M2B GSM Wireless Alarm System Brute Force Issue
Posted on 30 November -0001
<HTML><HEAD><TITLE>M2B GSM Wireless Alarm System Brute Force Issue</TITLE><META http-equiv="Content-Type" content="text/html; charset=utf-8"></HEAD><BODY>Advisory ID: SYSS-2016-064 Product: M2B GSM Wireless Alarm System Manufacturer: Multi Kon Trade Affected Version(s): Unspecified Tested Version(s): Unspecified Vulnerability Type: Improper Restriction of Excessive Authentication Attempts (CWE-307) Risk Level: High Solution Status: Open Manufacturer Notification: 2016-07-05 Solution Date: - Public Disclosure: 2016-11-23 CVE Reference: Not yet assigned Author of Advisory: Gerhard Klostermeier, SySS GmbH ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Overview: The M2B GSM wireless alarm system by Multi Kon Trade (MKT) was tested for possible security issues. Some features of this alam system as described by the manufacturer are (see [1]): * You will be noticed of any alarm by call or by SMS message. * The alarm system has a battery which will last 6 to 8 hours in case of a blackout. * You can pair up to 99 devices (sensors, remote control, etc.). * You do not have to run any cables. Everything is wireless. * It is possible to trigger alarms in case of fire, even if the alarm is disabled. * It is possible to trigger the alarm with a delay. Due to an insecure implementation of the used 433 MHz radio communication, the wireless alarm system M2B GSM is vulnerable to brute-force attacks. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Vulnerability Details: SySS GmbH found out that the 433 MHz radio communication of the wireless alarm system M2B GSM has no protection against brute-force attacks. A valid (paired) remote control is identified through its eight characters long identifier. A character is either "0", "1" or "f" (floating) (see [2]). Thus, it is possible to send any command signal for all possible identifiers. Via such a brute-force attack, for instance, it is possible to disarm an armed M2B GSM wireless alarm system remotely in an unauthorized manner. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Proof of Concept (PoC): SySS GmbH build a small device that is able to arm and disarm every M2B GSM wireless alarm system within its radio range in max. 40 minutes. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution: An extra anti-jammer device is purchasable by the Vendor. This sensor should detect malicious devices that are trying to disarm system using the brute-force method. If such a device is detected the alarm will be triggered. (Solution as suggested by the vendor.) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclosure Timeline: 2016-07-05: Vulnerability reported to manufacturer 2016-10-13: Response from the vendor with the solution on how to mitigate the risk 2016-11-23: Public release of security advisory ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ References: [1] M2B GSM Wireless Alarm System, Multi Kon Trade http://multikontrade.de/GSM-Funk-Alarmanlage [2] PT2260 Remote Control Encoder, Princeton Technology Corp. http://www.princeton.com.tw/Portals/0/Product/PT2260_4.pdf [3] SySS Security Advisory SYSS-2016-064 https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2016-064.txt [4] SySS GmbH, SySS Responsible Disclosure Policy https://www.syss.de/en/news/responsible-disclosure-policy/ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Credits: This security vulnerability was found by Gerhard Klostermeier of SySS GmbH. E-Mail: gerhard.klostermeier (at) syss.de Public Key: https://www.syss.de/fileadmin/dokumente/PGPKeys/Gerhard_Klostermeier.asc Key fingerprint = 8A9E 75CC D510 4FF6 8DB5 CC30 3802 3AAB 573E B2E7 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclaimer: The information provided in this security advisory is provided "as is" and without warranty of any kind. Details of this security advisory may be updated in order to provide as accurate information as possible. The latest version of this security advisory is available on the SySS Web site. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Copyright: Creative Commons - Attribution (by) - Version 3.0 URL: http://creativecommons.org/licenses/by/3.0/deed.en </BODY></HTML>
