Tony Kmoch

Paradox is one of widely used manufacturer of home and company security systems. This company makes several security tools like sirens, IR detectors, etc.  Here in Czech republic is Paradox even certified to secure military areas.

Do you trust this system? You should not. I have found very simple way how to unlock any area remotely, without knowing any password. The security bug is in Paradox’es IP100 module, which is absolutely unsafe.

IP100 is internet module which allows you to control (check zones status, lock, unlock) your house. Official description of this module about security says:

• Data sent and received using 128-bit (MD5 and RC4) or 256-bit (AES) data encryption.
• Two-way dynamic authentication.

This is whopper.  MD5 and RC4 is used only to encrypt the password, not to encrypt the communication. It means that man-in-the middle attacks can be performed, but it it’s pretty small bug compared to following :-).

How to make the attack and unlock the property:

1. Let the user connect into system, or make tiny script which waits for this event. Also social hacking can be used to persuade user to connect. 
2. As soon as any legal user connects to the system, anyone on the same internet subnet as the legal user can perform the attack. This „hacker“ can do any task which IP100 provides (just with entering good URL into browser). He can watch the zones or arm/disarm the object. This „hacker“ doesn’t need session id (because there is no session handling in IP100) nor usercode nor password. Actions described in following points:
3. To check open zones and locked/unlocked status of all subsystems just point to http://router_ip_address:port/statuslive.html. You will get JavaScript, where you can search for: tbl_useraccess = new Array(9,0,0,0,0,0,0,0); - it’s array of zones: 9 means unlocked, 5 means „stay“ and so on.  There is also status of all zones.
4. The real bad thing is, that „hacker“ can unlock the Paradox system just entering this URL: http://router_ip_address:port/statuslive.html?area=00&value=d. Variable „area“ is identifier from array you got from previous step from array tbl_useraccess. To turn Paradox into stay mode, just enter: http://router_ip_address:port/statuslive.html?area=00&value=s.

Conclusion:

• The only protection of IP100 module is based on IP address (well it was not intended to use this as security protection, but it was used to avoid parallel usage by several users … you can get this point from user’s guide). Don’t even think about translating IP100 from your internal LAN to internet. Use SSH and portforwarding instead.
• Did you ever imagine, that for example webmail would be protected only by IP address, not by user and password. ;o))

What do Paradox think about this?

I have discussed this bug by phone with Mr. Stephane Racicot (Vice-President Customer Relations of Paradox company). He let engineers from Paradox and local distributor (Mr. Mračna from Eurosat) to check this bug and they drew conclusion not beeing a big bug and maybe they will fix it in some future version.

Make your own decission, whether is it big or small one.  I’d not like the feeling, that anyone can unlock my house and I’d strongly recommend potential customers to avoid Paradox company (not because making some mistake, but due their attitude to security and the will to solve problems).