Multiple serious vulnerabilities in RSI Videofied's panels

Joined
10 Apr 2010
Messages
146
Reaction score
13
Location
London
Country
United Kingdom
It's very easy to spoof alarms from other panels - the security they have on the IP side is essentially worthless:


link deleted by Mod
 
Last edited by a moderator:
Sponsored Links
It is NOT a good idea to put this level of information into the public domain.

By all means give a synopsis of the method that can exploit the weak security of the system but NOT a detailed explanation.
 
I asked them what they wanted disclosed, and there was no response whatsoever.
If they didn't replay then they withheld permission to disclose.

Hopefully they will improve the security in the light of your findings but existing systems that cannot be upgraded may now be more vulnerable.
 
Sponsored Links
That's really not how it works. They've had 3 months with acknowledged communication with CERT/CC - all they need to do is ask.
 
Bernard, Videofied had ample time to reply. Being out in the open is exactly what it needs if so called security devices are being sold as secure and they are not.

Good work, CG, and may you continue to reveal as many insecure devices out there until hopefully companies have no other option than to do it right or be exposed.
 
The industry is a state. I thought the RF side of things was bad, then I looked at the IP side.

Unfortunately, I can't really name the good guys without being called biased, so I'm just releasing the vulnerabilities I find.

3 months is long enough - customers should have been informed of potential issues before now, even if it can't be fixed.
 
CG, you can always PM me the good guys. There has to be a few, surely?

Maybe the installers of said equipment won't be too quick to mock anything other than 'professionally' monitored systems because the reality is they really don't have a clue how secure these systems are.
 
by posting openly in a public forum you are increasing the chances of the panels being attacked.

certainly appreciate your kind of work, there are many ways to disable the panels out there without going hitech, but it requires some knowledge of the system and the location of its component parts.
 
What's the videofied graded at ?

I agree that the protocols are poor and are generally re-iterations of old code written for 8 bit hardware with the same old mistakes folded into the new products. I've been working with some of the major players IP based kit for a few years now and that's one of the main reasons that I advise AGAINST adding internal sensor based cameras to these systems. If you can gain control of the system, you can gain control of the cameras.
 
by posting openly in a public forum you are increasing the chances of the panels being attacked.

By not disclosing the issues though, the vendor wasn't going to fix them. Unfortunately, you sometimes need to force their hand.
 
What's the videofied graded at ?

I agree that the protocols are poor and are generally re-iterations of old code written for 8 bit hardware with the same old mistakes folded into the new products. I've been working with some of the major players IP based kit for a few years now and that's one of the main reasons that I advise AGAINST adding internal sensor based cameras to these systems. If you can gain control of the system, you can gain control of the cameras.

The panel can be grade 2 I believe, but I am not sure if that is the case with the signalling. They've literally not responded to me at all despite tens of attempts.

I've been doing competitor research on video verified systems (hence this work), and on the whole the security is not good. I would not trust a PIR camera inside my house. Usability, functionality and reliability is also poor though.
 

DIYnot Local

Staff member

If you need to find a tradesperson to get your job done, please try our local search below, or if you are doing it yourself you can find suppliers local to you.

Select the supplier or trade you require, enter your location to begin your search.


Are you a trade or supplier? You can create your listing free at DIYnot Local

 
Sponsored Links
Back
Top