Slashdot Mirror

← Back to Stories (view on slashdot.org)

Comcast's Xfinity Home Security Flaw Leaves Doors Open (rapid7.com)

Posted by Soulskill on from the comcast-meets-your-expectations-for-comcast dept.

itwbennett writes: Researchers at Rapid7 have disclosed vulnerabilities in Comcast's Xfinity Home Security offerings that prevent the system from alerting homeowners to unsecured doors or windows and would also fail to sense an intruder's motion in the home. The root cause of the problem can be found in the ZigBee-based protocol used by Comcast's system to operate over the 2.4 GHz frequency band. Rapid7's Phil Bosco discovered that the Xfinity Home Security system does not fail closed with an assumption of an attack if radio communications are disrupted. Instead, the system fails open, reporting that all sensors are intact, doors are closed, and no motion is detected.

119 comments

  1. Stick To Cable TV by macs4all · · Score: 1

    This is what happens when a company strays too far out of its core (in)competency.

    1. Re:Stick To Cable TV by bobbied · · Score: 2

      I don't know, as a former Comcast customer they seem to have about the same competency in home security as providing cable TV service.

      --
      "File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
    2. Re:Stick To Cable TV by mrchaotica · · Score: 1

      As an (unfortunately) current Comcast customer (who will jump ship the nanosecond Google Fiber becomes available), Comcast has always been technically competent in my experience. The problem is that they're evil!

      --

      "[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz

    3. Re:Stick To Cable TV by chipschap · · Score: 1

      Of course they are technically competent, they have to be to ensure that they minimize service and maximize ripping off their customers.

    4. Re:Stick To Cable TV by Anonymous Coward · · Score: 0

      It might surprise you that Comcast is really a group of companies. The cable TV bit is just one piece of it run by one division. The home security will be another part somewhere else. The bit thats currently cornering the VOD market world wide is another group of companies located in Seattle, Denver and other places which have absolutely nothing to do with the cable tv network, home security or much else outside of 'what they do'.

    5. Re:Stick To Cable TV by Zaowulf · · Score: 1

      Satan's toenail is still just as evil as the rest of his body.

    6. Re:Stick To Cable TV by Anonymous Coward · · Score: 0

      I once was at Comcast for an interview which involved a team which was related to the Home Security product. They stated that they were currently in the middle of a week long outage with the product at the time. So, this doesn't really surprise me very much.

      Then I became more concerned with them as soon as the interview panel effectively suggested that I was too independent minded and hands on for the big company mindset. They said this while exhibiting a level of despair on their faces that made it feel like they were interviewing me for a middle management position in Hell.

      Many places are hellish, but they at least try and pretend they're an awesome place to work. Here it seemed like they would reject you if you weren't sufficiently institutionalized in your mindset, which is was a disturbing thing to come across in my IT career. And I am not a rebellious character who could not fit into a corporate environment by any stretch of the imagination. I understand that managers do need to manage and not be alpha geeks, but they quite literally seemed concerned that I was even capable of being more technically minded than a pure manager and therefore could not manage a technical team.

      More than anything else, including the many support horror stories, that interview made me glad that I have never been a customer of Comcast, and I hope I never am.

      They didn't call me back after the interview, and to this day, it is one of the few interviews that I am relieved that I utterly failed at.

    7. Re:Stick To Cable TV by Zero__Kelvin · · Score: 1

      My understanding is that imaginary toenails are lawful good, actually.

      --
      Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
    8. Re:Stick To Cable TV by mysidia · · Score: 1

      I think those types of vulnerabilities like the one mentioned above are by no means specific to Comcast.

      Also, by and large, "experts" and manufacturers in the physical security industry are clueless in regards to IT security, Information security, and Systems security.

      Home security companies' core competence is in providing systems to mitigate physical security issues, but they are largely ignorant to specialized attacks and weaknesses in the systems themselves that they provide for the purpose of improving security.

      They will probably notice glaringly obvious issues that humans interact with: Such as 1234 as your passcode, Or exposed security wiring without a tamper sensor, but not much more.

      And it's probably just White-label hardware and software from the least-expensive source they could find badged with their company name, anyways.

    9. Re: Stick To Cable TV by Anonymous Coward · · Score: 0

      You are correct, this issue resides with Time Warners Home Security and many of the off the shelf wireless security systems you can buy. Everyone hates Comcast, we get that but the way these stories are labled are a bit misleading. Some of the issues go back to the zigby or z-wave implementation.

      Do you blame ATT if you missed the call that your wife went to the hospital because someone had a cellphone jammer near by?

    10. Re:Stick To Cable TV by KGIII · · Score: 0

      This is a day old so I'll throw an off-topic reply in here. I don't know if you kept up with the gibberish I posted during the holidays but my daughter finished med school and is now doing whatever it is that doctors do when they finish school and go do some poorly paid duty for four years. She's working in an children's emergency slash trauma unit in a city along the Eastern Seaboard.

      I have been conned! Conned I tell you! "Oh, but Daddy, it's not like you were doing anything better." *sighs* You can guess where this is going.

      According to her (I figure you can add this to your repertoire) iPads are easy to keep fairly sanitized and to clean if they get dirty. They're not applicable to all patients, some are kept in very sterile environments, but the hospital is a non-profit/charitable facility. So, yeah... She says that they need at least twenty as they have 18 beds. She does not yet have approval from the IT staff to put them online but I'm sure she'll get that approval. And yes, yes I'll take care of it.

      She should have been a con artist. I figured you'd be interested and would like to know that, in her professional opinion, they're suitable for use in such environments assuming they're not being kept in complete, sterile, isolation. I expect to know if they can be brought in and put on the network by the end of next week.

      --
      "So long and thanks for all the fish."
    11. Re:Stick To Cable TV by macs4all · · Score: 1

      She should have been a con artist. I figured you'd be interested and would like to know that, in her professional opinion, they're suitable for use in such environments assuming they're not being kept in complete, sterile, isolation. I expect to know if they can be brought in and put on the network by the end of next week.

      Ya know, for someone who isn't an Apple fan, you have probably purchased more Apple gear than the next TEN fanbois, LOL!!!

      Your daughter may very well have a promising second-career as a con-artist; but in this particular case, she is right-on.

      When the iPad first came out, I was looking into developing a disposable "bag" for just this sort of application. That idea went the way of all my good ideas, and was eventually replaced with another idea of mine for an iPad/tablet "sterilizer" chamber, that would use UV to disinfect one or more iPads/tablets. And of course, charging facilities would be provided, too for charging-while-disinfecting.

      iPads are used in thousands of hospitals everyday. Even without the disinfection. In sterile environments, like an Operating Room, they tend to put them in plastic bags (a gallon-ziploc works fine), and yes, the touchscreen does work through the plastic bag. But on the regular "floors", they just treat iPads like a clipboard. No sterilization, no protective sheath/pouch, nothing.

      I would say that iPads are probably fairly easy to keep relatively clean (cleaner than a computer keyboard and mouse!!!), simply because there really aren't many cracks and crevices for caked blood, etc, to congregate. The main issue is the Home button, because it gets pressed a zillion times a day, followed by the Sleep/Wake button. But a simple silicone-rubber "boot"-type case would probably work...

    12. Re:Stick To Cable TV by KGIII · · Score: 1

      Yeah, I'm going to be looking into cases for them - preferably ones that can be replaced between patients at minimal expense but the resealable bag is a good idea. I'll have to mention that to her. At this point, I probably should own stock in the damned company. Technically, I once did. I probably should have held onto those shares but I didn't. Ah well... I did not have a lot.

      --
      "So long and thanks for all the fish."
    13. Re:Stick To Cable TV by macs4all · · Score: 1

      Yeah, I'm going to be looking into cases for them - preferably ones that can be replaced between patients at minimal expense but the resealable bag is a good idea. I'll have to mention that to her. At this point, I probably should own stock in the damned company. Technically, I once did. I probably should have held onto those shares but I didn't. Ah well... I did not have a lot.

      I would suggest that you ask her to ask her Doctor-collegues what they do for iPad-cases. There is also a guy that sells iPad-sized bags for use in the Kitchen. I think this may be his stuff. I seem to remember that he hinted on his website that he was also investigating branching into medical applications for his iPad-sized bag.

      Gallon Ziplocs work; but they are really too big, so you end up doing an annoying "gift-wrap" thing with adhesive tape to keep them from sliding around with your finger. Plus, polyethelene really isn't that clear, and it is kind of static-y. But it works, and Ziplocs are cheap!

    14. Re:Stick To Cable TV by KGIII · · Score: 1

      Thanks again - I've actually got an acquaintance that makes custom plastic bags, now that you mention it. I'm reasonably certain that he has the capacity to make me something by the box. I suppose that's something to look into and might turn out to not just be viable but might turn into a business idea for him. I believe he has a special molder for making the zipper closure things. As he knows my daughter, I should have her contact him. She can con him out of a few dollars too.

      Even further off-topic, I've been to his factory. It's actually not a big thing and is kind of neat to see how they're made. They use either heat or ultrasound to seal them and the machines are really versatile. You basically just program them, it's a bit like CAM. I seem to recall that they're smart enough that you can basically feed it a design and it can figure out how to actually make the pieces on its own. 'Tis kind of neat and I'd not thought of that - I'll certainly look into it.

      --
      "So long and thanks for all the fish."
    15. Re:Stick To Cable TV by macs4all · · Score: 1

      Thanks again - I've actually got an acquaintance that makes custom plastic bags, now that you mention it. I'm reasonably certain that he has the capacity to make me something by the box. I suppose that's something to look into and might turn out to not just be viable but might turn into a business idea for him. I believe he has a special molder for making the zipper closure things. As he knows my daughter, I should have her contact him. She can con him out of a few dollars too.

      Even further off-topic, I've been to his factory. It's actually not a big thing and is kind of neat to see how they're made. They use either heat or ultrasound to seal them and the machines are really versatile. You basically just program them, it's a bit like CAM. I seem to recall that they're smart enough that you can basically feed it a design and it can figure out how to actually make the pieces on its own. 'Tis kind of neat and I'd not thought of that - I'll certainly look into it.

      Do me a favor and DON'T tell me. I am sick-to-death of seeing one-after-another of my ideas on store shelves!!! (That is, unless you want to factor me in for some shares of the resulting business...)

      Yeah, I actually went pretty far with the idea, actually, researching the best material, contacting several plastic-bag manufacturers, registering a Domain-name, etc.; but I was really broke at the time (got laid-off from my embedded Design job during the 2009 recession), and couldn't even afford a minimum run for a custom-sized bag. Note that the Orange Chef ones are NOT made from PE (Polyethelene); but rather some sort of Polycarbonate (Mylar) film. That is because it is glass-clear.

    16. Re:Stick To Cable TV by macs4all · · Score: 1

      I suppose that's something to look into and might turn out to not just be viable but might turn into a business idea for him.

      I also forgot that one of the things that took the wind out of my sails for that idea was that I found a Patent that would DEFINITELY be conflicting. I can't find it right now at work; but I'm sure I have it archived at home.

    17. Re:Stick To Cable TV by KGIII · · Score: 1

      The kinds of things he makes he never even bothers to patent. I've had this discussion with him before. Basically, a patent is useless to him and a waste of money. Making something to do what we're talking about will (not might be) copied by China who can do it cheaper and not give two shits about a patent. His best bet is to get in, do it quick, make his money, and then just get out. Or, less frequently, he just finds and builds a small network of companies and sells to them direct. Basically, you give him dimensions and he's got a product a day later and boxes full in a week. The place doesn't even run 24/7 or anything.

      In your case, he's who you'd probably go to and get a quick order filled if you're low on inventory or just starting out and want to rush to market. If you've got a lot of something or a large market then his company isn't the best choice for you in the long term - it's fine for short term, low volumes, and things like that. By low-volumes we're talking 100,000 units or so. Anything larger? Go to China. He probably won't even take that order or, if he does, he's just going to sub it out to China and communication is cheap today so you might as well do it yourself.

      Basically, you might have used him for the first samples and then the first couple of orders while you waited for them to ramp up in China and get the stuff here on a slow boat. He stores the designs to disk so you can return and have more done. He can do some custom shapes and closure types, those get welded by ultrasound usually. I've offered to help him expand, he's not interested. "I can't compete with China and there's a limit where I'll no longer be as profitable for the amount of work done." Something along those lines. He's probably right.

      Hmm... Network with people. That's my suggestion but, no worries - nobody ever listens to me. ;-) Seriously though, you'd be surprised who you know who knows someone. Hell, I'd have just forwarded an email to him on your behalf in the case of your device. He might have taken the job on 90 day or something. It's not much cost to him and all the equipment is paid for and the factory is already owned entirely. It's mostly a large warehouse and then two smaller sections of equipment and an office with a showroom. That's it. He's got like two fork-lifts and a box truck. I think he's got two employees and they're both family.

      Seeing as I'm already this far off-topic (and rightfully moderated as so up above), I'm actually rather fond of investing in small businesses. I've now got partial ownership of a few of them and all but one has been quite lucrative. Even the one that wasn't really lucrative, I still made out in the end with the assets being sold or kept. Since I sold my company, quite a few of my friends and family have their own small businesses - one as small as making handmade quilts.. I really think that's the way forward.

      Sometime this spring, I am not sure when, I'll be going to Peru to help my son close on a bar/hotel. He's not going to finish school at the moment (he went to Peru, met a native lady, and he's enjoying himself) so he might as well do something besides not being productive. I don't want non-productive kids. I've seen their type. He doesn't drink, it should be a good place for him. Well, he doesn't drink often.

      --
      "So long and thanks for all the fish."
  2. You get what you deserve for using comcast. by Anonymous Coward · · Score: 0

    I would imagine that since it operates in the 2.4 spectrum that there are many situations where radio communication is interrupted and would thus trigger an alarm. More then likely this would happen several times a day, making the alarm useless as people would then not actually think there was an issue but just the system acting up again. So Comcast in their infinite wisdom probably "fixed" the issue by not having it set off the alarm.

    1. Re:You get what you deserve for using comcast. by macs4all · · Score: 3, Insightful

      I would imagine that since it operates in the 2.4 spectrum that there are many situations where radio communication is interrupted and would thus trigger an alarm. More then likely this would happen several times a day, making the alarm useless as people would then not actually think there was an issue but just the system acting up again. So Comcast in their infinite wisdom probably "fixed" the issue by not having it set off the alarm.

      Good point about the 2.4 GHz "pollution" problem, and the fact that the system could NOT be designed to interpret simple loss-of-signal as an intrusion. In fact, the whole idea of wireless sensors in this particular application (at 2.4 GHz, at least) is a mighty dubious one, for this VERY reason.

    2. Re:You get what you deserve for using comcast. by silas_moeckel · · Score: 4, Interesting

      It depends on how long of a loss of signal, a few ms sure a few seconds sure, get to 30 seconds and well you have a problem. And thats assuming that it's a missed poll. Polling a battery powered devices is a battery trade off. Mind you the zigbee wireless is a hell of a lot more secure than what ADT is putting in for wireless. Think remotes that can disarm the system without even rolling key aka 1980's garage door opener.

      --
      No sir I dont like it.
    3. Re:You get what you deserve for using comcast. by macs4all · · Score: 1

      It depends on how long of a loss of signal, a few ms sure a few seconds sure, get to 30 seconds and well you have a problem. And thats assuming that it's a missed poll. Polling a battery powered devices is a battery trade off. Mind you the zigbee wireless is a hell of a lot more secure than what ADT is putting in for wireless. Think remotes that can disarm the system without even rolling key aka 1980's garage door opener.

      So, how long do YOU want to wait before deciding that someone has indeed broken-in?

      And oh yes, don't get me started on the whole insecurity of PIC Keeloq-based security. I developed a keyless-entry system for use with Delivery trucks (think UPS), and I originally started with Keeloq; but quickly changed to using AES-128, once I started reading about the weakness of Keeloq.

    4. Re:You get what you deserve for using comcast. by GSMacLean · · Score: 1

      It has to work this way. Otherwise your alarm would be going off every time you turned on the microwave oven. Wireless security systems are inherently secure. I refuse to use them in my house.

    5. Re:You get what you deserve for using comcast. by sjames · · Score: 1

      The problem isn't that it won't report a problem while interference has the radio links down (that is an issue with any wireless system). The problem is that once the interference clears up, it will continue to believe all's well for some time after.

    6. Re:You get what you deserve for using comcast. by Anonymous Coward · · Score: 0

      The bigger problem is relying on a security system that can be disabled by snipping a cable either in front of the house or several houses down (for example the cable box in front of my house serves 4 houses). Now, I don't know the current details on Xfinity home - cutting the cable line may well still allow the alarm to activate. But it certainly isn't going to notify anyone (Comcast's monitoring office, the police, the home owner) that there was a break in. Other systems use (for example) Verizon's cell network to report so that they cannot be disabled so easily.

    7. Re:You get what you deserve for using comcast. by Anonymous Coward · · Score: 0

      It's a trade off with battery life. You can't claim 3 years of battery life if you need to send a heartbeat every second, even with Zigbee radios. It would need a much bigger battery for that. Either way, a wired sensor is a better solution. The real problem is how home builders haven't really considered how much more useful connected devices can be for the homeowner for like the past 20 to 30 years. Which sucks, wireless devices are just a band aid to poor home design.

    8. Re:You get what you deserve for using comcast. by nehumanuscrede · · Score: 1

      The bigger problem is relying on a security system that can be disabled by snipping a cable either in front of the house or several houses down (for example the cable box in front of my house serves 4 houses). Now, I don't know the current details on Xfinity home - cutting the cable line may well still allow the alarm to activate. But it certainly isn't going to notify anyone (Comcast's monitoring office, the police, the home owner) that there was a break in. Other systems use (for example) Verizon's cell network to report so that they cannot be disabled so easily.

      Cutting the broadband cable won't do anything for you.

      The Xfinity flavor ( as well as most others ) contain a cellular backup within the unit to utilize in the event the broadband connection dies.

      Broadband connectivity is determined via periodic heartbeat packets coming and going to the monitoring system.

      So, while you can cut the cable, you'll also need a cellular jammer based on whatever flavor of cellular they're utilizing. Most homes using this level of alarm tech aren't worth going through all this trouble to break into to begin with.

    9. Re:You get what you deserve for using comcast. by sjames · · Score: 1

      Constant checking in will kill battery life, but the problem is that they don't remain in the alarm state. That would also cause battery wear, but only in the event of a break in.

      A wired system is more secure but not always practical as a retrofit. Of course, most home alarms depend on most criminals being dumb.

    10. Re:You get what you deserve for using comcast. by silas_moeckel · · Score: 1

      I use wired zones for my perimeter, I have some wireless motion but thats more belt and suspenders for the security side and drives the HA system.

      This is all about getting something dirt cheap to install and maintain to meet the requirements for the homeowners policy discount.

      --
      No sir I dont like it.
    11. Re:You get what you deserve for using comcast. by phantomfive · · Score: 1

      It depends on how long of a loss of signal, a few ms sure a few seconds sure, get to 30 seconds and well you have a problem.

      Then someone turns on the microwave for 10 minutes to cook a frozen pizza......

      --
      "First they came for the slanderers and i said nothing."
    12. Re:You get what you deserve for using comcast. by Anonymous Coward · · Score: 0

      Wireless security systems are inherently secure.

      I think you accidentally a prefix.

    13. Re:You get what you deserve for using comcast. by silas_moeckel · · Score: 1

      If you alarm is armed away who would be running a microwave?

      --
      No sir I dont like it.
    14. Re:You get what you deserve for using comcast. by mysidia · · Score: 1

      Mind you the zigbee wireless is a hell of a lot more secure than what ADT is putting in for wireless.

      Personally; I think a Keyfob is crappy security, regardless of the system used ---- unless its functions are essentially limited to "Force Arm" and "Panic".

      Keyfobs can be lost, misplaced, stolen, or a criminal can forcibly take it from you, or force you to disarm using it.

      Combinations do not suffer from these security issues; and if forced to disarm, modern panels allow durress codes to be pre-programmed.

      Last I check; ADT is just using rebadged Honeywell/VISTA Ademco panels, which they rebadge, and possibly use custom firmware on.

      The Honeywell 5883H security panel RF module is capable of supporting secure two-way wireless keyfobs, and the Honeywell 5834-4 is a high-security keyfob that uses two-way radio and encrypted challenge+response, and can check current arming status.

    15. Re:You get what you deserve for using comcast. by Slashdot+Junky · · Score: 1

      A pizza should never be cooked by microwaves. Now, if the "microwave" happens to be a combination unit also supporting, perhaps, convection cooking, it is okay to use the "microwave" to cook the thing. The bonus of cnvection cooking is that having a slice or three doesn't have to come at the expense of a home security system failure between the press of start and the ding heard once the timer has counted down.

      --
      .
      Landfill Mining Co.
      Managing the (Un)natural Resources of Tomorrow
    16. Re:You get what you deserve for using comcast. by silas_moeckel · · Score: 1

      What your not supposed to program the disarm button to disarm and send the silent alarm?

      --
      No sir I dont like it.
    17. Re:You get what you deserve for using comcast. by mysidia · · Score: 1

      What your not supposed to program the disarm button to disarm and send the silent alarm?

      This is technically feasible but not recommended. One of the troubles with keyfobs is you put them in your pocket, and the buttons accidentally get pushed: also if the alarm is silent, then you won't know you have accidentally triggered it until the cops show up.

    18. Re:You get what you deserve for using comcast. by TarPitt · · Score: 1

      BTW, the presentation at BlackHat about serious flaws in ADT's security was pulled due to legal pressure from vendors: Two more talks pulled from Black Hat hacking conference

      The paper, however, may be found here

      --
      If your children ever found out how lame you are, they'd murder you in your sleep
    19. Re:You get what you deserve for using comcast. by AmiMoJo · · Score: 1

      There are wireless bands reserved for alarms in Europe, and presumably the US too but I have not checked. Cheap systems don't use them because they need certification to ensure that they don't interfere with other alarms.

      Using 2.4ghz is beyond dumb. Then again the UK is trying to use it for meter reading too, and unsurprisingly it doesn't work very well.

      --
      const int one = 65536; (Silvermoon, Texture.cs)
      SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
    20. Re:You get what you deserve for using comcast. by Anonymous Coward · · Score: 0

      What? You're not supposed to program the disarm button to disarm and send the silent alarm?

      FTFY

    21. Re:You get what you deserve for using comcast. by silas_moeckel · · Score: 1

      Well for me in a small town thats not a big deal grew up with most of them, might have to produce some decent coffee. Being on a keychain they are not hitting a pocket till I'm parked and well out of range.

      --
      No sir I dont like it.
  3. Not Zigbee's Fault, either by macs4all · · Score: 2

    I have done some development (albeit limited) using a Zigbee stack, and this failure has nothing to do with the Zigbee protocol, per se. That "explanation" sounds like some of the project-engineers trying to pull the wool over the eyes of Comcast's management (and Customers).

    1. Re:Not Zigbee's Fault, either by phantomfive · · Score: 0

      It's something that's basically guaranteed to happen: when you hear the words "Comcast Software" you don't think "oh, that's really going to be secure" because they are a company that focuses on cutting costs primarily.

      If you want secure software, you need to start from the bottom up: even the most junior programmers need to be thinking about security, every time they write a line of code. Security isn't something that can be bolted on after the fact.

      If you think of Comcast's management style, you can be certain the managers are not training their new, junior programmers to think about security every time they write a line of code, but that is what it takes.

      --
      "First they came for the slanderers and i said nothing."
    2. Re:Not Zigbee's Fault, either by dpidcoe · · Score: 2

      Yeah, it's not a Zigbee issue. It's an issue with using a wireless signal on an overcrowded and highly competitive spectrum to perform a mission critical communication task.

      To make a car analogy, it's like blaming ford for making a shitty car because you tried to put 8 tons of bricks in your focus and the suspension failed.

    3. Re:Not Zigbee's Fault, either by Shoten · · Score: 1

      I have done some development (albeit limited) using a Zigbee stack, and this failure has nothing to do with the Zigbee protocol, per se. That "explanation" sounds like some of the project-engineers trying to pull the wool over the eyes of Comcast's management (and Customers).

      It has a little to do with ZigBee, since ZigBee as a standard uses 2.4 GHz. Beyond the part of spectrum that ZigBee uses, there's nothing else about the protocol that is a problem here...but there's no such thing as a ZigBee implementation that exists outside the 2.4 GHz public spectrum band.

      On the other hand, the issue here is an interesting one. ZigBee's actually a pretty secure protocol for communications, with regard to integrity and confidentiality. But for applications that depend upon availability, it's something that you could jam with a baby monitor, a wifi AP or a cordless phone. I wouldn't expect Comcast to come up with a home-grown solution that was nearly half as secure as ZigBee, and I also can't imagine that it could be worth it to license a piece of spectrum just for their solution; it would cost too damn much. So where does that leave all of us when it comes to this kind of use case?

      --

      For your security, this post has been encrypted with ROT-13, twice.
    4. Re:Not Zigbee's Fault, either by grahamsz · · Score: 2

      It's mostly to do with the low battery utilization of zigbee sensors. From what I can tell of the ones I have in my house, they basically use a reed relay to trip an interrupt on the microcontroller that causes it to transit that the sensor state has changed. In sleep mode then seem to run about a year on a coincell so it's obviously not in regular radio communication with the base station.

      Obviously the sensors could wait for acknowledgement of their state change and otherwise continue sending it until they come, but that'd also mean if the base station was offline for a few days all the batteries in the sensors would be dead. Even in that case you could still disrupt the sensor by wrapping it in foil.

      Despite all that it's still likely fine for a home security system. I highly doubt the average crooks would use a radio jammer or take the time to wrap sensors in tin foil. For most home owners the deterrent value is just fine.

    5. Re:Not Zigbee's Fault, either by macs4all · · Score: 1

      On the other hand, the issue here is an interesting one. ZigBee's actually a pretty secure protocol for communications, with regard to integrity and confidentiality. But for applications that depend upon availability, it's something that you could jam with a baby monitor, a wifi AP or a cordless phone. I wouldn't expect Comcast to come up with a home-grown solution that was nearly half as secure as ZigBee, and I also can't imagine that it could be worth it to license a piece of spectrum just for their solution; it would cost too damn much. So where does that leave all of us when it comes to this kind of use case?

      I dunno; especially considering the limited frequency-bands available with no licensing requirement. It sounds a bit ignorant, but considering we're talking about an indoor application, it almost seems like a "ZigBee-esque" mesh-network of infrared transceivers would be better for this, and no steenking FCC to worry about.

      Then, the only thing you have to worry about is sunlight bringing down your network...

      This is one of the reasons why it is a shame that the Echelon LONTalk protocol didn't really catch on in the home automation space (and because the development tools were RIDICULOUSLY expensive); because it is media-agnostic. It simply doesn't care if you use microwaves or smoke-signals to transfer packets; so long as the information is decode-able.

    6. Re:Not Zigbee's Fault, either by Darinbob · · Score: 1

      Ture, but the Zigbee protocol is pretty ugly in a lot of places (SEP 2.0 that is). Low speed link yet binary data is transmitted using XML? Ludicrous.

    7. Re:Not Zigbee's Fault, either by macs4all · · Score: 1

      Ture, but the Zigbee protocol is pretty ugly in a lot of places (SEP 2.0 that is). Low speed link yet binary data is transmitted using XML? Ludicrous.

      I agree. I think that a fair amount of things about ZigBee are somewhat under-planned; but this stuff still isn't ZigBee's fault. Other than the fact that they picked a VERY crowded RF band upon which to hitch their entire concept.

    8. Re:Not Zigbee's Fault, either by AmiMoJo · · Score: 1

      A year on a coin cell would give you enough energy to send a ping say once a minute. I do this stuff for a living, it's surprising how little energy you need.

      Sending a ping now and then is essential, because otherwise the battery could die or the sensor fail and you wouldn't even know.

      --
      const int one = 65536; (Silvermoon, Texture.cs)
      SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
    9. Re:Not Zigbee's Fault, either by goose-incarnated · · Score: 1

      A year on a coin cell would give you enough energy to send a ping say once a minute.

      Depends on the transmission power requirements. Doubling the distance between transmitter and receiver generally means quadrupling the power output; noise of any sort (refrigerator motor, microwave, baby-monitor) causes retransmits, temperature deviations might affect battery performance, false-positives occur more often than expected, etc. In general take your best estimate of battery-life under perfect conditions, then halve it.

      --
      I'm a minority race. Save your vitriol for white people.
    10. Re:Not Zigbee's Fault, either by grahamsz · · Score: 1

      Can you recommend a zigbee sensor that can do that? I'd love one, and like you agree that it's probably possible on paper but in reality i've tried a few and haven't found anything that can deliver that from a coin cell.

  4. do people expect these things to work? by known_coward_69 · · Score: 1

    i thought their only purpose was so that your home insurance company will cover your home

    1. Re:do people expect these things to work? by geekmux · · Score: 1

      i thought their only purpose was so that your home insurance company will cover your home

      Ironically, you just answered your own question as to the people that would give a shit about the actual functionality.

  5. werd by Anonymous Coward · · Score: 0

    ADT for life

    1. Re:werd by nehumanuscrede · · Score: 1

      ADT for life

      FYI, even ADT has switched to wireless sensor setups. My parents house is outfitted with them.

  6. This is why... by mindwhip · · Score: 2

    This is why wireless is such a bad idea in many situations... wired allows for so much more tamper proofing and overall security.

    --
    [The Universe] has gone offline.
    1. Re:This is why... by Anonymous Coward · · Score: 0

      A wired solution that reported "everything is ok!" if you cut the wires or the power went out would be equally stupid.

      The problem isn't related to wireless, the problem is related to the engineers designing a "security" system not understanding that "security" means it needs to take into account attackers trying to defeat it who have access to things like tin foil and wire cutters.

    2. Re:This is why... by Fly+Swatter · · Score: 1

      I think it is related to wireless. Wireless WILL get interference from time to time disrupting communications. If it 'failed safe' there would be so many false alarms it would be either a) useless and/or b) non-profitable constantly responding to false alarms. They chose the marketable and profitable route.

    3. Re:This is why... by dpidcoe · · Score: 1

      A wired solution that reported "everything is ok!" if you cut the wires or the power went out would be equally stupid.

      It would actually be more stupid to do that with a wired solution. The reason they likely did it that way with the wireless solution is because they didn't want to trigger false alarms every time the neighbor turns on their old badly shielded microwave. A wired system doesn't even have that excuse.

    4. Re:This is why... by phantomfive · · Score: 1

      A wired solution that reported "everything is ok!" if you cut the wires or the power went out would be equally stupid. The problem isn't related to wireless

      With a wired solution, you need to actually cut the wires and have physical access. With a wireless solution, an attacker can use a jammer to break the connection.

      Most likely the developers did this because with wireless, there would be so many false alarms of the connection being broken, that it was just annoying for the users (That's not an excuse, they still should have put a notice somewhere that the connection had been broken, even if they didn't turn on the alarm and automatically call the police).

      --
      "First they came for the slanderers and i said nothing."
    5. Re:This is why... by mlw4428 · · Score: 1

      How so? It's all in the design of the system. The way around this would be an authenticated "heart-beat" type setup wherein I tell you that I'm OK until I don't tell you I'm OK. In that case it becomes the monitoring center's responsibility to dial the police. Instead from what I've surmised the system is designed so that it's mostly a "I'm OK unless I say otherwise", which is poor design. The medium of communication has nothing to do with it.

    6. Re:This is why... by GateGuy · · Score: 1

      A wired solution that reported "everything is ok!" if you cut the wires or the power went out would be equally stupid.

      A good wired solution would use supervised alarm circuits. These have a resistors incorporated into the circuit, usually one in series and one parallel.

      In this manner cutting the wires would produce a true open. Twisting the wires together would show a true closed. In normal operation neither of those two conditions would exist.

      --
      Maryland State Motto: If you can dream it, we can tax it.
    7. Re:This is why... by Anonymous Coward · · Score: 0

      Yes, but wireless is SOOO convenient.

    8. Re:This is why... by nehumanuscrede · · Score: 1

      A wired solution that reported "everything is ok!" if you cut the wires or the power went out would be equally stupid.

      A good wired solution would use supervised alarm circuits. These have a resistors incorporated into the circuit, usually one in series and one parallel.

      In this manner cutting the wires would produce a true open. Twisting the wires together would show a true closed. In normal operation neither of those two conditions would exist.

      In addition, some wired systems actually send pulses or heartbeat style data packets to the supervisory system. Coupled with your resistance setup, tampering with the wiring would be rather difficult indeed.

    9. Re:This is why... by Anonymous Coward · · Score: 0

      Cables might be designed with a shielding and some copper strands that short out when cut/burnt

    10. Re:This is why... by tlhIngan · · Score: 1

      How so? It's all in the design of the system. The way around this would be an authenticated "heart-beat" type setup wherein I tell you that I'm OK until I don't tell you I'm OK. In that case it becomes the monitoring center's responsibility to dial the police. Instead from what I've surmised the system is designed so that it's mostly a "I'm OK unless I say otherwise", which is poor design. The medium of communication has nothing to do with it.

      Indeed.

      In fact, the wireless sensors I've seen (900MHz based ones) operate on a 4 state system - contact open, contact closed, heart-beat, low battery. One of those must be reported periodically and the receiver must make sure all the sync'ed devices check in periodically (usually at least once a minute). The devices are sync'ed to the receiver in case your neighbour has the same system, and also to provide proper reporting of state (e.g., if the sensor is motion, you need to be notified it's motion so ignore it when in "armed at home" mode).

      If a sensor battery needs changing, it sends the low battery heartbeat which causes the system to report which sensor has a low battery. If a sensor hasn't been heard from, then it's a fault and reported to the security company who calls you.

      None of this uses ZigBee - wireless alarm sensors have been around a while. And the manuals from all of them I've seen send a heartbeat signal.

    11. Re:This is why... by antdude · · Score: 1

      It's not hard to cut the lines. ;)

      Wireless (e.g., cellular) is harder though.

      --
      Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
    12. Re:This is why... by mrchaotica · · Score: 1

      Not only is that not an excuse, that's a tacit admission that a "wireless security system" is an oxymoron and a fruitless endeavor, and marketing a product as such is tantamount to fraud.

      --

      "[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz

  7. Is anybody surprised? by gstoddart · · Score: 0

    Why would you trust your fscking cable company to be your security alarm? What makes you think they have any expertise in this field?

    I find this stuff to be mostly self-inflicted stupidity on behalf of consumers.

    Every week we see yet another story indicating that consumer electronics have absolute garbage security, and are rushed out the door by people do don't give a crap about your security.

    All this smart home crap, and all of this home monitoring crap pushed by your cable company? It's stuff being rushed to market by assholes in marketing. They either don't do security at all, or they do it incompetently.

    Until companies bear some legal liability, which their lobbyists will ensure they never do, there's only one sensible option: Assume every damned Internet of Shit product which comes along is so massively insecure as to be dangerous.

    Because in all likelihood it is.

    This shit is more about selling you product and gathering marketing and analytics data than it is about your damned home security. Just because some idiot slapped on a shoddy wifi connection and wrote an app for your phone doesn't mean they're selling you anything other than snake oil.

    You want an alarm? Go with a proper alarm company with actual experience in the field.

    Every single day I'm forced to conclude the internet of stuff and the appification of the world is a bloody waste of time and money. And they have an EULA which basically says "we're not responsible no matter how grossly incompetent we are".

    Now, get off my damned lawn as I continue to keep most of my things in the analog world and not give a shit if you get hacked or not.

    --
    Lost at C:>. Found at C.
    1. Re:Is anybody surprised? by phantomfive · · Score: 1

      All the development methodologies of the last few decades have been primarily focused on how to get software out the door quicker: Agile, RAD, Extreme Programming, etc are focused on faster (of course, there are exceptions: NASA for example always tries to make things more reliable, other researchers have looked at that too, but the mainline software industry has mostly ignored reliability).

      The reality is, if you want secure software, every programmer needs to be thinking about security. It's not something you can bolt on after the software is written. You can't have a "Red Team" who tries to fix things later (although that can be a secondary layer of security). Companies don't think about security until they are big enough to be a target, which is obviously a problem.

      We need a new development methodology based on security.....instead of RAAD call it RAADT after a certain contentious developer......

      --
      "First they came for the slanderers and i said nothing."
    2. Re:Is anybody surprised? by gstoddart · · Score: 1

      Well, I will say the general issue here is people are willing to accept shit security for a shiny bauble. And that's their own damned problem.

      Until companies bear real legal liability for being incompetent at implementing security, I am going to assume that every new product which wants to connect to the internet is a steaming pile of shit I have no interest in.

      If you can open your door from your cell phone, someone else can too. And there's a very good chance it's so damned trivial to bypass that it would be scary.

      You won't see a culture of development as being highly focused on security until corporations bear legal liability for it. As long as they don't, you pretty much have to assume there is pretty much no security at all.

      Me, I simply don't give a damn about products which want to connect to the internet so I can access them from my phone. Because I see no reason to control my entire life from my phone or the internet.

      What everyone else does ... not my damned problem.

      I'm just simply not going to act like I have any sympathy anymore. What the world needs right now is a lot more bitter old men giving their best Nelson "Ha ha!" when this shit happens. Maybe shame will finally work where trying to explain the problem has failed.

      --
      Lost at C:>. Found at C.
    3. Re:Is anybody surprised? by Anonymous Coward · · Score: 0

      The reason people trust the cable company is that they don't think about it. They just receive ads in the mail and the cable company has staff to "install" and so it gets done. A company that ONLY did security installs has higher overhead and must actually provide a useful product. A cable company's only cost is the extra sheet of paper in the daily ad mailer about bundling or adding more crap to your cable package.

    4. Re:Is anybody surprised? by Anonymous Coward · · Score: 0

      All the development methodologies of the last few decades have been primarily focused on how to get software out the door quicker:
      Partially, but not really.

      Development methodologies focus on speed of the development as well as producing the right thing for the right job. If security is part of what "the right thing" is, then the methodology will produce it. If it's not, then it won't.

      We need a new development methodology based on security
      Hmm... I just don't think it's really a methodology problem, but a cultural one. You can't just plug in a methodology and expect people to suddenly care about security.

    5. Re:Is anybody surprised? by phantomfive · · Score: 1

      Development methodologies focus on speed of the development as well as producing the right thing for the right job. If security is part of what "the right thing" is, then the methodology will produce it. If it's not, then it won't.

      Nope. You can tell what from the name what they are focused on. "Agile" is focused on quickly responding to customers, RAD is focused on Rapid application development, for example.

      Every development methodology claims to "produce the right thing," even teams without any methodology, even waterfall claims that. That is not unique to any methodology, they all do that.

      --
      "First they came for the slanderers and i said nothing."
    6. Re:Is anybody surprised? by Anonymous Coward · · Score: 0

      The part that surprises me is how cable companies can expand into content, broadband internet, and home security, but still manage to be considered and labeled as "cable companies". Time Warner Cable has a similar offering and I don't even want to deal with them for a cable TV connection let alone home security. I wonder if they'd throttle your home security data if you watched too many movies this month.

      Though being a cable company that you pay to watch your home opens up some unique targeted advertising opportunities. I'm sure they can extract a lot of info from even camera feeds pointed away from your home. The demographics of your family, your local climate, what cars you drive, what sports you like, how many vacations you take, do you have pets, employment changes...

    7. Re:Is anybody surprised? by phantomfive · · Score: 1

      I just read this story which suggests that consumers are starting to avoid IoT stuff because of security concerns. So that might cheer you up (a bit) on a rainy, dreary morning.

      --
      "First they came for the slanderers and i said nothing."
    8. Re:Is anybody surprised? by mrchaotica · · Score: 1

      What everyone else does ... not my damned problem.

      I was with you up to this point. While I wish I could ignore all the shitty decisions other people make, it still affects me because the good choices I want to make become more difficult or impossible. For example, it's probably no longer possible to buy a new car that doesn't spy on you. Even if I keep driving antique cars myself, sooner or later that fact would make me stand out enough that I become trackable anyway.

      --

      "[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz

  8. False Positive nightmare by captaindomon · · Score: 1

    You need to look at the rate of false positives vs. false negatives. If they took the fail-alert approach, for every true security breach, Comcast would be responding to thousands of "my microwave interrupts my WiFi when it runs" etc. This would further impact response times to true security breaches due to cry wolf issues. So is it secure? Yeah not really. Is this the correct business choice for Comcast? Probably.

    --
    Just because I can hook a shark from a boat, I do no offer to wrestle it in the water.
    1. Re:False Positive nightmare by macs4all · · Score: 1

      You need to look at the rate of false positives vs. false negatives. If they took the fail-alert approach, for every true security breach, Comcast would be responding to thousands of "my microwave interrupts my WiFi when it runs" etc. This would further impact response times to true security breaches due to cry wolf issues. So is it secure? Yeah not really. Is this the correct business choice for Comcast? Probably.

      If they would just develop an equivalent system that used the 5.4 GHz band, they could get away from the insane 2.4 GHz pollution issues, and thus increase the reliability (and thus trustworthiness) of their RF-link several-fold. THEN they could develop their "intrusion rules" around something that was nearly as foolproof as a hard-wired connection. Note that I said "nearly"...

    2. Re:False Positive nightmare by JeffOwl · · Score: 1

      So why not do what competent alarm companies do an create a third state called "fault" which indicates that there is a problem but not necessarily a break in? This is just a side effect of Comcast not being a security company but trying to be all things to all people and doing none of it well.

    3. Re:False Positive nightmare by geminidomino · · Score: 1

      Is this the correct business choice for Comcast? Probably.

      Not any more so than replacing the doors of their corporate offices with bead curtains and rice paper.

      If a flaw this basic is inherent in a wireless approach, then the right business choice is you don't use the wireless approach.

    4. Re:False Positive nightmare by Anonymous Coward · · Score: 0

      Is this the correct business choice for Comcast? Probably.

      If a flaw this basic is inherent in a wireless approach, then the right business choice is you don't use the wireless approach.

      Not exactly.

      Not using this product is the correct choice for YOUR business, as you desire security and this does not provide it (and arguably actively harms it)

      Not selling this product is very likely the Wrong business choice for Comcast however, as they desire money and you to give it to them.
      This "product" existing, being sold, and used (even in its failed state as such) makes them more money than if they did not sell it and got nothing.

      Refer to "snake oil salesmen" - clearly from the point of view of the snake oil salesman, selling you nothing in exchange for your real money is the correct choice for the goal of "making money easily" - which still remains completely at odds with your own point of view in wanting something of value, and ideally something that does what it claims to do, in exchange for as little money of yours as possible.

      Same thing.

    5. Re:False Positive nightmare by mrchaotica · · Score: 1

      So is it secure? Yeah not really. Is this the correct business choice for Comcast? Probably.

      It's only the correct business choice because companies are no longer held accountable for products that are blatantly not fit for purpose, but fraudulently marketed as such.

      --

      "[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz

    6. Re:False Positive nightmare by geminidomino · · Score: 1

      That assumes there's no value in not being known as a snake-oil salesman.

  9. some died due to comcast poor installers by Joe_Dragon · · Score: 1

    http://www.inquisitr.com/15151...

  10. WHO CARES ABOUT THIS, MY DOORS ARE OPEN by Anonymous Coward · · Score: 0

    My backdoor, Slashdot brethren VIOLATE MY ANUS

  11. Home Monitoring != Home Security by Anonymous Coward · · Score: 0

    It's positioned as "home monitoring" not "home security".

    I doubt any insurance company would consider this as home security being discount worthy.

    Rogers in the great white north of Canuickstan has the same scam, but uses cellular protocols/gsm and bills you up the wazoo.

  12. I wouldn't trust Comcast with anything important by XxtraLarGe · · Score: 1

    We've had them for years for cable, phone & internet. Then we dropped our land line, and they actually wanted to increase our phone bill when we wanted the service stopped! They said we paid less for all 3 services because of the "triple play discount", so it cost more for cable & internet than it cost for cable, internet & telephone. It wasn't until I threatened to leave that they took that off of our service and dropped our bill by $10. Then, to save more money, we got rid of our extra cable boxes ($10 each) and replaced them with digital converters for our upstairs TVs ($ each). After I installed them, they didn't work. So I called, the tech fixed it on their end, so we could watch TV in bed. Of course, when they "fixed" that problem, they "accidentally" turned off my DVR service. Then we got a notice saying we were not being billed correctly, and they boosted the price back up to $10 for each converter. Called & argued with them again. They fixed the price. Then the devices stopped working again. Called again, and now neither the converters OR the DVR is working. So now I have to have a tech come to my house. I almost have to believe they are doing it on purpose at this point, but WOW !!! I wonder how much Comcast wastes per year fixing things they screwed up on the previous tech support call? In some instances above, I did use chat, which is a semi-improvement, but only by a little. <\rant>

    --
    Taking guns away from the 99% gives the 1% 100% of the power.
  13. Xfinity doesn't leave doors open by wonkey_monkey · · Score: 2

    Comcast's Xfinity Home Security Flaw Leaves Doors Open

    No, people leave doors open. Xfinity just sucks at warning you about it.

    --
    systemd is Roko's Basilisk.
    1. Re:Xfinity doesn't leave doors open by Anonymous Coward · · Score: 0

      That's what I was thinking when I saw the headline about home security and leaving doors open.

  14. Re:I wouldn't trust Comcast with anything importan by Anonymous Coward · · Score: 0

    That's all the BS consumer pricing plan crap they all pull - AT&T does the same. And the introductory rate bullshit is done by all.

    And the other shitty thing is that you're lock into a 2 year or more agreement but if the give you shitty service or none at all, well fuck you pay me! Don't pay? Well, fuck you off to collections! Try to sue? Well, fuck you off to industry stacked forced binding arbitration that will rule in their favor.

    They are unethical mother fuckers and I do as little business as I can with those fuckers. we need a Teleco version of teh Consumer Financial Protection Bureau because the FTC and FCC are bought and paid for by the ISPs and Telcos..

  15. Tradeoffs. by Anonymous Coward · · Score: 0

    Wireless communications are prone to failure. That's the nature of wireless. The alternative here is to report a bunch of false alarms whenever connectivity is lost. Is that really a good security system?

    So they chose to ignore sensors that go offline. It's pretty reasonable for a home security system to not protect against sophisticated attackers willing to jam wireless signals. It's not like you're trying to protect 640 million in bearer bonds. I'm not saying it takes a genius to jam a wireless home security system. But try to realize that people who rob houses are generally not too bright.

  16. Re:I wouldn't trust Comcast with anything importan by Anonymous Coward · · Score: 0

    Pardon my ignorance, but could you or someone else please explain the difference between a "cable box" and a "digital converter"?

  17. Not a real issue by Anonymous Coward · · Score: 1

    Everyone seems to be jumping on the bash comcast band wagon here but did comcast really cause this kind of problem? The article didn't mention but the sensor check-in message will get missed by the control panel (think heartbeat) and report comm fail. So why would a wireless sensor communication failure triggering a false alarm be a GOOD thing? If you consider the fees some local governments charge for false alarms, the strict federal regulations preventing false alarms, how these systems handle sensor communication failures, and how obviously unrealistic a 24/7 uptime is on a wireless sensor, then this "vulnerability" seems a bit silly. RF is hard, and add to that limitations on size, output power, and battery life. If this were a wired sensor and the line was cut without an immediate effect, then I'd be concerned... but with wireless, I'd rather not pay hundreds of dollars on false alarm fees.

  18. Security Systems by corychristison · · Score: 1

    I spent some time as an installer for a local security company at one point in time.

    I don't know what Comcast is using, but most security systems (wired or wireless) can be configured to be Normally Open, or Normally Closed. Also, some can be configured to fail open or fail safe.

    This could in part be a configuration issue.

    But I also didnt read the article. Just speculating... haha

  19. They do that for a reason. by Lumpy · · Score: 1

    Because the damn thing would be non stop false alarms if they did. Zigbee is NOT reliable enough for an alarm system.

    --
    Do not look at laser with remaining good eye.
  20. Re:I wouldn't trust Comcast with anything importan by XxtraLarGe · · Score: 1

    Pardon my ignorance, but could you or someone else please explain the difference between a "cable box" and a "digital converter"?

    A cable box decodes both HD & SD signals and sends them to your TV. A digital converter basically only decoded the SD signals. It's also much smaller and doesn't have digital numbers for the channel on it. That's the practical differences, not the technical, but that's all I'm concerned about. From my understanding, the digital converters COULD handle up to 4k transmissions, but we still can't get our HD channels because Comcast.

    --
    Taking guns away from the 99% gives the 1% 100% of the power.
  21. Re:I wouldn't trust Comcast with anything importan by XxtraLarGe · · Score: 1

    you're lock into a 2 year or more agreement

    I have no contract, I'm month-to-month. It allows me to make changes fairly easily. Oh, I forgot that the most recent thing I did was buy my own Netgear N600 Wifi Cable Modem Router. It cost me $95, but will save me $10 a month, so it pays for itself in under a year. Of course, getting that set up was another ordeal. I followed the instructions, got a success message on Comcast's page, and still had to call tech support. Couldn't do chat, because the only time I could connect to the internet was by going through the Comcast modem setup page. It was literally the only page that worked. Took a half-hour phone call to get it working correctly.

    --
    Taking guns away from the 99% gives the 1% 100% of the power.
  22. Constant ABUSE. Now calls itself "Infinity". by Anonymous Coward · · Score: 0

    Comcast voted the 2014 "Worst Company In America".

    When there is a lot of abuse, people make distracting comments, rather than trying to stop the abuse.

  23. IoaYTGS by Hognoxious · · Score: 1

    Welcome to the IoaYTGS - Internet of all Your Things Got Stolen.

    --
    Confucius say, "Find worm in apple - bad. Find half a worm - worse."
  24. Communications disruption can mean only one thing by Anonymous Coward · · Score: 0

    Rapid7's Phil Bosco discovered that the Xfinity Home Security system does not fail closed with an assumption of an attack if radio communications are disrupted.

    ... home invasion.

    https://www.youtube.com/watch?v=eF4Hcr7XX3c

  25. Current Customer by Anonymous Coward · · Score: 0

    I hate the triple play package... its a trap.

    $600 to exit contract when they fail to deliver satisfactory service... ADP is soooooo much better and easier.

  26. Other Vendors Impacted ? by nehumanuscrede · · Score: 1

    Most of the newer alarm system offerings have switched over to wireless sensors vs the old school method of hard-wiring them.

    ( Hard wire is the way to go, but you really need to do it as the home is being built. Trying to retrofit a wired system after is a major undertaking. )

    I'm curious to know if the other vendors using wireless sensors also suffer from the same vulnerabilities as the Xfinity one does. ( ADT, AT&T Digital Life, etc. )

  27. It spreads to all products... by SeaFox · · Score: 1

    This would be the same Comcast that makes your cableco-provided wireless modem/router combo broadcast a second public wi-fi network by default? Sounds like Comcast will cause open back doors in the both physical and metaphorical sense.

  28. Xfinity? by ceoyoyo · · Score: 1

    That's the company that sends me e-mail notifications for someone's alarm system. The notifications contain the person's first name, street address, a timestamp and what the action was (alarm armed, disarmed, armed stay, alarm, etc.). There only return address is unmonitored and xfinity.com doesn't seem to have any contact information.

    Seems like a legit operation.

  29. Best security system by MitchDev · · Score: 1

    Loyal, protective dogs, big ones...

    1. Re:Best security system by phantomfive · · Score: 1

      You can shoot dogs, or poison them, or bribe them with meat.
      No one is going to think your house is being broken into, just because a dog is barking.

      --
      "First they came for the slanderers and i said nothing."
    2. Re:Best security system by goose-incarnated · · Score: 1

      You can shoot dogs, or poison them, or bribe them with meat. No one is going to think your house is being broken into, just because a dog is barking.

      The smartest AI in the world is still orders of magnitude dumber than an untrained guard dog.

      Sure, you can poison dogs, but only one at a time, thereby making it slower to break in. You can shoot dogs, but that just alerts everyone within earshot. You can try bribing my rottweilers with meat, but I don't think it will be very successful - they've remained quite hostile to strangers after eating the stranger's meat in the past.

      I'm in the crime capital of the world (probably), and the only times I've ever been broken into was when I had no dogs, because... (say it with me)

      Even an untrained guard dog is a larger hurdle to cross than the smartest home security system.

      --
      I'm a minority race. Save your vitriol for white people.
    3. Re:Best security system by MitchDev · · Score: 1

      All that matters is that the person trying to break in hears the dogs. Shooting a dog makes a LOT of noise. You have to get in the house to poison them, and that's assuming the owner or family members aren't there to catch you in the act. Your automated system is not perfect either, NO system is. I find your comments disingenuous at best.

    4. Re:Best security system by MitchDev · · Score: 1

      Plus dogs have a lot on non-security benefits too :)

    5. Re:Best security system by phantomfive · · Score: 1

      I find your comments disingenuous at best.

      I know people who've had their dogs shot, so I apologize for your findings.

      --
      "First they came for the slanderers and i said nothing."
    6. Re:Best security system by phantomfive · · Score: 1

      Cool.

      --
      "First they came for the slanderers and i said nothing."
  30. Response time negates the value by Anonymous Coward · · Score: 0

    Alarm systems don't really work -- the response time from breach to cops arriving is way too long to catch anyone. All the burglars caught in our neighborhood are done in by neighbors who follow the burglars when they leave their friends/neighbors house, and the cops then are able to catch them on the road. I used to live in a house with an alarm, and it had a grandfathered 130dB horn in the attic and a loud bell on the outside of the house (nowadays, almost all cities require silent alarms). Everyone on the block knows when the alarm goes off. House was broken into repeatedly. Every time the cops arrived but every time the crooks got away, except the one time the neighbor followed the pickup because he knew it wasn't ours. Buy insurance and keep documents hidden in a safe that is too heavy to move w/o equipment.

  31. Blatant Violation of Net Neutrality by almechist · · Score: 1

    Reading quickly through this thread, with all the comments about whiners wanting something for nothing, it seems to me that most are missing the real story here. The Binge-on plan is supposed to be about getting certain content without it counting against a data cap, that certain providers have worked out a deal with T-Mobile allowing their streams to be “optimized” in exchange for users getting unlimited access. But it turns out that everyone‘s content is being treated the same: it’s all throttled. So what exactly is the point of having only some content providers participate? A select few companies have allowed their names to be used, and have theoretically signed on to the scheme, but those providers' data isn’t being treated any differently then anyone else’s, the data is ALL being throttled! Think about it, all video data on the internet is being treated the same, but only some companies are being given the opportunity to serve up unlimited amounts of video. Why? Why just them? I have read that other streaming providers can opt in for free, which if true just makes the unequal treatment worse. By default, T-Mobile is treating video data as if the provider has already agreed to the plan, but only a select few companies are reaping the benefits. From an engineering standpoint, participating companies are doing ABSOLUTELY NOTHING differently than non-participating companies. WTF? Bottom line: ALL VIDEO CONTENT IS BEING THROTTLED, SO ALL VIDEO CONTENT PROVIDERS SHOULD REAP THE BENEFITS! Anything else is a flat out violation of net neutrality. And that’s the real story here.

    1. Re:Blatant Violation of Net Neutrality by almechist · · Score: 1

      cancel above, wrong thread /sigh

  32. Home security device isn't secure from jamming .. by Marcomasino · · Score: 0

    Why didn't such bugs come to light when Comcast tested the device for potential security vulnerabilities. They did test that a home security device was immune to conventional jamming. Either way I wouldn't trust product from them in the future.

  33. These are not Comcast/Xfinity devices by intermelt · · Score: 1

    It is important to note that Comcast is not the manufacturer of these devices. They are also most likely not creating the software for them either. The alarm system is sold by an OEM that several different alarm companies use, including other cable companies.

    The system also isn't just using ZigBee for communication, it is using the ZigBee Home Automation standard. ZigBee has defined how they want home security and automation products to communicate over their ZigBee radio standard. So this isn't just related to Comcast. I would think that just about every other system out there using ZigBee for home security would have the same problem. So this is a bigger problem than just Comcast users.

    I would think a software update could be pushed to the base station that would detect active signal jamming. It could be as simple as checking of the signal level is peaked on all channels with no valid data being detected. It could also be a lot more sophisticated and look at actual received data to determine if it was from a jamming device or possibly matches signatures of known devices that can cause interference.

    I think an ideal solution is adding a beacon that is not dependent on power usage. This beacon would transmit on regular intervals (every second or so). If this signal is not received for a period of time (plus may some other detected conditions), then the system can trigger the desired alarm.

  34. Re:I wouldn't trust Comcast with anything importan by mrchaotica · · Score: 1

    A "digital converter" lets you view a digital signal on an old analog TV. A "cable box" is a bullshit tactic that adds DRM to your cable signal (all it does is replace the functionality of the QAM tuner your TV already has, because the cable company intentionally broke it by encrypting the signal) and inflates the cost by giving the cable company a flimsy excuse to charge extra per-TV fees on top of the already-overpriced subscription itself.

    Cable boxes are an attack on consumers and the FCC should never have allowed them to exist in the first place, especially in light of the Carterfone decision (the principles of which should have been applied to cable TV service just as much as to phone service).

    --

    "[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz

  35. Re:I wouldn't trust Comcast with anything importan by mrchaotica · · Score: 1

    Damn, I screwed up the link. (Actually, it wasn't my fault; Firefox has suddenly stopped including the "http://" in the address bar for non-HTTPS URLs for some reason. WTF, Firefox?) Here's the correct one: http://arstechnica.com/tech-policy/2008/06/carterfone-40-years/

    --

    "[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz