Black Hat 2014: How to steal security codes from home alarm systems

A $50 device made with off the shelf hardware can.

For $50 attackers can build a radio device that cracks home alarm systems and other common security devices, Black Hat 2014 attendees will hear this week.

A combination of a microcontroller and a single-board computer comprises the device, which can capture and replay codes that make it possible to disable the alarms, according to Silvio Cesare, a researcher at Qualys who will present the talk.

+ Also on Network World: 10 disturbing attacks at Black Hat USA 2014 |The Black Hat Quiz 2014 +

He says he built the device and was able to train it to steal the codes by eavesdropping on the radio-frequency remote that most alarm systems come with to enable and disable the gear. He says that practically all home alarm systems that had a remote used fixed codes, making a replay attack possible once the code was pilfered.

The device was made from Arduino and Raspberry Pi hardware.

Another soft spot he discovered in home alarm systems is the non-volatile memory that stores information such as calibration, configuration and passwords. With physical access to the devices he says he can connect a device programmer that reads the device's minicontroller where the passcode is stored that customers punch in to enable or disable the alarms.

Either method would let burglars shut down security systems so they could break in without fear of sounding the alarm.

Surprisingly, he says, the easiest way to defend against these types of attacks is to buy systems that don't have these vulnerabilities. He says he'll lay down how to shop for alarm systems that pass the test.

Cesare also plans to show how to break security of the keyless entry system of a popular late-model car using predictable rolling codes. To analyze the system he used software defined radio and some math, but he also built a button-pushing robot to punch in combinations of numbers in order to gather data to do the math.

See the original post:
Black Hat 2014: How to steal security codes from home alarm systems