cybergibbons Posted November 23, 2015 Share Posted November 23, 2015 (edited) As many of you know, I spent some time researching the CSL CS2300-R SPTs last year. I found a series of issues that I think are serious problems. CSL have had 17 months to deal with these issues, and after them dawdling, I opted for co-ordinated disclosure of the issues via CERT/CC. CSL have had 45 days to respond to CERT/CC, and only did so on Friday with a statement that is largely spin and distraction. In summary, the issues found: CSL have developed incredibly bad encryption, on a par with techniques state-of-the-art in the time before computers. CSL have not protected against substitution very well CSL can’t fix issues when they are found because they can’t update the firmware There seems to be a big gap between the observed behaviour of the CS2300-R boards and the standards It’s likely that the test house didn’t actually test the encryption or electronic security Even if a device adheres to the standard, it could still be full of holes CSL either lack the skill or drive to develop secure systems, making mistake after mistake I have written a blog post detailing these issues, which also links to the full PDF report. Until CSL can demonstrate that their products are standards compliant and secure, I would advise not using them, especially for higher grades. Edited November 23, 2015 by cybergibbons I have a blog, some of which is about alarm security and reverse engineering:http://cybergibbons.com/ Link to comment https://www.thesecurityinstaller.co.uk/community/topic/39405-csl-dualcom-cs2300-r-vulnerabilities/ Share on other sites More sharing options...
james.wilson Posted November 23, 2015 Share Posted November 23, 2015 Is the 2300 the board in grade 3 mode? securitywarehouse Security Supplies from Security Warehouse Trade Members please contact us for your TSI vetted trade discount. Link to comment https://www.thesecurityinstaller.co.uk/community/topic/39405-csl-dualcom-cs2300-r-vulnerabilities/#findComment-435433 Share on other sites More sharing options...
cybergibbons Posted November 23, 2015 Author Share Posted November 23, 2015 Is the 2300 the board in grade 3 mode? The only difference between the grades is the reporting time, as far as I can tell. The encryption, the protocol, the lack of firmware updates etc. are the same regardless of grade. I have a blog, some of which is about alarm security and reverse engineering:http://cybergibbons.com/ Link to comment https://www.thesecurityinstaller.co.uk/community/topic/39405-csl-dualcom-cs2300-r-vulnerabilities/#findComment-435435 Share on other sites More sharing options...
cybergibbons Posted November 23, 2015 Author Share Posted November 23, 2015 The vulnerability note from CERT has now gone live: http://www.kb.cert.org/vuls/id/428280 I have a blog, some of which is about alarm security and reverse engineering:http://cybergibbons.com/ Link to comment https://www.thesecurityinstaller.co.uk/community/topic/39405-csl-dualcom-cs2300-r-vulnerabilities/#findComment-435437 Share on other sites More sharing options...
Nova-Security Posted November 23, 2015 Share Posted November 23, 2015 wonder if the BSIA will get involved to assist on of their biggest members www.nova-security.co.uk www.nsiapproved.co.uk No PMs please unless i know you or you are using this board with your proper name. Link to comment https://www.thesecurityinstaller.co.uk/community/topic/39405-csl-dualcom-cs2300-r-vulnerabilities/#findComment-435449 Share on other sites More sharing options...
james.wilson Posted November 23, 2015 Share Posted November 23, 2015 wonder if the BSIA will get involved to assist on of their biggest members to assist? in what way? securitywarehouse Security Supplies from Security Warehouse Trade Members please contact us for your TSI vetted trade discount. Link to comment https://www.thesecurityinstaller.co.uk/community/topic/39405-csl-dualcom-cs2300-r-vulnerabilities/#findComment-435457 Share on other sites More sharing options...
cybergibbons Posted November 23, 2015 Author Share Posted November 23, 2015 wonder if the BSIA will get involved to assist on of their biggest members That's really no way to refer to Simon Banks. I have a blog, some of which is about alarm security and reverse engineering:http://cybergibbons.com/ Link to comment https://www.thesecurityinstaller.co.uk/community/topic/39405-csl-dualcom-cs2300-r-vulnerabilities/#findComment-435458 Share on other sites More sharing options...
james.wilson Posted November 23, 2015 Share Posted November 23, 2015 cg what responses have you had from csl regarding this? its a bit over my head but can the unit be defeated in the field without access to the unit itself? securitywarehouse Security Supplies from Security Warehouse Trade Members please contact us for your TSI vetted trade discount. Link to comment https://www.thesecurityinstaller.co.uk/community/topic/39405-csl-dualcom-cs2300-r-vulnerabilities/#findComment-435460 Share on other sites More sharing options...
cybergibbons Posted November 23, 2015 Author Share Posted November 23, 2015 cg what responses have you had from csl regarding this? They haven't communicated with me at all since they tried getting my home address 6 weeks ago. its a bit over my head but can the unit be defeated in the field without access to the unit itself? I believe it can, yes. Certainly the ones that use the IP path can be sniffed and spoofed with little trouble. The problem is that I can't push the boundaries any further to prove it. The real point is that their systems have been designed and operated by people who very clearly are incompetent. If anyone has looked at their security, CSL have totally ignored any findings. God knows what else is there. If you aren't regulated by the law, it could be awful. I have a blog, some of which is about alarm security and reverse engineering:http://cybergibbons.com/ Link to comment https://www.thesecurityinstaller.co.uk/community/topic/39405-csl-dualcom-cs2300-r-vulnerabilities/#findComment-435464 Share on other sites More sharing options...
norman Posted November 23, 2015 Share Posted November 23, 2015 Who did they try to get your address from? I hear if you boil the horses head it makes quite a pleasant soup. Nothing is foolproof to a sufficiently talented fool. Link to comment https://www.thesecurityinstaller.co.uk/community/topic/39405-csl-dualcom-cs2300-r-vulnerabilities/#findComment-435471 Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now