A popular smart home security system can be remotely disarmed, researchers say – TechCrunch

A cybersecurity company says a popular smart home security system has a pair of vulnerabilities that can be exploited to disarm the system altogether.

Rapid7 found the vulnerabilities in the Fortress S03, a home security system that relies on Wi-Fi to connect cameras, motion sensors, and sirens to the internet, allowing owners to remotely monitor their home anywhere with a mobile app. The security system also uses a radio-controlled key fob to let homeowners arm or disarm their house from outside their front door.

But the cybersecurity company said the vulnerabilities include an unauthenticated API and an unencrypted radio signal that can be easily intercepted.

Rapid7 revealed details of the two vulnerabilities on Tuesday after not hearing from Fortress in three months, the standard window of time that security researchers give to companies to fix bugs before details are made public. Rapid7 said its only acknowledgment of its email was when Fortress closed its support ticket a week later without commenting.

Fortress owner Michael Hofeditz opened but did not respond to several emails sent by TechCrunch with an email open tracker. An email from Bottone Riling, a Massachusetts law firm representing Fortress, called the claims “false, purposely misleading and defamatory,” but did not provide specifics that it claims are false, or if Fortress has mitigated the vulnerabilities.

Rapid7 said that Fortress’ unauthenticated API can be remotely queried over the internet without the server checking if the request is legitimate. The researchers said by knowing a homeowner’s email address, the server would return the device’s unique IMEI, which in turn could be used to remotely disarm the system.

The other flaw takes advantage of the unencrypted radio signals sent between the security system and the homeowner’s key fob. That allowed Rapid7 to capture and replay the signals for “arm” and “disarm” because the radio waves weren’t scrambled properly.

Vishwakarma said homeowners could add a plus-tagged email address with a long, unique string of letters and numbers in place of a password as a stand-in for a password. But there was little for homeowners to do for the radio signal bug until Fortress addresses it.

Fortress has not said if it has fixed or plans to fix the vulnerabilities. It’s not clear if Fortress is able to fix the vulnerabilities without replacing the hardware. It’s not known if Fortress builds the device itself or buys the hardware from another manufacturer.

Read more:

Source link

The post A popular smart home security system can be remotely disarmed, researchers say – TechCrunch appeared first on Chop News.



from Chop News https://ift.tt/3DCovv2

Comments

Post a Comment

Popular posts from this blog

Where To Find Undetected Black Ops Cold War Hacks? | RVCJS

Image
Black Ops Cold War hacks are highly popular and there’s absolutely no question about it. If you regularly play the game on PC, there’s no doubt you haven’t encountered at least a few players that have used said Cold War hacks. You’ve probably thought about using them too at least once or twice, but haven’t done so because of a fear of getting banned. Luckily, there’s now a great solution for that which we’ll be discussing more about today. This solution is undetected Cold War hacks.  The Key Points to Keep in Mind Hacks for Cold War are very popular, but it’s very risky to use them.  Once you get banned, there’s no chance of recovering your account, which is why undetected hacks are a necessity.  Not all ‘’undetected’’ are truly undetected. You have to clearly decide which of them you choose.  Battlelog.co is the most trustable cheat provider of all in this department, as they offer truly amazing undetected Black Ops Cold War hacks .    Ho...
Read more

How to Manage Your Spinal Cord Injury in Arizona

Image
How to Manage Your Spinal Cord Injury in Arizona:  Arizona is a prosperous state in the United States, with a population of more than seven million people in 2019. It has a robust economy with an unemployment rate of 5.1% during the year. The state also posted a 2.7% job growth in 2018-2019, mainly driven by its healthcare industry. One of the growing segments in the state’s healthcare sector is medical cannabis. Experts recommend it to treat ailments like chronic pain and spinal cord injuries (SCI). However, you need to have a medical marijuana card in Arizona to buy medical cannabis legally. How to Manage Your Spinal Cord Injury in Arizona When to Seek Medical Help for Your SCI The National Spinal Cord Injury Association claimed an estimated 450,000 Americans are living with SCI. Also, there are around 17,000 new SCI cases in the U.S. every year. If you are an SCI sufferer, you should go to the hospital immediately if you experience one or more of the following symptoms af...
Read more

Jaydev Compares Cutting Beans With Pujara’s Ranji Final Innings, Gets A Hilarious Reply From Him | RVCJS

Image
The Indian cricketers are presently sitting inside their houses as the coronavirus outbreak has compelled each one of us to remain indoors to save ourselves from getting infected. While some players are getting active on social media networks and interacting with their fans or colleagues, several others are letting their fans know how they are spending time in the 21 days lockdown period. Indian cricketer Jaydev Unadkat under whose captaincy the Saurashtra team won the Ranji Trophy recently took to the micro-blogging site Twitter and posted a photo in which he showed the vegetables that he chopped. He also wrote heartwarming message for his mother as she has done such things infinite times but never showed off. Jaydev Unadkat’s tweet read, “By, Yours truly.. To, The Mother.. (who does it infinite times without any such show-off & appreciation)  #QuarantineLife” By, Yours truly.. To, The Mother.. (who does it infinite times without any such show-off & appreciation) #Q...
Read more