Hello From A Security Researcher

[cybergibbons]

inject a false sense of jeopardy!

Isn't that what the whole alarm industry is based around though

No, but I see your point. I'd really like to see statistics around burglary - if alarms are in use, what grade are they, how much was stolen, etc. I can't seem to find any though.

[matthew.brough]

Isn't that what the whole alarm industry is based around though ;)No, but I see your point. I'd really like to see statistics around burglary - if alarms are in use, what grade are they, how much was stolen, etc. I can't seem to find any though.

I don't believe it exists. There are stats for number of police response alarms, number of false calls, number of genuine calls and number of arrests and the arrest rate is so low it's not really worth noting.

[Oxo]

Isn't that what the whole alarm industry is based around though

 

 

Nope.

And it is a broad spectrum here, not just alarms. It includes locks and security devices and metal works. With cameras and other associated combinations.

You are concentrating on the electronic side, we deal with both the electronic and physical with other deterrents for higher risks after a RA and consultation.

Some fair comments have been made, but not using the above spectrums.

Have you not taken into account how we do an RA and what we use for the protection after that?

 

We DO NOT, well the ones in this for the rewards of job satisfaction as well as gain, make false assesments or try to scare the customer ( The reference to jeopardy). We assess and try to eliminate the risk. Not increase it by using "sub standard" equipment. Unlike many whom say the lesser items you have tested are not just adequate but  superiour in certain aspects...............which does really give me ball ache.

Fools who are not even regulated making out a cheap piece of C&R kit is suitable (Letters of the alphabet disguised to avoid court cases).

[Joe Harris]

CG - To help clear some confusion up on a point not always immediately obvious to those outside the industry:

 

Grades apply to the alarm system installations themselves but signalling grades used are often higher than the security grade of the system as many installers agree that polling guidelines are pretty lax.

 

For example it is common for a Grade 2 or 3 system to have a grade 4 signalling device.

 

Security Grade != Signalling Grade

 

Occasionally there is an exception but most quality installers lean towards a higher signalling grade.

[Boxshifter]

This thread is very interesting. I think the point that CG is getting at is that it won't be long before these jamming techniques pop up on YouTube and every 16 year old in the country will be able to disable the ever growing supply of wireless alarms and making professional installers look incompetent when a kid walks through the front door. In the world of network security one of the first rules is 'don't use wi-if'.

At the end of the day an alarm is an alarm and not a lock or a doberman it is there to notify an intrusion with a bit of deterent on the side. At least if the @&£! Hits the fan we can all earn good money converting systems back to hardwired

[Scotmod]

Isn't that what the whole alarm industry is based around though

No, but I see your point. I'd really like to see statistics around burglary - if alarms are in use, what grade are they, how much was stolen, etc. I can't seem to find any though.

 

What you started by saying was a bit sensationalist though. When you get stuck in to it the story is quite different from what we've started with. I have a theory, if you'll stick with me it should answer your question as to why you won't get statistics and why you'll be lucky to sell a dozen of your £30 devices.

 

Take me as a prime example. I have buildings and contents insurance. My insurer does not require me to have an alarm and my property doesn't have one* I've made the conscious decision that if someone was to break in to my home I would be happy with them stealing whatever contents they can get their hands on. All my important and sentimental keepsakes are in a small safe bolted to the floor. My insurers agree with me and if god forbid anything ever did happen the items and damage would be replaced and repaired at no cost to me. All I gain to lose is the mentality that my home is no longer safe and someone else has been through my belongings. An event some people never recover from.

 

Cybergibbons decides he's not quite comfortable with that thought so contacts his insurers to see what they recommend in terms of an intruder alarm. They know the value of the policy he has taken out and would assume that if he had anything of higher value, surely he would want it installed. The agent goes through their system and arrives at Grade 2. Either monitored or not. Again personal choice. Then someone goes through all the hassle of attempting to break in with your device. For the sake of argument the system is completely disabled. Dead. The alarm doesn't go off, but the fault of RF jamming is left on the log. The burglar still gets what they want and leaves. The insurance still pays out because it was a forced entry. Whether or not the alarm system went off or not. The insurers still pay and the police still get involved.

 

Alarms are not guarantees. They are deterrents. This is the main reason why your device wouldn't sell nor appeal to anyone. People on Grade 2 accept their stuff might get stolen. It is part of the risk assessment for the grading. 

 

The most striking thing about all of this is we are forgetting the criminal themselves. They see a bellbox, they don't bother. They go 2 minutes up the road to the house that doesn't have one. If your the kind of person that would have something stolen by someone as interested in crime as far enough to research a wireless alarm signal jammer then what they want should really be in another location and you shouldn't tell porkies to your alarm company nor your insurer.

[cybergibbons]

Nope.

And it is a broad spectrum here, not just alarms. It includes locks and security devices and metal works. With cameras and other associated combinations.

You are concentrating on the electronic side, we deal with both the electronic and physical with other deterrents for higher risks after a RA and consultation.

Some fair comments have been made, but not using the above spectrums.

Have you not taken into account how we do an RA and what we use for the protection after that?

 

We DO NOT, well the ones in this for the rewards of job satisfaction as well as gain, make false assesments or try to scare the customer ( The reference to jeopardy). We assess and try to eliminate the risk. Not increase it by using "sub standard" equipment. Unlike many whom say the lesser items you have tested are not just adequate but  superiour in certain aspects...............which does really give me ball ache.

Fools who are not even regulated making out a cheap piece of C&R kit is suitable (Letters of the alphabet disguised to avoid court cases).

I have to strongly disagree here. There are entire large corporations peddling alarms pretty much using fear to sell, and it looks like the have a big share of the home market. The physical security side of it is rife with it as well. A great example is Pickbuster - stop lock bumping it says - but there is no evidence bumping is used in burglaries at all. You also assume everyone has the same scruples as yourself.

[cybergibbons]

All I gain to lose is the mentality that my home is no longer safe and someone else has been through my belongings. An event some people never recover from.

Isn't this what the majority of home burglary victims state is the lasting impact?

[cybergibbons]

Regardless, it's clear that many of you don't think that the use of a device to disable alarms is a likely or viable threat.

Does this absolve the bugs/flaws in these wireless alarm systems? Is the manufacturer's response of "we don't care, it meets a ten year old standard" appropriate? If so, what value is there in the extra security afforded by Texecom Richochet's mesh protocol over Scantronic's much more basic protocol? They are both grade 2, so why would an insurer care? Is there no use in allowing these systems to be patched if flaws are found?

What happens if we extend this general school of thought to higher grade wired alarms and signalling systems? The design of SIA-HS means that you can trigger alarm events for all alarms at a ARC easily. This in my mind is a major issue - and it's not being dealt with. Would it not be an issue if redcare systems could be remotely turned off?

In recent communication, I was told by a manufacturer that a firmware image cannot be reverse engineered. This is wholesale false - it can be, and it's clear there are several exploitable buffer overflow issues in the code, allowing remote access to the system without a password. This is a grade 2 device, but there is nothing in the standards that mean a grade 3 or 4 is any less likely to suffer these problems.

The whole industry seems to discourage investigation into issues. I think that's really odd.

[cybergibbons]

My main concern is around the standards that dictate the features found in these alarms - specifically EN 50131-5-3 - which doesn't allow differentiation between a poor grade 2 alarm, and a much better one.

Don't know where you got your information about EN50131-5-3 but you are wrong. I am a UK expert on the WG11 working group and we have finished rewriting the standard, it is being edited at BSI and will be published for comment in due course.

Adrian - I realise you seem to have clammed up for some reason - but what aspect of the standard differentiates a Texecom Richochet panel from one of the other grade 2 panels? I don't see how I am wrong on this - it's an opinion, not a fact.

 

Also, is the open directory of firmware meant to be there? They seem to normally be restricted, so it seems odd to leave it open.