Csl Dualcom Cs2300-R Vulnerabilities

[jimcarter]

I don't know if WebWayOne want to pass comment on the self declared aspects of standards testing?

Difficult topic for me to be involved in tbh.

 

The levels of testing that can be done in respect of substitution and encryption are complex and I do believe that when we carried out certification to EN50136 this aspect was largely self declaration. Not ideal I would agree.

 

As a company our core specialty is (and always has been) secure communications. Ever since we entered the market with the first IP based ATS back in 2005 we have been under the microscope from all aspects of the industry. So 128AES, key exchange, substitution protection etc etc are what we eat sleep and breathe. 

 

In a separate topic I mentioned that we have had the ATS independently pen tested on multiple occasions, we would not have been successful in internet signalling within the financial sector & corporate space without. This level of testing was (as it should be) intense and incredibly thorough, carried out under NDA as well because we were almost at the level where we were talking about the core of the encryption and substitution techniques we developed.

[GalaxyGuy]

Featured on hackaday:

http://hackaday.com/2015/11/26/hacker-uncovers-security-holes-at-csl-dualcom/

[al-yeti]

CSL

Response

http://cybergibbons.com/wp-content/uploads/2015/11/CSL_statement.txt

[cybergibbons]

http://www.thesecurityinstaller.co.uk/community/topic/32716-dual-path-signalling-devices-dual-path-failure-reporting-times/

 

Thanks. That's interesting. I don't understand why it would take more than 10 minutes regardless of grade. I think the standard is a joke in this respect.

I spoke to my CSL rep yesterday who denied there site was hacked and also claimed any units tested were more than six years old and there units are completely secure.

 

As in, they denied this?

 

http://cybergibbons.com/alarms-2/customer-database-leak-on-csl-dualcoms-sim-registration-portal/

 

I have the emails from Santosh Chandorkar where we discussed it.

 

The units were old, but there is no evidence that the newer units don't suffer from the same issues.

the vpn bit from what i read is very last mile. Its not end to end.

 

Plus i believe alarm delivery and polling are different routes so polling imo does not prove path availability for alarm transmission.

ie some use the same path end to end to poll and deliver alarms.

 

As far as I can work out, the VPN is from the ARC to CSL. Certainly on the firmware I looked at there is no VPN functionality. The processors they use - the NEC 78K0R - are very small. They'd have to write the VPN software from the ground-up themselves. The way the latest firmware I have works, it just doesn't have room to do this.

 

The primary reason behind this is that the CS2300-R has been coded to deal with 4 different GRPS modems. The way this is done, it makes the code 4 times bigger in a lot of places. I'd estimate about 40% of the flash memory is taken up with this - there just is not room for a VPN client.

 

Possibly on later units, they have trimmed this out, allowing them to add functionality.

Difficult topic for me to be involved in tbh.

 

The levels of testing that can be done in respect of substitution and encryption are complex and I do believe that when we carried out certification to EN50136 this aspect was largely self declaration. Not ideal I would agree.

 

As a company our core specialty is (and always has been) secure communications. Ever since we entered the market with the first IP based ATS back in 2005 we have been under the microscope from all aspects of the industry. So 128AES, key exchange, substitution protection etc etc are what we eat sleep and breathe. 

 

In a separate topic I mentioned that we have had the ATS independently pen tested on multiple occasions, we would not have been successful in internet signalling within the financial sector & corporate space without. This level of testing was (as it should be) intense and incredibly thorough, carried out under NDA as well because we were almost at the level where we were talking about the core of the encryption and substitution techniques we developed.

 

That's the thing then - where the standards are weak, you and your customers have demanded that pen testing takes up the slack.

[cybergibbons]

This is where I reported the issue to Santosh, and he responded, eventually.

 

[cybergibbons]

55,000 views in a week, which isn't bad at all.

 

Still very surprised as CSL's lack of response - Twitter and Google are not looking bright for them.

[al-yeti]

But how many failures are known?

[cybergibbons]

But how many failures are known?

 

No idea - that's for CSL to answer. But they can't, because they don't have any way of detecting it.

[al-yeti]

But surely there would be a record of failures where perhaps a bulgary or fire took place and perhaps no signalling was sent ,regardless of csl it would show up with the Maintainer no?

[jimcarter]

But surely there would be a record of failures where perhaps a bulgary or fire took place and perhaps no signalling was sent ,regardless of csl it would show up with the Maintainer no?

That's irrelevant.

 

The whole point of data security (or Security for that matter) is not simply what has occurred in the past, it's what can happen today or in the future.

 

It's like insurance - if you didn't have it and you had an accident you'd soon get some...

 

If you want to risk not having any and just hope it never happens...that's your lookout.

 

We do happen to be in the Security Industry, don't we?