Comcast's Xfinity Home Security Flaw Leaves Doors Open (rapid7.com)

itwbennett writes: Researchers at Rapid7 have disclosed vulnerabilities in Comcast's Xfinity Home Security offerings that prevent the system from alerting homeowners to unsecured doors or windows and would also fail to sense an intruder's motion in the home. The root cause of the problem can be found in the ZigBee-based protocol used by Comcast's system to operate over the 2.4 GHz frequency band. Rapid7's Phil Bosco discovered that the Xfinity Home Security system does not fail closed with an assumption of an attack if radio communications are disrupted. Instead, the system fails open, reporting that all sensors are intact, doors are closed, and no motion is detected.

Comments

Stick To Cable TV

[macs4all]

This is what happens when a company strays too far out of its core (in)competency.

Re:Stick To Cable TV

[bobbied]

I don't know, as a former Comcast customer they seem to have about the same competency in home security as providing cable TV service.

Re:Stick To Cable TV

[mrchaotica]

As an (unfortunately) current Comcast customer (who will jump ship the nanosecond Google Fiber becomes available), Comcast has always been technically competent in my experience. The problem is that they're evil!

Re:Stick To Cable TV

[chipschap]

Of course they are technically competent, they have to be to ensure that they minimize service and maximize ripping off their customers.

Re:Stick To Cable TV

[Zaowulf]

Satan's toenail is still just as evil as the rest of his body.

Re:Stick To Cable TV

[Zero__Kelvin]

My understanding is that imaginary toenails are lawful good, actually.

Re:Stick To Cable TV

[mysidia]

I think those types of vulnerabilities like the one mentioned above are by no means specific to Comcast.

Also, by and large, "experts" and manufacturers in the physical security industry are clueless in regards to IT security, Information security, and Systems security.

Home security companies' core competence is in providing systems to mitigate physical security issues, but they are largely ignorant to specialized attacks and weaknesses in the systems themselves that they provide for the purpose of improving security.

They will probably notice glaringly obvious issues that humans interact with: Such as 1234 as your passcode, Or exposed security wiring without a tamper sensor, but not much more.

And it's probably just White-label hardware and software from the least-expensive source they could find badged with their company name, anyways.

Re:Stick To Cable TV

[macs4all]

She should have been a con artist. I figured you'd be interested and would like to know that, in her professional opinion, they're suitable for use in such environments assuming they're not being kept in complete, sterile, isolation. I expect to know if they can be brought in and put on the network by the end of next week.

Ya know, for someone who isn't an Apple fan, you have probably purchased more Apple gear than the next TEN fanbois, LOL!!!

Your daughter may very well have a promising second-career as a con-artist; but in this particular case, she is right-on.

When the iPad first came out, I was looking into developing a disposable "bag" for just this sort of application. That idea went the way of all my good ideas, and was eventually replaced with another idea of mine for an iPad/tablet "sterilizer" chamber, that would use UV to disinfect one or more iPads/tablets. And of course, charging facilities would be provided, too for charging-while-disinfecting.

iPads are used in thousands of hospitals everyday. Even without the disinfection. In sterile environments, like an Operating Room, they tend to put them in plastic bags (a gallon-ziploc works fine), and yes, the touchscreen does work through the plastic bag. But on the regular "floors", they just treat iPads like a clipboard. No sterilization, no protective sheath/pouch, nothing.

I would say that iPads are probably fairly easy to keep relatively clean (cleaner than a computer keyboard and mouse!!!), simply because there really aren't many cracks and crevices for caked blood, etc, to congregate. The main issue is the Home button, because it gets pressed a zillion times a day, followed by the Sleep/Wake button. But a simple silicone-rubber "boot"-type case would probably work...

Re:Stick To Cable TV

[KGIII]

Yeah, I'm going to be looking into cases for them - preferably ones that can be replaced between patients at minimal expense but the resealable bag is a good idea. I'll have to mention that to her. At this point, I probably should own stock in the damned company. Technically, I once did. I probably should have held onto those shares but I didn't. Ah well... I did not have a lot.

Re:Stick To Cable TV

[macs4all]

Yeah, I'm going to be looking into cases for them - preferably ones that can be replaced between patients at minimal expense but the resealable bag is a good idea. I'll have to mention that to her. At this point, I probably should own stock in the damned company. Technically, I once did. I probably should have held onto those shares but I didn't. Ah well... I did not have a lot.

I would suggest that you ask her to ask her Doctor-collegues what they do for iPad-cases. There is also a guy that sells iPad-sized bags for use in the Kitchen. I think this may be his stuff. I seem to remember that he hinted on his website that he was also investigating branching into medical applications for his iPad-sized bag.

Gallon Ziplocs work; but they are really too big, so you end up doing an annoying "gift-wrap" thing with adhesive tape to keep them from sliding around with your finger. Plus, polyethelene really isn't that clear, and it is kind of static-y. But it works, and Ziplocs are cheap!

Re:Stick To Cable TV

[KGIII]

Thanks again - I've actually got an acquaintance that makes custom plastic bags, now that you mention it. I'm reasonably certain that he has the capacity to make me something by the box. I suppose that's something to look into and might turn out to not just be viable but might turn into a business idea for him. I believe he has a special molder for making the zipper closure things. As he knows my daughter, I should have her contact him. She can con him out of a few dollars too.

Even further off-topic, I've been to his factory. It's actually not a big thing and is kind of neat to see how they're made. They use either heat or ultrasound to seal them and the machines are really versatile. You basically just program them, it's a bit like CAM. I seem to recall that they're smart enough that you can basically feed it a design and it can figure out how to actually make the pieces on its own. 'Tis kind of neat and I'd not thought of that - I'll certainly look into it.

Re:Stick To Cable TV

[macs4all]

Thanks again - I've actually got an acquaintance that makes custom plastic bags, now that you mention it. I'm reasonably certain that he has the capacity to make me something by the box. I suppose that's something to look into and might turn out to not just be viable but might turn into a business idea for him. I believe he has a special molder for making the zipper closure things. As he knows my daughter, I should have her contact him. She can con him out of a few dollars too.

Even further off-topic, I've been to his factory. It's actually not a big thing and is kind of neat to see how they're made. They use either heat or ultrasound to seal them and the machines are really versatile. You basically just program them, it's a bit like CAM. I seem to recall that they're smart enough that you can basically feed it a design and it can figure out how to actually make the pieces on its own. 'Tis kind of neat and I'd not thought of that - I'll certainly look into it.

Do me a favor and DON'T tell me. I am sick-to-death of seeing one-after-another of my ideas on store shelves!!! (That is, unless you want to factor me in for some shares of the resulting business...)

Yeah, I actually went pretty far with the idea, actually, researching the best material, contacting several plastic-bag manufacturers, registering a Domain-name, etc.; but I was really broke at the time (got laid-off from my embedded Design job during the 2009 recession), and couldn't even afford a minimum run for a custom-sized bag. Note that the Orange Chef ones are NOT made from PE (Polyethelene); but rather some sort of Polycarbonate (Mylar) film. That is because it is glass-clear.

Re:Stick To Cable TV

[macs4all]

I suppose that's something to look into and might turn out to not just be viable but might turn into a business idea for him.

I also forgot that one of the things that took the wind out of my sails for that idea was that I found a Patent that would DEFINITELY be conflicting. I can't find it right now at work; but I'm sure I have it archived at home.

Re:Stick To Cable TV

[KGIII]

The kinds of things he makes he never even bothers to patent. I've had this discussion with him before. Basically, a patent is useless to him and a waste of money. Making something to do what we're talking about will (not might be) copied by China who can do it cheaper and not give two shits about a patent. His best bet is to get in, do it quick, make his money, and then just get out. Or, less frequently, he just finds and builds a small network of companies and sells to them direct. Basically, you give him dimensions and he's got a product a day later and boxes full in a week. The place doesn't even run 24/7 or anything.

In your case, he's who you'd probably go to and get a quick order filled if you're low on inventory or just starting out and want to rush to market. If you've got a lot of something or a large market then his company isn't the best choice for you in the long term - it's fine for short term, low volumes, and things like that. By low-volumes we're talking 100,000 units or so. Anything larger? Go to China. He probably won't even take that order or, if he does, he's just going to sub it out to China and communication is cheap today so you might as well do it yourself.

Basically, you might have used him for the first samples and then the first couple of orders while you waited for them to ramp up in China and get the stuff here on a slow boat. He stores the designs to disk so you can return and have more done. He can do some custom shapes and closure types, those get welded by ultrasound usually. I've offered to help him expand, he's not interested. "I can't compete with China and there's a limit where I'll no longer be as profitable for the amount of work done." Something along those lines. He's probably right.

Hmm... Network with people. That's my suggestion but, no worries - nobody ever listens to me. ;-) Seriously though, you'd be surprised who you know who knows someone. Hell, I'd have just forwarded an email to him on your behalf in the case of your device. He might have taken the job on 90 day or something. It's not much cost to him and all the equipment is paid for and the factory is already owned entirely. It's mostly a large warehouse and then two smaller sections of equipment and an office with a showroom. That's it. He's got like two fork-lifts and a box truck. I think he's got two employees and they're both family.

Seeing as I'm already this far off-topic (and rightfully moderated as so up above), I'm actually rather fond of investing in small businesses. I've now got partial ownership of a few of them and all but one has been quite lucrative. Even the one that wasn't really lucrative, I still made out in the end with the assets being sold or kept. Since I sold my company, quite a few of my friends and family have their own small businesses - one as small as making handmade quilts.. I really think that's the way forward.

Sometime this spring, I am not sure when, I'll be going to Peru to help my son close on a bar/hotel. He's not going to finish school at the moment (he went to Peru, met a native lady, and he's enjoying himself) so he might as well do something besides not being productive. I don't want non-productive kids. I've seen their type. He doesn't drink, it should be a good place for him. Well, he doesn't drink often.

Not Zigbee's Fault, either

[macs4all]

I have done some development (albeit limited) using a Zigbee stack, and this failure has nothing to do with the Zigbee protocol, per se. That "explanation" sounds like some of the project-engineers trying to pull the wool over the eyes of Comcast's management (and Customers).

Re:Not Zigbee's Fault, either

[dpidcoe]

Yeah, it's not a Zigbee issue. It's an issue with using a wireless signal on an overcrowded and highly competitive spectrum to perform a mission critical communication task.

To make a car analogy, it's like blaming ford for making a shitty car because you tried to put 8 tons of bricks in your focus and the suspension failed.

Re:Not Zigbee's Fault, either

[Shoten]

I have done some development (albeit limited) using a Zigbee stack, and this failure has nothing to do with the Zigbee protocol, per se. That "explanation" sounds like some of the project-engineers trying to pull the wool over the eyes of Comcast's management (and Customers).

It has a little to do with ZigBee, since ZigBee as a standard uses 2.4 GHz. Beyond the part of spectrum that ZigBee uses, there's nothing else about the protocol that is a problem here...but there's no such thing as a ZigBee implementation that exists outside the 2.4 GHz public spectrum band.

On the other hand, the issue here is an interesting one. ZigBee's actually a pretty secure protocol for communications, with regard to integrity and confidentiality. But for applications that depend upon availability, it's something that you could jam with a baby monitor, a wifi AP or a cordless phone. I wouldn't expect Comcast to come up with a home-grown solution that was nearly half as secure as ZigBee, and I also can't imagine that it could be worth it to license a piece of spectrum just for their solution; it would cost too damn much. So where does that leave all of us when it comes to this kind of use case?

Re:Not Zigbee's Fault, either

[grahamsz]

It's mostly to do with the low battery utilization of zigbee sensors. From what I can tell of the ones I have in my house, they basically use a reed relay to trip an interrupt on the microcontroller that causes it to transit that the sensor state has changed. In sleep mode then seem to run about a year on a coincell so it's obviously not in regular radio communication with the base station.

Obviously the sensors could wait for acknowledgement of their state change and otherwise continue sending it until they come, but that'd also mean if the base station was offline for a few days all the batteries in the sensors would be dead. Even in that case you could still disrupt the sensor by wrapping it in foil.

Despite all that it's still likely fine for a home security system. I highly doubt the average crooks would use a radio jammer or take the time to wrap sensors in tin foil. For most home owners the deterrent value is just fine.

Re:Not Zigbee's Fault, either

[macs4all]

On the other hand, the issue here is an interesting one. ZigBee's actually a pretty secure protocol for communications, with regard to integrity and confidentiality. But for applications that depend upon availability, it's something that you could jam with a baby monitor, a wifi AP or a cordless phone. I wouldn't expect Comcast to come up with a home-grown solution that was nearly half as secure as ZigBee, and I also can't imagine that it could be worth it to license a piece of spectrum just for their solution; it would cost too damn much. So where does that leave all of us when it comes to this kind of use case?

I dunno; especially considering the limited frequency-bands available with no licensing requirement. It sounds a bit ignorant, but considering we're talking about an indoor application, it almost seems like a "ZigBee-esque" mesh-network of infrared transceivers would be better for this, and no steenking FCC to worry about.

Then, the only thing you have to worry about is sunlight bringing down your network...

This is one of the reasons why it is a shame that the Echelon LONTalk protocol didn't really catch on in the home automation space (and because the development tools were RIDICULOUSLY expensive); because it is media-agnostic. It simply doesn't care if you use microwaves or smoke-signals to transfer packets; so long as the information is decode-able.

Re:Not Zigbee's Fault, either

[Darinbob]

Ture, but the Zigbee protocol is pretty ugly in a lot of places (SEP 2.0 that is). Low speed link yet binary data is transmitted using XML? Ludicrous.

Re:Not Zigbee's Fault, either

[macs4all]

Ture, but the Zigbee protocol is pretty ugly in a lot of places (SEP 2.0 that is). Low speed link yet binary data is transmitted using XML? Ludicrous.

I agree. I think that a fair amount of things about ZigBee are somewhat under-planned; but this stuff still isn't ZigBee's fault. Other than the fact that they picked a VERY crowded RF band upon which to hitch their entire concept.

Re:Not Zigbee's Fault, either

[AmiMoJo]

A year on a coin cell would give you enough energy to send a ping say once a minute. I do this stuff for a living, it's surprising how little energy you need.

Sending a ping now and then is essential, because otherwise the battery could die or the sensor fail and you wouldn't even know.

Re:Not Zigbee's Fault, either

[goose-incarnated]

A year on a coin cell would give you enough energy to send a ping say once a minute.

Depends on the transmission power requirements. Doubling the distance between transmitter and receiver generally means quadrupling the power output; noise of any sort (refrigerator motor, microwave, baby-monitor) causes retransmits, temperature deviations might affect battery performance, false-positives occur more often than expected, etc. In general take your best estimate of battery-life under perfect conditions, then halve it.

Re:Not Zigbee's Fault, either

[grahamsz]

Can you recommend a zigbee sensor that can do that? I'd love one, and like you agree that it's probably possible on paper but in reality i've tried a few and haven't found anything that can deliver that from a coin cell.

do people expect these things to work?

[known_coward_69]

i thought their only purpose was so that your home insurance company will cover your home

Re:do people expect these things to work?

[geekmux]

i thought their only purpose was so that your home insurance company will cover your home

Ironically, you just answered your own question as to the people that would give a shit about the actual functionality.

This is why...

[mindwhip]

This is why wireless is such a bad idea in many situations... wired allows for so much more tamper proofing and overall security.

Re:This is why...

[Fly Swatter]

I think it is related to wireless. Wireless WILL get interference from time to time disrupting communications. If it 'failed safe' there would be so many false alarms it would be either a) useless and/or b) non-profitable constantly responding to false alarms. They chose the marketable and profitable route.

Re:This is why...

[dpidcoe]

A wired solution that reported "everything is ok!" if you cut the wires or the power went out would be equally stupid.

It would actually be more stupid to do that with a wired solution. The reason they likely did it that way with the wireless solution is because they didn't want to trigger false alarms every time the neighbor turns on their old badly shielded microwave. A wired system doesn't even have that excuse.

Re:This is why...

[phantomfive]

A wired solution that reported "everything is ok!" if you cut the wires or the power went out would be equally stupid. The problem isn't related to wireless

With a wired solution, you need to actually cut the wires and have physical access. With a wireless solution, an attacker can use a jammer to break the connection.

Most likely the developers did this because with wireless, there would be so many false alarms of the connection being broken, that it was just annoying for the users (That's not an excuse, they still should have put a notice somewhere that the connection had been broken, even if they didn't turn on the alarm and automatically call the police).

Re:This is why...

[mlw4428]

How so? It's all in the design of the system. The way around this would be an authenticated "heart-beat" type setup wherein I tell you that I'm OK until I don't tell you I'm OK. In that case it becomes the monitoring center's responsibility to dial the police. Instead from what I've surmised the system is designed so that it's mostly a "I'm OK unless I say otherwise", which is poor design. The medium of communication has nothing to do with it.

Re:This is why...

[GateGuy]

A wired solution that reported "everything is ok!" if you cut the wires or the power went out would be equally stupid.

A good wired solution would use supervised alarm circuits. These have a resistors incorporated into the circuit, usually one in series and one parallel.

In this manner cutting the wires would produce a true open. Twisting the wires together would show a true closed. In normal operation neither of those two conditions would exist.

Re:This is why...

[nehumanuscrede]

A wired solution that reported "everything is ok!" if you cut the wires or the power went out would be equally stupid.

A good wired solution would use supervised alarm circuits. These have a resistors incorporated into the circuit, usually one in series and one parallel.

In this manner cutting the wires would produce a true open. Twisting the wires together would show a true closed. In normal operation neither of those two conditions would exist.

In addition, some wired systems actually send pulses or heartbeat style data packets to the supervisory system. Coupled with your resistance setup, tampering with the wiring would be rather difficult indeed.

Re:This is why...

[tlhIngan]

How so? It's all in the design of the system. The way around this would be an authenticated "heart-beat" type setup wherein I tell you that I'm OK until I don't tell you I'm OK. In that case it becomes the monitoring center's responsibility to dial the police. Instead from what I've surmised the system is designed so that it's mostly a "I'm OK unless I say otherwise", which is poor design. The medium of communication has nothing to do with it.

Indeed.

In fact, the wireless sensors I've seen (900MHz based ones) operate on a 4 state system - contact open, contact closed, heart-beat, low battery. One of those must be reported periodically and the receiver must make sure all the sync'ed devices check in periodically (usually at least once a minute). The devices are sync'ed to the receiver in case your neighbour has the same system, and also to provide proper reporting of state (e.g., if the sensor is motion, you need to be notified it's motion so ignore it when in "armed at home" mode).

If a sensor battery needs changing, it sends the low battery heartbeat which causes the system to report which sensor has a low battery. If a sensor hasn't been heard from, then it's a fault and reported to the security company who calls you.

None of this uses ZigBee - wireless alarm sensors have been around a while. And the manuals from all of them I've seen send a heartbeat signal.

Re:This is why...

[antdude]

It's not hard to cut the lines. ;)

Wireless (e.g., cellular) is harder though.

Re:This is why...

[mrchaotica]

Not only is that not an excuse, that's a tacit admission that a "wireless security system" is an oxymoron and a fruitless endeavor, and marketing a product as such is tantamount to fraud.

Re:You get what you deserve for using comcast.

[macs4all]

I would imagine that since it operates in the 2.4 spectrum that there are many situations where radio communication is interrupted and would thus trigger an alarm. More then likely this would happen several times a day, making the alarm useless as people would then not actually think there was an issue but just the system acting up again. So Comcast in their infinite wisdom probably "fixed" the issue by not having it set off the alarm.

Good point about the 2.4 GHz "pollution" problem, and the fact that the system could NOT be designed to interpret simple loss-of-signal as an intrusion. In fact, the whole idea of wireless sensors in this particular application (at 2.4 GHz, at least) is a mighty dubious one, for this VERY reason.

False Positive nightmare

[captaindomon]

You need to look at the rate of false positives vs. false negatives. If they took the fail-alert approach, for every true security breach, Comcast would be responding to thousands of "my microwave interrupts my WiFi when it runs" etc. This would further impact response times to true security breaches due to cry wolf issues. So is it secure? Yeah not really. Is this the correct business choice for Comcast? Probably.

Re:False Positive nightmare

[macs4all]

You need to look at the rate of false positives vs. false negatives. If they took the fail-alert approach, for every true security breach, Comcast would be responding to thousands of "my microwave interrupts my WiFi when it runs" etc. This would further impact response times to true security breaches due to cry wolf issues. So is it secure? Yeah not really. Is this the correct business choice for Comcast? Probably.

If they would just develop an equivalent system that used the 5.4 GHz band, they could get away from the insane 2.4 GHz pollution issues, and thus increase the reliability (and thus trustworthiness) of their RF-link several-fold. THEN they could develop their "intrusion rules" around something that was nearly as foolproof as a hard-wired connection. Note that I said "nearly"...

Re:False Positive nightmare

[JeffOwl]

So why not do what competent alarm companies do an create a third state called "fault" which indicates that there is a problem but not necessarily a break in? This is just a side effect of Comcast not being a security company but trying to be all things to all people and doing none of it well.

Re:False Positive nightmare

[geminidomino]

Is this the correct business choice for Comcast? Probably.

Not any more so than replacing the doors of their corporate offices with bead curtains and rice paper.

If a flaw this basic is inherent in a wireless approach, then the right business choice is you don't use the wireless approach.

Re:False Positive nightmare

[mrchaotica]

So is it secure? Yeah not really. Is this the correct business choice for Comcast? Probably.

It's only the correct business choice because companies are no longer held accountable for products that are blatantly not fit for purpose, but fraudulently marketed as such.

Re:False Positive nightmare

[geminidomino]

That assumes there's no value in not being known as a snake-oil salesman.

Re:You get what you deserve for using comcast.

[silas_moeckel]

It depends on how long of a loss of signal, a few ms sure a few seconds sure, get to 30 seconds and well you have a problem. And thats assuming that it's a missed poll. Polling a battery powered devices is a battery trade off. Mind you the zigbee wireless is a hell of a lot more secure than what ADT is putting in for wireless. Think remotes that can disarm the system without even rolling key aka 1980's garage door opener.

some died due to comcast poor installers

[Joe_Dragon]

http://www.inquisitr.com/15151...

Re:Is anybody surprised?

[phantomfive]

All the development methodologies of the last few decades have been primarily focused on how to get software out the door quicker: Agile, RAD, Extreme Programming, etc are focused on faster (of course, there are exceptions: NASA for example always tries to make things more reliable, other researchers have looked at that too, but the mainline software industry has mostly ignored reliability).

The reality is, if you want secure software, every programmer needs to be thinking about security. It's not something you can bolt on after the software is written. You can't have a "Red Team" who tries to fix things later (although that can be a secondary layer of security). Companies don't think about security until they are big enough to be a target, which is obviously a problem.

We need a new development methodology based on security.....instead of RAAD call it RAADT after a certain contentious developer......

Re:You get what you deserve for using comcast.

[macs4all]

It depends on how long of a loss of signal, a few ms sure a few seconds sure, get to 30 seconds and well you have a problem. And thats assuming that it's a missed poll. Polling a battery powered devices is a battery trade off. Mind you the zigbee wireless is a hell of a lot more secure than what ADT is putting in for wireless. Think remotes that can disarm the system without even rolling key aka 1980's garage door opener.

So, how long do YOU want to wait before deciding that someone has indeed broken-in?

And oh yes, don't get me started on the whole insecurity of PIC Keeloq-based security. I developed a keyless-entry system for use with Delivery trucks (think UPS), and I originally started with Keeloq; but quickly changed to using AES-128, once I started reading about the weakness of Keeloq.

Re:Is anybody surprised?

[gstoddart]

Well, I will say the general issue here is people are willing to accept shit security for a shiny bauble. And that's their own damned problem.

Until companies bear real legal liability for being incompetent at implementing security, I am going to assume that every new product which wants to connect to the internet is a steaming pile of shit I have no interest in.

If you can open your door from your cell phone, someone else can too. And there's a very good chance it's so damned trivial to bypass that it would be scary.

You won't see a culture of development as being highly focused on security until corporations bear legal liability for it. As long as they don't, you pretty much have to assume there is pretty much no security at all.

Me, I simply don't give a damn about products which want to connect to the internet so I can access them from my phone. Because I see no reason to control my entire life from my phone or the internet.

What everyone else does ... not my damned problem.

I'm just simply not going to act like I have any sympathy anymore. What the world needs right now is a lot more bitter old men giving their best Nelson "Ha ha!" when this shit happens. Maybe shame will finally work where trying to explain the problem has failed.

I wouldn't trust Comcast with anything important

[XxtraLarGe]

We've had them for years for cable, phone & internet. Then we dropped our land line, and they actually wanted to increase our phone bill when we wanted the service stopped! They said we paid less for all 3 services because of the "triple play discount", so it cost more for cable & internet than it cost for cable, internet & telephone. It wasn't until I threatened to leave that they took that off of our service and dropped our bill by $10. Then, to save more money, we got rid of our extra cable boxes ($10 each) and replaced them with digital converters for our upstairs TVs ($ each). After I installed them, they didn't work. So I called, the tech fixed it on their end, so we could watch TV in bed. Of course, when they "fixed" that problem, they "accidentally" turned off my DVR service. Then we got a notice saying we were not being billed correctly, and they boosted the price back up to $10 for each converter. Called & argued with them again. They fixed the price. Then the devices stopped working again. Called again, and now neither the converters OR the DVR is working. So now I have to have a tech come to my house. I almost have to believe they are doing it on purpose at this point, but WOW !!! I wonder how much Comcast wastes per year fixing things they screwed up on the previous tech support call? In some instances above, I did use chat, which is a semi-improvement, but only by a little. <\rant>

Xfinity doesn't leave doors open

[wonkey_monkey]

Comcast's Xfinity Home Security Flaw Leaves Doors Open

No, people leave doors open. Xfinity just sucks at warning you about it.

Re:You get what you deserve for using comcast.

[GSMacLean]

It has to work this way. Otherwise your alarm would be going off every time you turned on the microwave oven. Wireless security systems are inherently secure. I refuse to use them in my house.

Not a real issue

[Anonymous Coward]

Everyone seems to be jumping on the bash comcast band wagon here but did comcast really cause this kind of problem? The article didn't mention but the sensor check-in message will get missed by the control panel (think heartbeat) and report comm fail. So why would a wireless sensor communication failure triggering a false alarm be a GOOD thing? If you consider the fees some local governments charge for false alarms, the strict federal regulations preventing false alarms, how these systems handle sensor communication failures, and how obviously unrealistic a 24/7 uptime is on a wireless sensor, then this "vulnerability" seems a bit silly. RF is hard, and add to that limitations on size, output power, and battery life. If this were a wired sensor and the line was cut without an immediate effect, then I'd be concerned... but with wireless, I'd rather not pay hundreds of dollars on false alarm fees.

Security Systems

[corychristison]

I spent some time as an installer for a local security company at one point in time.

I don't know what Comcast is using, but most security systems (wired or wireless) can be configured to be Normally Open, or Normally Closed. Also, some can be configured to fail open or fail safe.

This could in part be a configuration issue.

But I also didnt read the article. Just speculating... haha

They do that for a reason.

[Lumpy]

Because the damn thing would be non stop false alarms if they did. Zigbee is NOT reliable enough for an alarm system.

Re:I wouldn't trust Comcast with anything importan

[XxtraLarGe]

Pardon my ignorance, but could you or someone else please explain the difference between a "cable box" and a "digital converter"?

A cable box decodes both HD & SD signals and sends them to your TV. A digital converter basically only decoded the SD signals. It's also much smaller and doesn't have digital numbers for the channel on it. That's the practical differences, not the technical, but that's all I'm concerned about. From my understanding, the digital converters COULD handle up to 4k transmissions, but we still can't get our HD channels because Comcast.

Re:Is anybody surprised?

[phantomfive]

Development methodologies focus on speed of the development as well as producing the right thing for the right job. If security is part of what "the right thing" is, then the methodology will produce it. If it's not, then it won't.

Nope. You can tell what from the name what they are focused on. "Agile" is focused on quickly responding to customers, RAD is focused on Rapid application development, for example.

Every development methodology claims to "produce the right thing," even teams without any methodology, even waterfall claims that. That is not unique to any methodology, they all do that.

Re:You get what you deserve for using comcast.

[sjames]

The problem isn't that it won't report a problem while interference has the radio links down (that is an issue with any wireless system). The problem is that once the interference clears up, it will continue to believe all's well for some time after.

Re:I wouldn't trust Comcast with anything importan

[XxtraLarGe]

you're lock into a 2 year or more agreement

I have no contract, I'm month-to-month. It allows me to make changes fairly easily. Oh, I forgot that the most recent thing I did was buy my own Netgear N600 Wifi Cable Modem Router. It cost me $95, but will save me $10 a month, so it pays for itself in under a year. Of course, getting that set up was another ordeal. I followed the instructions, got a success message on Comcast's page, and still had to call tech support. Couldn't do chat, because the only time I could connect to the internet was by going through the Comcast modem setup page. It was literally the only page that worked. Took a half-hour phone call to get it working correctly.

IoaYTGS

[Hognoxious]

Welcome to the IoaYTGS - Internet of all Your Things Got Stolen.

Other Vendors Impacted ?

[nehumanuscrede]

Most of the newer alarm system offerings have switched over to wireless sensors vs the old school method of hard-wiring them.

( Hard wire is the way to go, but you really need to do it as the home is being built. Trying to retrofit a wired system after is a major undertaking. )

I'm curious to know if the other vendors using wireless sensors also suffer from the same vulnerabilities as the Xfinity one does. ( ADT, AT&T Digital Life, etc. )

It spreads to all products...

[SeaFox]

This would be the same Comcast that makes your cableco-provided wireless modem/router combo broadcast a second public wi-fi network by default? Sounds like Comcast will cause open back doors in the both physical and metaphorical sense.

Re:You get what you deserve for using comcast.

[nehumanuscrede]

The bigger problem is relying on a security system that can be disabled by snipping a cable either in front of the house or several houses down (for example the cable box in front of my house serves 4 houses). Now, I don't know the current details on Xfinity home - cutting the cable line may well still allow the alarm to activate. But it certainly isn't going to notify anyone (Comcast's monitoring office, the police, the home owner) that there was a break in. Other systems use (for example) Verizon's cell network to report so that they cannot be disabled so easily.

Cutting the broadband cable won't do anything for you.

The Xfinity flavor ( as well as most others ) contain a cellular backup within the unit to utilize in the event the broadband connection dies.

Broadband connectivity is determined via periodic heartbeat packets coming and going to the monitoring system.

So, while you can cut the cable, you'll also need a cellular jammer based on whatever flavor of cellular they're utilizing. Most homes using this level of alarm tech aren't worth going through all this trouble to break into to begin with.

Re:werd

[nehumanuscrede]

ADT for life

FYI, even ADT has switched to wireless sensor setups. My parents house is outfitted with them.

Re:You get what you deserve for using comcast.

[sjames]

Constant checking in will kill battery life, but the problem is that they don't remain in the alarm state. That would also cause battery wear, but only in the event of a break in.

A wired system is more secure but not always practical as a retrofit. Of course, most home alarms depend on most criminals being dumb.

Re:Is anybody surprised?

[phantomfive]

I just read this story which suggests that consumers are starting to avoid IoT stuff because of security concerns. So that might cheer you up (a bit) on a rainy, dreary morning.

Xfinity?

[ceoyoyo]

That's the company that sends me e-mail notifications for someone's alarm system. The notifications contain the person's first name, street address, a timestamp and what the action was (alarm armed, disarmed, armed stay, alarm, etc.). There only return address is unmonitored and xfinity.com doesn't seem to have any contact information.

Seems like a legit operation.

Re:You get what you deserve for using comcast.

[silas_moeckel]

I use wired zones for my perimeter, I have some wireless motion but thats more belt and suspenders for the security side and drives the HA system.

This is all about getting something dirt cheap to install and maintain to meet the requirements for the homeowners policy discount.

Best security system

[MitchDev]

Loyal, protective dogs, big ones...

Re:Best security system

[phantomfive]

You can shoot dogs, or poison them, or bribe them with meat.
No one is going to think your house is being broken into, just because a dog is barking.

Re:Best security system

[goose-incarnated]

You can shoot dogs, or poison them, or bribe them with meat. No one is going to think your house is being broken into, just because a dog is barking.

The smartest AI in the world is still orders of magnitude dumber than an untrained guard dog.

Sure, you can poison dogs, but only one at a time, thereby making it slower to break in. You can shoot dogs, but that just alerts everyone within earshot. You can try bribing my rottweilers with meat, but I don't think it will be very successful - they've remained quite hostile to strangers after eating the stranger's meat in the past.

I'm in the crime capital of the world (probably), and the only times I've ever been broken into was when I had no dogs, because... (say it with me)

Even an untrained guard dog is a larger hurdle to cross than the smartest home security system.

Re:Best security system

[MitchDev]

All that matters is that the person trying to break in hears the dogs. Shooting a dog makes a LOT of noise. You have to get in the house to poison them, and that's assuming the owner or family members aren't there to catch you in the act. Your automated system is not perfect either, NO system is. I find your comments disingenuous at best.

Re:Best security system

[MitchDev]

Plus dogs have a lot on non-security benefits too :)

Re:Best security system

[phantomfive]

I find your comments disingenuous at best.

I know people who've had their dogs shot, so I apologize for your findings.

Re:Best security system

[phantomfive]

Cool.

Re:You get what you deserve for using comcast.

[phantomfive]

It depends on how long of a loss of signal, a few ms sure a few seconds sure, get to 30 seconds and well you have a problem.

Then someone turns on the microwave for 10 minutes to cook a frozen pizza......

Blatant Violation of Net Neutrality

[almechist]

Reading quickly through this thread, with all the comments about whiners wanting something for nothing, it seems to me that most are missing the real story here. The Binge-on plan is supposed to be about getting certain content without it counting against a data cap, that certain providers have worked out a deal with T-Mobile allowing their streams to be “optimized” in exchange for users getting unlimited access. But it turns out that everyone‘s content is being treated the same: it’s all throttled. So what exactly is the point of having only some content providers participate? A select few companies have allowed their names to be used, and have theoretically signed on to the scheme, but those providers' data isn’t being treated any differently then anyone else’s, the data is ALL being throttled! Think about it, all video data on the internet is being treated the same, but only some companies are being given the opportunity to serve up unlimited amounts of video. Why? Why just them? I have read that other streaming providers can opt in for free, which if true just makes the unequal treatment worse. By default, T-Mobile is treating video data as if the provider has already agreed to the plan, but only a select few companies are reaping the benefits. From an engineering standpoint, participating companies are doing ABSOLUTELY NOTHING differently than non-participating companies. WTF? Bottom line: ALL VIDEO CONTENT IS BEING THROTTLED, SO ALL VIDEO CONTENT PROVIDERS SHOULD REAP THE BENEFITS! Anything else is a flat out violation of net neutrality. And that’s the real story here.

Re:Blatant Violation of Net Neutrality

[almechist]

cancel above, wrong thread /sigh

Re:You get what you deserve for using comcast.

[silas_moeckel]

If you alarm is armed away who would be running a microwave?

Re:You get what you deserve for using comcast.

[mysidia]

Mind you the zigbee wireless is a hell of a lot more secure than what ADT is putting in for wireless.

Personally; I think a Keyfob is crappy security, regardless of the system used ---- unless its functions are essentially limited to "Force Arm" and "Panic".

Keyfobs can be lost, misplaced, stolen, or a criminal can forcibly take it from you, or force you to disarm using it.

Combinations do not suffer from these security issues; and if forced to disarm, modern panels allow durress codes to be pre-programmed.

Last I check; ADT is just using rebadged Honeywell/VISTA Ademco panels, which they rebadge, and possibly use custom firmware on.

The Honeywell 5883H security panel RF module is capable of supporting secure two-way wireless keyfobs, and the Honeywell 5834-4 is a high-security keyfob that uses two-way radio and encrypted challenge+response, and can check current arming status.

These are not Comcast/Xfinity devices

[intermelt]

It is important to note that Comcast is not the manufacturer of these devices. They are also most likely not creating the software for them either. The alarm system is sold by an OEM that several different alarm companies use, including other cable companies.

The system also isn't just using ZigBee for communication, it is using the ZigBee Home Automation standard. ZigBee has defined how they want home security and automation products to communicate over their ZigBee radio standard. So this isn't just related to Comcast. I would think that just about every other system out there using ZigBee for home security would have the same problem. So this is a bigger problem than just Comcast users.

I would think a software update could be pushed to the base station that would detect active signal jamming. It could be as simple as checking of the signal level is peaked on all channels with no valid data being detected. It could also be a lot more sophisticated and look at actual received data to determine if it was from a jamming device or possibly matches signatures of known devices that can cause interference.

I think an ideal solution is adding a beacon that is not dependent on power usage. This beacon would transmit on regular intervals (every second or so). If this signal is not received for a period of time (plus may some other detected conditions), then the system can trigger the desired alarm.

Re:You get what you deserve for using comcast.

[Slashdot Junky]

A pizza should never be cooked by microwaves. Now, if the "microwave" happens to be a combination unit also supporting, perhaps, convection cooking, it is okay to use the "microwave" to cook the thing. The bonus of cnvection cooking is that having a slice or three doesn't have to come at the expense of a home security system failure between the press of start and the ding heard once the timer has counted down.

Re:You get what you deserve for using comcast.

[silas_moeckel]

What your not supposed to program the disarm button to disarm and send the silent alarm?

Re:You get what you deserve for using comcast.

[mysidia]

What your not supposed to program the disarm button to disarm and send the silent alarm?

This is technically feasible but not recommended. One of the troubles with keyfobs is you put them in your pocket, and the buttons accidentally get pushed: also if the alarm is silent, then you won't know you have accidentally triggered it until the cops show up.

Re:You get what you deserve for using comcast.

[TarPitt]

BTW, the presentation at BlackHat about serious flaws in ADT's security was pulled due to legal pressure from vendors: Two more talks pulled from Black Hat hacking conference

The paper, however, may be found here

Re:You get what you deserve for using comcast.

[AmiMoJo]

There are wireless bands reserved for alarms in Europe, and presumably the US too but I have not checked. Cheap systems don't use them because they need certification to ensure that they don't interfere with other alarms.

Using 2.4ghz is beyond dumb. Then again the UK is trying to use it for meter reading too, and unsurprisingly it doesn't work very well.

Re:You get what you deserve for using comcast.

[silas_moeckel]

Well for me in a small town thats not a big deal grew up with most of them, might have to produce some decent coffee. Being on a keychain they are not hitting a pocket till I'm parked and well out of range.

Re:Is anybody surprised?

[mrchaotica]

What everyone else does ... not my damned problem.

I was with you up to this point. While I wish I could ignore all the shitty decisions other people make, it still affects me because the good choices I want to make become more difficult or impossible. For example, it's probably no longer possible to buy a new car that doesn't spy on you. Even if I keep driving antique cars myself, sooner or later that fact would make me stand out enough that I become trackable anyway.

Re:I wouldn't trust Comcast with anything importan

[mrchaotica]

A "digital converter" lets you view a digital signal on an old analog TV. A "cable box" is a bullshit tactic that adds DRM to your cable signal (all it does is replace the functionality of the QAM tuner your TV already has, because the cable company intentionally broke it by encrypting the signal) and inflates the cost by giving the cable company a flimsy excuse to charge extra per-TV fees on top of the already-overpriced subscription itself.

Cable boxes are an attack on consumers and the FCC should never have allowed them to exist in the first place, especially in light of the Carterfone decision (the principles of which should have been applied to cable TV service just as much as to phone service).

Re:I wouldn't trust Comcast with anything importan

[mrchaotica]

Damn, I screwed up the link. (Actually, it wasn't my fault; Firefox has suddenly stopped including the "http://" in the address bar for non-HTTPS URLs for some reason. WTF, Firefox?) Here's the correct one: http://arstechnica.com/tech-policy/2008/06/carterfone-40-years/