This top home security system could be disabled remotely
Vendor wouldn’t return emails or acknowledge the vulnerabilities, claim researchers
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
A popularhome security systemcan reportedly be disabled, according tocybersecurityresearchers.
Researchers at Rapid7 found a pair of vulnerabilities in the Fortress S03 home security system that relies onWi-Fito connect cameras, motion sensors and sirens to the internet, to enable owners to remotely monitor their home.
Rapid7 hasshared the detailsabout the two vulnerabilities after it did not hear from Fortress in over three months, which is the standard window of time for security disclosures, followed by the industry.
We’re looking at how our readers use VPNs with streaming sites like Netflix so we can improve our content and offer better advice. This survey won’t take more than 60 seconds of your time, and we’d hugely appreciate if you’d share your experiences with us.
Click here to start the survey in a new window«
According to the timeline shared by Rapid7, it is confident it got through to the company since Fortress silently closed its first support ticket over a week later after it was created.
Anybody home?
As per the details shared by Rapid7, it found that the Fortress S03 system relies on a radio-controlled key fob that helpsarmand disarm the system.
Its researchers discovered that signals from the keys were unencrypted and could be intercepted, which enabled them to capture and replay the signals for “arm” and “disarm”.
It found a second vulnerability in Fortress’ unauthenticated API, which can be remotely queried over the internet without the server checking the legitimacy of the request. All it takes is a homeowner’s email address for the server to return the device’s unique IMEI code, which can be used to remotely disarm the system.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Rapid7 claims it brought the issues to Fortress’ knowledge, but the company never returned their messages, even after it raised a new ticket reiterating their intent to publish the details.
While Fortress did not respond to queries fromTechCrunch, an email from their law firm labelled Rapid7’s claims as “false, purposely misleading and defamatory,” without adding more details.
ViaTechCrunch
With almost two decades of writing and reporting on Linux, Mayank Sharma would like everyone to think he’sTechRadar Pro’sexpert on the topic. Of course, he’s just as interested in other computing topics, particularly cybersecurity, cloud, containers, and coding.
This new phishing strategy utilizes GitHub comments to distribute malware
Should your VPN always be on?
NYT Strands today — hints, answers and spangram for Sunday, November 10 (game #252)
