to emotion to catch those that supported them.

Yes, I want to catch them. Then break into their phone!!! Apple is aiding and abetting by not helping. No they’re not because there’s a lot more at stake than just one phone despite the claims by the government. Anything they build can be used against any other iPhone. Not only that, if it falls into the wrong hands it can be used for criminal enterprise.

Tim used the following line as well:

Criminals and bad actors will still encrypt, using tools that are readily available to them.

This is most definitely true. As pointed out to me by Ashley, if you replace the words and shift the subject this reads like letter from the President of the NRA.

I came to the following realization which cements just how important and how right this stance is. What the FBI wants fails the Jews in the Attic test. To think that this will only be used in this one case is naïve and without forethought.  There is no way you will keep a genie like this in the bottle. At some point it’s going to get out and it’s not going be pretty.

Say what you will about Apple, but at least they have the balls to stand up and not just play dead due to an “Appeal to Emotion.” -B ]

 

Barron is the owner, editor, and principal author at The Minuteman, a competitive shooter, and staff member for Boomershoot. Even in his free time he’s merging his love and knowledge of computers and technology with his love of firearms.

He has a BS in electrical engineering from Washington State University. Immediately after college he went into work on embedded software and hardware for use in critical infrastructure. This included cryptographic communications equipment as well as command and control devices that were using that communications equipment. Since then he’s worked on just about everything ranging from toys, phones, other critical infrastructure, and even desktop applications. Doing everything from hardware system design, to software architecture, to actually writing software that makes your athletic band do its thing.

I’d say I told you so…

But what’s the point? The people who realize that using Javascript for everything is a bad idea don’t need me lecturing them. The people who want to use Javascript for everything couldn’t create a secure system, much less understand the realities of a hostile environment if their life depended on it. Their fandom precedes the ability for critical thinking.

This is why when I read this, this morning;

This impacts Node at the Buffer to UTF8 String conversion and can cause a process to crash. The security concern comes from the fact that a lot of data from outside of an application is delivered to Node via this mechanism which means that users can potentially deliver specially crafted input data that can cause an application to crash when it goes through this path.

I said, “And nothing will change.” At least, as a minor saving grace, HTTP(S) headers do not fall vulnerable to this particular bug, but that’s mainly the headers there is question to the remainder of the processing.

The fact is, nothing is perfect, nothing is fool-proof, and frankly my hate for Javascript is largely due to the people I find who fall over themselves defending it. Does it serve a purpose? Yup, you bet. Is is a hammer that should be used while seeing every problem as a nail? Absolutely NOT.

 

Barron is the owner, editor, and principal author at The Minuteman, a competitive shooter, and staff member for Boomershoot. Even in his free time he’s merging his love and knowledge of computers and technology with his love of firearms.

He has a BS in electrical engineering from Washington State University. Immediately after college he went into work on embedded software and hardware for use in critical infrastructure. This included cryptographic communications equipment as well as command and control devices that were using that communications equipment. Since then he’s worked on just about everything ranging from toys, phones, other critical infrastructure, and even desktop applications. Doing everything from hardware system design, to software architecture, to actually writing software that makes your athletic band do its thing.