cybergibbons Posted November 30, 2015 Share Posted November 30, 2015 As per the subject, I found multiple serious vulnerabilities in RSI Videofied's protocol: http://cybergibbons.com/alarms-2/multiple-serious-vulnerabilities-in-rsi-videofieds-alarm-protocol/ This means it is trivially easy to spoof alarms from other panels. RSI Videofied have not been communicative. Supposedly they have deployed a fix, but I have not been shown what this fix is. They have had 4.5 months to respond so far. I would strongly recommend if you use their panels to ask what they are doing to fix this. I have a blog, some of which is about alarm security and reverse engineering:http://cybergibbons.com/ Link to comment https://www.thesecurityinstaller.co.uk/community/topic/39438-multiple-serious-vulnerabilities-in-rsi-videofieds-alarm-protocol/ Share on other sites More sharing options...
PeterJames Posted November 30, 2015 Share Posted November 30, 2015 Oh dear does Matt know? Link to comment https://www.thesecurityinstaller.co.uk/community/topic/39438-multiple-serious-vulnerabilities-in-rsi-videofieds-alarm-protocol/#findComment-436007 Share on other sites More sharing options...
cybergibbons Posted November 30, 2015 Author Share Posted November 30, 2015 Oh dear does Matt know? I believe so. I have a blog, some of which is about alarm security and reverse engineering:http://cybergibbons.com/ Link to comment https://www.thesecurityinstaller.co.uk/community/topic/39438-multiple-serious-vulnerabilities-in-rsi-videofieds-alarm-protocol/#findComment-436008 Share on other sites More sharing options...
Dick Posted November 30, 2015 Share Posted November 30, 2015 "In summary, the protocol is so broken that it provides no security, allowing an attacker to easily spoof or intercept alarms." Diabolical. Link to comment https://www.thesecurityinstaller.co.uk/community/topic/39438-multiple-serious-vulnerabilities-in-rsi-videofieds-alarm-protocol/#findComment-436021 Share on other sites More sharing options...
james.wilson Posted November 30, 2015 Share Posted November 30, 2015 How much other gear is insecure? securitywarehouse Security Supplies from Security Warehouse Trade Members please contact us for your TSI vetted trade discount. Link to comment https://www.thesecurityinstaller.co.uk/community/topic/39438-multiple-serious-vulnerabilities-in-rsi-videofieds-alarm-protocol/#findComment-436023 Share on other sites More sharing options...
datadiffusion Posted November 30, 2015 Share Posted November 30, 2015 SD1 dialler As per the subject, I found multiple serious vulnerabilities in RSI Videofied's protocol: http://cybergibbons.com/alarms-2/multiple-serious-vulnerabilities-in-rsi-videofieds-alarm-protocol/ This means it is trivially easy to spoof alarms from other panels. RSI Videofied have not been communicative. Supposedly they have deployed a fix, but I have not been shown what this fix is. They have had 4.5 months to respond so far. I would strongly recommend if you use their panels to ask what they are doing to fix this. My impression of RSI is that they have a team of about 2 people in the UK So, I've decided to take my work back underground.... to stop it falling into the wrong hands Link to comment https://www.thesecurityinstaller.co.uk/community/topic/39438-multiple-serious-vulnerabilities-in-rsi-videofieds-alarm-protocol/#findComment-436024 Share on other sites More sharing options...
cybergibbons Posted November 30, 2015 Author Share Posted November 30, 2015 How much other gear is insecure? Who knows. As you all told me, who cares about the RF side. Look at the signalling side. I started and it's not good. Risco, Visonic, CSL and Videofied have all attempted to go further than SIA etc. and they have made massive errors. What I don't get is how badly broken it is. These are not subtle issues - the Videofied work took me less than 3 hours from start to finish. I spent more time trying to contact them and writing the blog post than actually doing the work. I gave up on the UK side and tried the French and US contacts, still nothing. It took CERT to get them talking. I have a blog, some of which is about alarm security and reverse engineering:http://cybergibbons.com/ Link to comment https://www.thesecurityinstaller.co.uk/community/topic/39438-multiple-serious-vulnerabilities-in-rsi-videofieds-alarm-protocol/#findComment-436029 Share on other sites More sharing options...
Dick Posted November 30, 2015 Share Posted November 30, 2015 SD1 dialler Are you saying the SD1 dialler is insecure in reply to James? Link to comment https://www.thesecurityinstaller.co.uk/community/topic/39438-multiple-serious-vulnerabilities-in-rsi-videofieds-alarm-protocol/#findComment-436035 Share on other sites More sharing options...
skywalker Posted December 1, 2015 Share Posted December 1, 2015 As per the subject, I found multiple serious vulnerabilities in RSI Videofied's protocol: http://cybergibbons.com/alarms-2/multiple-serious-vulnerabilities-in-rsi-videofieds-alarm-protocol/ This means it is trivially easy to spoof alarms from other panels. RSI Videofied have not been communicative. Supposedly they have deployed a fix, but I have not been shown what this fix is. They have had 4.5 months to respond so far. I would strongly recommend if you use their panels to ask what they are doing to fix this. you should plan a high profile heist... Link to comment https://www.thesecurityinstaller.co.uk/community/topic/39438-multiple-serious-vulnerabilities-in-rsi-videofieds-alarm-protocol/#findComment-436133 Share on other sites More sharing options...
petrolhead Posted December 2, 2015 Share Posted December 2, 2015 (edited) Ooooooh ooooooooh i'm incontinent! Edited December 2, 2015 by norman Link to comment https://www.thesecurityinstaller.co.uk/community/topic/39438-multiple-serious-vulnerabilities-in-rsi-videofieds-alarm-protocol/#findComment-436224 Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now