Message-ID: <b550841b-d94c-0032-6175-eff595f11532@syss.de>
Date: Mon, 25 Mar 2019 09:07:42 +0100
From: Matthias Deeg <matthias.deeg@...s.de>
To: <fulldisclosure@...lists.org>
Subject: [FD] [SYSS-2018-035]: ABUS Secvest Remote Control - Missing
 Encryption of Sensitive Data (CWE-311)

Advisory ID: SYSS-2018-035
Product: ABUS Secvest Remote Control (FUBE50014, FUBE50015)
Manufacturer: ABUS
Affected Version(s): n/a
Tested Version(s): n/a
Vulnerability Type: Missing Encryption of Sensitive Data (CWE-311)
Risk Level: High
Solution Status: Open
Manufacturer Notification: 2018-11-21
Solution Date: -
Public Disclosure: 2019-03-25
CVE Reference: CVE-2019-9862
Authors of Advisory: Matthias Deeg (SySS GmbH), Thomas Detert

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Overview:

ABUS Secvest FUBE50014 and FUBE50015 are wireless remote controls for
the ABUS Secvest wireless alarm system.

Some of the device features as described by the manufacturer are
(see [1]):

"
* User-friendly remote control with easily identifiable symbols
* Features ‘arm’, ‘disarm’ and ‘status query’ keys
* 8 LEDs provide an overview and display current system status
* Button for custom configuration available (Secvest wireless alarm
  system only)
* Optional manual panic alarm available (Secvest wireless alarm system
  only)
* Encrypted signal transmission
* Rolling Code
  Thanks to the rolling code process this product is protected against
  so-called replay attacks. All controlling signals between this product
  and the Secvest alarm panel are in individualised and thus, are not
  able to be reproduced by third parties. This process is protected
  from third party tampering, and exceeds the requirements of the
  DIN EN 50131-1 level 2 security standard.
"

Due to the missing "Encrypted signal transmission", an attacker is able
to eavesdrop sensitive data as cleartext, for instance the current
rolling code state.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Vulnerability Details:

Thomas Detert found out that the claimed "Encrypted signal transmission"
of the Secvest wireless remote control FUBE50014 is not present at all.

Thus, an attacker observing radio signals of an ABUS FUBE50014
wireless remote control is able to see all sensitive data of
transmitted packets as cleartext and can analyze the used packet format
and the communication protocol.

For instance, this security issue could successfully be exploited to
observe the current rolling code state of the wireless remote control
and deduce the cryptographically weak used rolling code algorithm
(see SySS security advisory SYSS-2018-034 [2]).

SySS found out that the new ABUS Secvest remote control FUBE50015 is
also affected by this security vulnerability.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Proof of Concept (PoC):

Thomas Detert developed a Teensy-based PoC tool using a CC1101 sub-1GHz
transceiver that allows disarming the alarm system in an unauthorized
way. He provided his tool including documentation and source to SySS
GmbH for responsible disclosure purposes.

SySS GmbH could successfully perform a disarming attack against an ABUS
Secvest wireless alarm system by exploiting the unencrypted signal
transmission of the ABUS Secvest wireless remote controls FUBE50014 and
FUBE50015 and the predictable rolling code implementation using either
Mr. Detert's PoC tool, a developed Python tool for the RFCat-based radio
dongle YARD Stick One (see [3]), or a eZ430-Chronos (see [4]) with a
specially developed firmware.

Successful disarming attacks against an ABUS Secvest wireless alarm
system are shown in our SySS proof-of-concept video "ABUS Secvest
Rolling Code PoC Attack" [7].

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Solution:

SySS GmbH is not aware of a solution for this reported security
vulnerability.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclosure Timeline:

2018-11-21: Vulnerability reported to manufacturer
2018-11-28: Vulnerability reported to manufacturer once more
2018-12-12: E-mail to ABUS support asking if they are going to give
            some feedback regarding the reported security issue
2018-12-12: Phone call with ABUS support, the reported security
            advisories were forwarded to the ABUS Security Center
            Support
2018-12-12: E-mail to ABUS Security Center Support asking if they are
            going to give some feedback regarding the reported security
            issue
2019-01-14: Updated information regarding remote control ABUS Secvest
            FUBE50015
2019-03-25: Public release of security advisory

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

References:

[1] Product website for ABUS Secvest wireless remote control

https://www.abus.com/eng/Home-Security/Alarm-systems/Secvest-wireless-alarm-system/Control-devices-and-extensions/Secvest-Wireless-Remote-Control2
[2] SySS Security Advisory SYSS-2018-034

https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2018-034.txt
[3] Product website YARD Stick One
    https://greatscottgadgets.com/yardstickone/
[4] Product website for Texas Instruments eZ430-Chronos
    http://www.ti.com/tool/EZ430-CHRONOS
[5] SySS Security Advisory SYSS-2018-035

https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2018-035.txt
[6] SySS GmbH, SySS Responsible Disclosure Policy
    https://www.syss.de/en/news/responsible-disclosure-policy/
[7] SySS Proof-of-Concept Video: ABUS Secvest Rolling Code PoC Attack
    https://youtu.be/pSdsMVn-7gM

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Credits:

This security vulnerability was found by Thomas Detert.

Mr. Detert reported his finding to SySS GmbH where it was verified and
later reported to the manufacturer by Matthias Deeg.

E-Mail: matthias.deeg (at) syss.de
Public Key:
https://www.syss.de/fileadmin/dokumente/Materialien/PGPKeys/Matthias_Deeg.asc
Key fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclaimer:

The information provided in this security advisory is provided "as is"
and without warranty of any kind. Details of this security advisory may
be updated in order to provide as accurate information as possible. The
latest version of this security advisory is available on the SySS Web
site.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Copyright:

Creative Commons - Attribution (by) - Version 3.0
URL: http://creativecommons.org/licenses/by/3.0/deed.en


Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)


_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists