james.wilson Posted November 23, 2015 Share Posted November 23, 2015 id of thought that security on a security signalling device is pretty damn important securitywarehouse Security Supplies from Security Warehouse Trade Members please contact us for your TSI vetted trade discount. Link to comment https://www.thesecurityinstaller.co.uk/community/topic/39405-csl-dualcom-cs2300-r-vulnerabilities/page/5/#findComment-435527 Share on other sites More sharing options...
cybergibbons Posted November 23, 2015 Author Share Posted November 23, 2015 id of thought that security on a security signalling device is pretty damn important Me too. This is the thing though - it keeps on getting back to "is it being exploited". I have no idea. Neither do CSL. But fundamentally, the device doesn't comply with the standards it claims to. How many of you know the PIN that secures the SMS functionality on Dualcoms in your estate? I have a blog, some of which is about alarm security and reverse engineering:http://cybergibbons.com/ Link to comment https://www.thesecurityinstaller.co.uk/community/topic/39405-csl-dualcom-cs2300-r-vulnerabilities/page/5/#findComment-435528 Share on other sites More sharing options...
Dick Posted November 23, 2015 Share Posted November 23, 2015 technically its down to installer as thats the final cert issued All things being equal yes, but this has to be different from now on in. It is only the beginning too where security is concerned if we go down the route of the ever popular automated equipment. 1 Link to comment https://www.thesecurityinstaller.co.uk/community/topic/39405-csl-dualcom-cs2300-r-vulnerabilities/page/5/#findComment-435529 Share on other sites More sharing options...
cybergibbons Posted November 24, 2015 Author Share Posted November 24, 2015 All things being equal yes, but this has to be different from now on in. It is only the beginning too where security is concerned if we go down the route of the ever popular automated equipment. There has to be a chain of trust. I think it is wholly unreasonable to except an installer (or installation company) to evaluate each and every product they install. They need to trust either the test house, or the manufacturer. As more and more devices get connected to the Internet, this will be more important. I've only briefly looked at Risco, Visonic, and Videofied Internet connected gear, and they all had serious issues. Some companies are getting security experts involved at the design stage now though. I have a blog, some of which is about alarm security and reverse engineering:http://cybergibbons.com/ Link to comment https://www.thesecurityinstaller.co.uk/community/topic/39405-csl-dualcom-cs2300-r-vulnerabilities/page/5/#findComment-435534 Share on other sites More sharing options...
cybergibbons Posted November 24, 2015 Author Share Posted November 24, 2015 I'm still really confused about CSL's product lines. I looked at units that are marked CS2300-R. CSL claim there are only 600 of these in the field. But then this box: http://www.ebay.co.uk/itm/272052537074?ru=http%3A%2F%2Fwww.ebay.co.uk%2Fsch%2Fi.html%3F_from%3DR40%26_sacat%3D0%26_nkw%3D272052537074%26_rdc%3D1 That is a G4 Gradeshift with a Worldsim - marked CS2300-R... Surely there are more than 600 of these? I have a blog, some of which is about alarm security and reverse engineering:http://cybergibbons.com/ Link to comment https://www.thesecurityinstaller.co.uk/community/topic/39405-csl-dualcom-cs2300-r-vulnerabilities/page/5/#findComment-435538 Share on other sites More sharing options...
Dick Posted November 24, 2015 Share Posted November 24, 2015 There has to be a chain of trust. I think it is wholly unreasonable to except an installer (or installation company) to evaluate each and every product they install. They need to trust either the test house, or the manufacturer. As more and more devices get connected to the Internet, this will be more important. I've only briefly looked at Risco, Visonic, and Videofied Internet connected gear, and they all had serious issues. Some companies are getting security experts involved at the design stage now though. Agreed, but the trust is being tested as technology moves on and largely away from what installers have been used to for many years. There is now another 'breed' in the mix of security and these guys are, on occasions, failing at the first hurdle to make the hardware secure via inadequate software programming. Companies using independent certified security experts to give their equipment a seal of approval should be the only way forward now if trust is to be maintained. Link to comment https://www.thesecurityinstaller.co.uk/community/topic/39405-csl-dualcom-cs2300-r-vulnerabilities/page/5/#findComment-435541 Share on other sites More sharing options...
cybergibbons Posted November 24, 2015 Author Share Posted November 24, 2015 Agreed, but the trust is being tested as technology moves on and largely away from what installers have been used to for many years. There is now another 'breed' in the mix of security and these guys are, on occasions, failing at the first hurdle to make the hardware secure via inadequate software programming. Companies using independent certified security experts to give their equipment a seal of approval should be the only way forward now if trust is to be maintained. Ask the question to Redcare, Emizon or WebWayOne - have you been pentested? We already know what one of them will say. I have a blog, some of which is about alarm security and reverse engineering:http://cybergibbons.com/ Link to comment https://www.thesecurityinstaller.co.uk/community/topic/39405-csl-dualcom-cs2300-r-vulnerabilities/page/5/#findComment-435543 Share on other sites More sharing options...
al-yeti Posted November 24, 2015 Share Posted November 24, 2015 Back to pstn then , more secure Link to comment https://www.thesecurityinstaller.co.uk/community/topic/39405-csl-dualcom-cs2300-r-vulnerabilities/page/5/#findComment-435544 Share on other sites More sharing options...
Dick Posted November 24, 2015 Share Posted November 24, 2015 Ask the question to Redcare, Emizon or WebWayOne - have you been pentested? We already know what one of them will say. What, and take your fun away, never!! I've stayed away from 'this' technology on purpose waiting for this day of reckoning. Whichever the way you look at it it'll only get worse, or more entertaining, before it gets better. Link to comment https://www.thesecurityinstaller.co.uk/community/topic/39405-csl-dualcom-cs2300-r-vulnerabilities/page/5/#findComment-435547 Share on other sites More sharing options...
sixwheeledbeast Posted November 24, 2015 Share Posted November 24, 2015 That is a G4 Gradeshift with a Worldsim - marked CS2300-R... Surely there are more than 600 of these? I guess it depends on what your calling CS2300-R. Take your ebay example this shows a "CS2300-R" but the product part number is CS2412. It doesn't seem easy to tell which products your vulnerabilities relate to from these CS numbers. Link to comment https://www.thesecurityinstaller.co.uk/community/topic/39405-csl-dualcom-cs2300-r-vulnerabilities/page/5/#findComment-435548 Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now