Isn't that 'Self Declared' bit the whole industry in general.

 

I think that is part of the problem, but to sell signalling devices in some places (Spain, at least), you need third-party testing.

The CS2300 has been tested:

https://twitter.com/CSLDualCom/status/486496083322093568

 

But, after speaking to the testing house, it is highly likely that the entire encryption and substitution protection bit is self-declared, even when third-party tested. Personally, I don't think that's made clear.

If self certing is part of it what's the point of 3rd party certification?

On 1st May this year, I found it was possible to dump the names, addresses, emails, usernames, and phone numbers of every single user of every single company who had registered on the CSL M2M SIM page. I did not push the investigation any further, but worse may have been visible.

 

http://cybergibbons.com/alarms-2/customer-database-leak-on-csl-dualcoms-sim-registration-portal/

 

If you would like to know if your company was one of the listed ones, I can check for you.

 

Can you check if I'm on there Mercury Security Management?

If you're a CSL customer or have ever called them about *any* product I'd say it looks like you will be.

If it's general info

Ie phone number email address being registered company anyway

What's the big deal it's all available anyway ?

What's the big deal it's all available anyway ?

Well lets say Kev Hall appears on the list under his co's name,

At one time the site would have given out his email & password to those in the know.

If the same credentials are used else where, that presents quite a risk ?

We just go into housing and building like you , get bigger cone cutters and your done

Is csl overall cheapest?

Can you check if I'm on there Mercury Security Management?

 

Yes, Frank.

If self certing is part of it what's the point of 3rd party certification?

 

The point is that most people don't realise this, and it took quite a lot of work to arrange a meeting with the test house before I found this out.

So you have a cert and people think it means all of it was third-party tested.

Yes, Frank.

 

That would be our CEO

If it's general info

Ie phone number email address being registered company anyway

What's the big deal it's all available anyway ?

 

There are sole traders on there, who might not want their addresses out there. A lot of mobile numbers. Usernames - they should not be leaking.

It's also strongly indicative that they have done no security testing at all. This was found in under a minute of browsing their site. What else is there?

 

Also, it's a great tool for social engineering. And a great list of contacts for a competitor.

Edited November 8, 201510 yr by cybergibbons