How secure is the texecom?

[homesecure]

Thank you everyone for your helpful replies. 

 

@AdrianMealing That's very useful as I believe my panel already has v3.01 firmware.   If it's already got the encryption, do I need to enable it via wintex or other method? 

 

Thanks again 

[AdrianMealing]

@homesecure you generate the encryption key (128bit AES) in the app, and then enable it and enter it into an engineers menu on the keypad. It can only be done via the keypad and not through Wintex.

 

The documentation that came with the panel details the procedure for doing this.

 

In our next version of the app, and with V4 panel firmware all of this will be automated, and enabled as standard. It will also not be necessary to open ports on the router as we have another method now for establishing the connection. It will also be possible to flash the panel to V4 to enable the new methods. The security for the communications in V4 are more than just the encryption key used in V3.

 

Regarding the initial article, the use of wireshark to sniff data on the network only actually works IF you are on the same network. So our point in our response about network security is certainly valid, and unless the hacker is already on your network wireshark is not going to show anything.

[homesecure]

Thanks very much for the information Adrian. May I ask when this v4 firmware will be released? 

 

I don't have the lead as yet to flash it,  but may flash it once v4 update is available. 

[AdrianMealing]

V4 is undergoing extensive testing as we speak. I cannot put a firm date on release as we may need to fix anything found to be broken during testing. I would anticipate sometime in September looking at the current test schedule.

[datadiffusion]

6 hours ago, AdrianMealing said:

Regarding the initial article, the use of wireshark to sniff data on the network only actually works IF you are on the same network. So our point in our response about network security is certainly valid, and unless the hacker is already on your network wireshark is not going to show anything.

 

This is a really valid point but good that the changes in V4 are being made, as I was wondering today how long it will be before WPA/WPA2 is compromised just like WEP was, especially on consumer grade routers (i.e the easiest route onto said network).

 

However, whilst a home / domestic network is possibly the easiest to bust, it's probably the least likely to be of interest to serious tealeaves I suppose.

 

What would be interesting are sites with poorly setup guest access via wifi, commercial type places, that use such IoT products. Once access to the network is gained via friendly means (i.e daytime) it would be no trouble to return at night with wifi access from outside the premises...

[sixwheeledbeast]

40 minutes ago, datadiffusion said:

 

I was wondering today how long it will be before WPA/WPA2 is compromised just like WEP was

 

All encryption can be compromised with enough computing power, having strong passwords is the key to stop attacks. A 128 bit AES key would take billions of years to brute force.

WEP and some WPA can be exploited much easier than a WPA2 connection, WEP was flawed in many ways and WPA was a backwards compatible plaster for WEP.

All WiFi should be WPA2 which uses AES 256 bit encryption for maximum security.

 

Any site that would share guest access with the rest of the network is asking for trouble.

[secureiam]

The setup though is long winded for everything, although getting quicker at doing al the individual steps.

 

its encrypted now, previously it was displayed as plain text as the article explains.

 

The app currently giving my customers more grief with the current android parsing issue.

[AdrianMealing]

1 hour ago, secureiam said:

The setup though is long winded for everything, although getting quicker at doing al the individual steps.

 

its encrypted now, previously it was displayed as plain text as the article explains.

 

The app currently giving my customers more grief with the current android parsing issue.

All this will change with V4, and to be fair the Android issue has nothing to do with this thread and is being looked at.

[datadiffusion]

3 hours ago, sixwheeledbeast said:

Any site that would share guest access with the rest of the network is asking for trouble.

 

Plenty do though, esp. pubs etc...

[secureiam]

Hi Adrian,

 

cant comment on the future, cant see it now, but improvements are always welcome, as would be the reliability of notifications but I digress.

 

Security can always be bypassed and hacked by someone that is a geek(knowledgeable person)if they have the will and the time to spend.

 

I certainly welcome the steps made to make things more secure has to be a good thing and the lesser geek isn't likely to give it a go in a hurry.