Do you trust this system? You should not. I have found very simple way how to unlock any area remotely, without knowing any password. The security bug is in Paradox’es IP100 module, which is absolutely unsafe.

IP100 is internet module which allows you to control (check zones status, lock, unlock) your house. Official description of this module about security says:

• Data sent and received using 128-bit (MD5 and RC4) or 256-bit (AES) data encryption.
• Two-way dynamic authentication.

This is whopper.  MD5 and RC4 is used only to encrypt the password, not to encrypt the communication. It means that man-in-the middle attacks can be performed, but it it’s pretty small bug compared to following :-).

How to make the attack and unlock the property:

1. Let the user connect into system, or make tiny script which waits for this event. Also social hacking can be used to persuade user to connect. 
2. As soon as any legal user connects to the system, anyone on the same internet subnet as the legal user can perform the attack. This „hacker“ can do any task which IP100 provides (just with entering good URL into browser). He can watch the zones or arm/disarm the object. This „hacker“ doesn’t need session id (because there is no session handling in IP100) nor usercode nor password. Actions described in following points:
3. To check open zones and locked/unlocked status of all subsystems just point to http://router_ip_address:port/statuslive.html. You will get JavaScript, where you can search for: tbl_useraccess = new Array(9,0,0,0,0,0,0,0); - it’s array of zones: 9 means unlocked, 5 means „stay“ and so on.  There is also status of all zones.
4. The real bad thing is, that „hacker“ can unlock the Paradox system just entering this URL: http://router_ip_address:port/statuslive.html?area=00&value=d. Variable „area“ is identifier from array you got from previous step from array tbl_useraccess. To turn Paradox into stay mode, just enter: http://router_ip_address:port/statuslive.html?area=00&value=s.

Conclusion:

• The only protection of IP100 module is based on IP address (well it was not intended to use this as security protection, but it was used to avoid parallel usage by several users … you can get this point from user’s guide). Don’t even think about translating IP100 from your internal LAN to internet. Use SSH and portforwarding instead.
• Did you ever imagine, that for example webmail would be protected only by IP address, not by user and password. ;o))

What do Paradox think about this?

I have discussed this bug by phone with Mr. Stephane Racicot (Vice-President Customer Relations of Paradox company). He let engineers from Paradox and local distributor (Mr. Mračna from Eurosat) to check this bug and they drew conclusion not beeing a big bug and maybe they will fix it in some future version.

Make your own decission, whether is it big or small one.  I’d not like the feeling, that anyone can unlock my house and I’d strongly recommend potential customers to avoid Paradox company (not because making some mistake, but due their attitude to security and the will to solve problems).

After couple minutes, I have found free solution using VBA script.

Just put this code into VBAProject.OTM:

Private Sub Application_ItemSend(ByVal Item As Object, _
                                 Cancel As Boolean)
    Dim objRecip As Recipient
    Dim strMsg As String
    Dim res As Integer
    Dim strBcc As String
    On Error Resume Next
 
    ' #### USER OPTIONS ####
    ' address for Bcc -- must be SMTP address or resolvable
    ' to a name in the address book
    strBcc = "someone@somewhere.dom"
 
    Set objRecip = Item.Recipients.Add(strBcc)
    objRecip.Type = olBCC
    If Not objRecip.Resolve Then
        strMsg = "Could not resolve the Bcc recipient. " & _
                 "Do you want still to send the message?"
        res = MsgBox(strMsg, vbYesNo + vbDefaultButton1, _
                "Could Not Resolve Bcc Recipient")
        If res = vbNo Then
            Cancel = True
        End If
    End If
 
    Set objRecip = Nothing
End Sub

Editor can be opened using Alt+F11 in Outlook 2007, exploring Project tree on the right side and adding Application - ItemSend handler using top comboboxes.

Also it’s neccessary to change security settings:

1. In Outlook 2000 to 2003, choose Tools | Macro | Security and set security to Medium. In Outlook 2007, the macro security settings are in the Tools | Trust Center dialog. Set macro security to Warn on all macros.
2. Restart Outlook

URLs:

• http://pubs.logicalexpressions.com/Pub0009/LPMArticle.asp?ID=341
• http://www.outlookcode.com/article.aspx?id=72
• http://outlookcode.com/article.aspx?id=49