Comcast's Xfinity Home Security Flaw Leaves Doors Open (rapid7.com)

itwbennett writes: Researchers at Rapid7 have disclosed vulnerabilities in Comcast's Xfinity Home Security offerings that prevent the system from alerting homeowners to unsecured doors or windows and would also fail to sense an intruder's motion in the home. The root cause of the problem can be found in the ZigBee-based protocol used by Comcast's system to operate over the 2.4 GHz frequency band. Rapid7's Phil Bosco discovered that the Xfinity Home Security system does not fail closed with an assumption of an attack if radio communications are disrupted. Instead, the system fails open, reporting that all sensors are intact, doors are closed, and no motion is detected.

Comments

Not Zigbee's Fault, either

[macs4all]

I have done some development (albeit limited) using a Zigbee stack, and this failure has nothing to do with the Zigbee protocol, per se. That "explanation" sounds like some of the project-engineers trying to pull the wool over the eyes of Comcast's management (and Customers).

Re:Not Zigbee's Fault, either

[dpidcoe]

Yeah, it's not a Zigbee issue. It's an issue with using a wireless signal on an overcrowded and highly competitive spectrum to perform a mission critical communication task.

To make a car analogy, it's like blaming ford for making a shitty car because you tried to put 8 tons of bricks in your focus and the suspension failed.

Re:Not Zigbee's Fault, either

[grahamsz]

It's mostly to do with the low battery utilization of zigbee sensors. From what I can tell of the ones I have in my house, they basically use a reed relay to trip an interrupt on the microcontroller that causes it to transit that the sensor state has changed. In sleep mode then seem to run about a year on a coincell so it's obviously not in regular radio communication with the base station.

Obviously the sensors could wait for acknowledgement of their state change and otherwise continue sending it until they come, but that'd also mean if the base station was offline for a few days all the batteries in the sensors would be dead. Even in that case you could still disrupt the sensor by wrapping it in foil.

Despite all that it's still likely fine for a home security system. I highly doubt the average crooks would use a radio jammer or take the time to wrap sensors in tin foil. For most home owners the deterrent value is just fine.

This is why...

[mindwhip]

This is why wireless is such a bad idea in many situations... wired allows for so much more tamper proofing and overall security.

Re:You get what you deserve for using comcast.

[macs4all]

I would imagine that since it operates in the 2.4 spectrum that there are many situations where radio communication is interrupted and would thus trigger an alarm. More then likely this would happen several times a day, making the alarm useless as people would then not actually think there was an issue but just the system acting up again. So Comcast in their infinite wisdom probably "fixed" the issue by not having it set off the alarm.

Good point about the 2.4 GHz "pollution" problem, and the fact that the system could NOT be designed to interpret simple loss-of-signal as an intrusion. In fact, the whole idea of wireless sensors in this particular application (at 2.4 GHz, at least) is a mighty dubious one, for this VERY reason.

Re:You get what you deserve for using comcast.

[silas_moeckel]

It depends on how long of a loss of signal, a few ms sure a few seconds sure, get to 30 seconds and well you have a problem. And thats assuming that it's a missed poll. Polling a battery powered devices is a battery trade off. Mind you the zigbee wireless is a hell of a lot more secure than what ADT is putting in for wireless. Think remotes that can disarm the system without even rolling key aka 1980's garage door opener.

Re:Stick To Cable TV

[bobbied]

I don't know, as a former Comcast customer they seem to have about the same competency in home security as providing cable TV service.

Xfinity doesn't leave doors open

[wonkey_monkey]

Comcast's Xfinity Home Security Flaw Leaves Doors Open

No, people leave doors open. Xfinity just sucks at warning you about it.