RE: Woefully Insecure: Remote Control 433Mhz Power Sockets

DAB — Sun, 10 Apr 2016 19:26:14 GMT

Good luck on your thesis.

I have seen some very brutal reviews when the group decides it does not like what you did.

As for the commercial links, few of the manufacturers even considered security, so I am not surprised that your devices are easy to hack.

Next step is to find a way to secure them without introducing a lot of cost.

DAB

RE: Woefully Insecure: Remote Control 433Mhz Power Sockets

shabaz — Sun, 10 Apr 2016 11:23:13 GMT

Hi Gough!

Great post and relevant information. To be honest most consumer remote power strips are insecure here too.

Although the ones I have seen have been built to a higher quality and using more reliable modulation schemes and at least did have a functioning learning capability. But insecure nevertheless, nothing that someone with a $10 SDR dongle and laptop couldn't grab and replay again and again.

It isn't great, but the thinking goes along the lines of:

(a) Question: what is the value of the impact to the "thing" that is to be secured?

--> Answer: probably a few pennies/cents if the "thing" is remote controlled home lighting where malicious switching-on will result in a slightly higher power bill

(b) Question: what is a reasonable amount to do in order to provide reasonable protection from the risk of that impact (the impact being a few pennies in this case)

--> Answer to date from most manufacturers: not publish the bitstream

It all breaks down of course if our answer to (a) is slightly different, such as if we use such remote control power sockets to operate (say) electric security gates or kettles that could run dry etc or if the particular lighting is visible from outside and causes a security issue for users.

Not disagreeing that manufacturers could do more (or at least publish guidelines on what the recommended use-cases for their products are based on a security perspective, because the average non-technical user may mistakenly presume such products are secure for all practical purposes which as you've shown clearly they are not).

Sad to say, but possibly the sort of thing that might need legislation so that such products meet a minimum published security standard (there will still be products that flout it of course) or declared in plain language on the packet, but today there is no legal requirement in the UK with respect to wireless security for home remote control products as far as I am aware (I could be totally wrong - not my main knowledge area!!).

Of relevance to (b), the ability to do reverse-engineering and replay attacks at low cost has changed dramatically in the past few years because of the availability of cheap SDR (not blaming SDR! just stating that some will misuse it).

RE: Woefully Insecure: Remote Control 433Mhz Power Sockets

clem57 — Sun, 10 Apr 2016 09:16:44 GMT

Long read, but a great learning about hacking that you went through. Do they make these in US standard plugs?

Clem