14
\$\begingroup\$

Sorry if this is the wrong community for this question but in my mind, it's the best fit. Please close or move to a more appropriate community if it's off topic.

The other day, several home alarm companies came to look at my home to quote an alarm system. They all gave me a wireless option since the wired option they said would be super expensive.

I asked if it was possible for someone to jam the wireless sensors and break in. One representative said no but didn't elaborate why. The other said no because the communication between the sensor and the main panel is encrypted so people can't jam it.

I don't believe this is true but I don't have an EE degree. I think it's not true because I've heard on the news people have built cell phone jammers so it probably isn't hard to jam these sensors too. I think these sensors operated in the 200Mhz range (if I remember correctly), if that matters, although he said there's some encryption going on between the panel and sensor. That confuses me because the encryption is digital but the communication is analog?

\$\endgroup\$
9
  • 15
    \$\begingroup\$ Surely any half-way decent security system will alert you somehow if it looses communication with one of its wireless sensors. \$\endgroup\$
    – brhans
    Commented Feb 28, 2017 at 19:05
  • 44
    \$\begingroup\$ Its possible to jam ANY wireless system. \$\endgroup\$
    – Voltage Spike ♦
    Commented Feb 28, 2017 at 19:11
  • 1
    \$\begingroup\$ Perhaps this belongs on "security"? A poorly designed system would be vulnerable to jamming and replay attacks. The problem is that incorporating strong encryption for every sensor might be expensive. Perhaps there are industry standards that would ensure a minimum security level. If it's entirely proprietary, you have no chance of knowing how it actually works. \$\endgroup\$
    – user95482301
    Commented Feb 28, 2017 at 19:19
  • 3
    \$\begingroup\$ @user95482301 - I would guess that these sort of systems are probably about as strongly encrypted as your average garage-door remote - cheap but certainly hackable these days. \$\endgroup\$
    – brhans
    Commented Feb 28, 2017 at 19:30
  • 14
    \$\begingroup\$ The word jam is important here. Jam just means that someone can cause the system to loose signal. As @laptop2d said, any wireless system can be jammed. Loosing signal and faking a signal are two different things. \$\endgroup\$
    – Bort
    Commented Feb 28, 2017 at 19:36

5 Answers 5

Reset to default
39
\$\begingroup\$

A "denial-of-service" wireless attack is very easy. It will disrupt radio communication between sensor and panel. Hopefully, the panel is smart enough to detect that one (or more) of its sensors has failed to report-in. A non-reporting sensor should be assumed under attack. Ask your supplier what protocol is followed if your panel reports that a sensor has failed to report-in.
A much more difficult attack is a "spoof" attack, where the communication between sensor and panel is overpowered by an attacker with a valid message. An "all-OK" signal is very difficult for an attacker to generate because of encryption. Because these signals are regularly sent, it is vulnerable to a determined attacker who is willing to capture signals over a long period.

\$\endgroup\$
8
  • 1
    \$\begingroup\$ Re "A non-reporting sensor should be assumed under attack": I suppose there are sources of benign interference which can temporarily interrupt communication. I personally experienced power drills, light switches, cordless phones and other devices interrupting WLAN, digital TV (DVB-T) and analog radio at least briefly. Depending on the protocol even a few brief pulses can cause a longer communication breakdown; other sources like electric motors are by nature longer-term. So: How would one avoid frequent false alarms? What would a reasonable timeout be? \$\endgroup\$
    – Peter - Reinstate Monica
    Commented Mar 1, 2017 at 10:22
  • 2
    \$\begingroup\$ @PeterA.Schneider Those things are unlikely to be occurring while an alarm is set. The fact that a cordless drill sets off your alarm when you're not home may be considered an advantage by some. \$\endgroup\$
    – jayjay
    Commented Mar 1, 2017 at 11:38
  • 1
    \$\begingroup\$ Re: spoof: It would depend on the quality of the encryption protocols though. If it's a static encryption key and static message between the host and client sensor, monitoring simply two "call-ins" would be enough to capture the call-in and determine that it was the same sequence being sent each time, which could just then be replayed. You would hope that this isn't the case, but embedded security isn't always what we hope for... \$\endgroup\$
    – Hugh Nolan
    Commented Mar 1, 2017 at 11:52
  • 4
    \$\begingroup\$ @HughNolan With properly implemented encryption, a long period may easily be several times the age of the Universe. If the encryption can be broken by analyzing just two messages, that's no encryption at all. \$\endgroup\$
    – Dmitry Grigoryev
    Commented Mar 1, 2017 at 17:49
  • 2
    \$\begingroup\$ Agreed to Dmitry. I'm not arguing that well-implemented encryption is broken. WPA works excellently, for example. Just saying that custom embedded systems do not always implement good standards, or indeed any standards. @glen_geek, I was thinking of a "replay" attack from e.g. a wideband scanner. A spoof is of course much more difficult than a jam, this is pretty theoretical rather than practical. \$\endgroup\$
    – Hugh Nolan
    Commented Mar 1, 2017 at 18:03
21
\$\begingroup\$

First of all, to clear some things up: All digital signals are built up by analog signals. As already mentioned in the comments, all wireless communications can be jammed, encrypted or no. And last but not least, jamming is not the same as hacking into. Jamming is just "stopping" the signal.

Now, if the alarm central is good, I would expect it to expect a signal from each and every sensor on a regular basis. If a burglar simply jams one or more of the sensors, the central should realize that it has "lost" a sensor, and sound the bell.

On the other hand, this could lead to false alarms if the reception is bad. This would be a major problem, because over time the user will become annoyed, lose faith in the system, and switch it off. That's not only an expensive paperweight, it's also one that could be stolen.

The first rule of wireless is: Use a wired connection. Don't use wireless unless there is absolutely no other option.

Thus, my advice would be to either get the wired version, or save up for the wired version. But I don't know your house, your other wireless appliances (or your neighbors's), the thickness and materials of your walls, the exact alarm system in question, the warranty, insurance, or clauses in the contract, etc. In the end it's gonna be your decision, so good on you for trying to make it an informed one.

\$\endgroup\$
5
  • \$\begingroup\$ Thx. I really want wired too but it felt like the rep was trying to steer me away from that by telling me how expensive it would be and that wireless is the way to go. I'm hesitant but at the same time, if you're smart enough to jam things, I would think you'd rob someone richer than me. After buying this house, we're very poor and I pity the thief that tries to break in b/c we have nothing. In fact, the thief might pity ME and LEAVE money. :p \$\endgroup\$
    – Classified
    Commented Feb 28, 2017 at 23:16
  • 3
    \$\begingroup\$ IME alarm salesmen play on fear, and try to sell you things you don't necessarily need. If the system pays itself off over a few years in the form of reduced house insurance, then great. If that's not a factor, you could even make a primitive but discrete, effective, very custom tailored and expandable system by yourself, using cheap and readily available Arduino type parts. That is, if you're willing to put the time and effort into the necessary research and experimentation. You'd probably learn some electronics on the way too. \$\endgroup\$
    – Dampmaskin
    Commented Mar 1, 2017 at 0:07
  • 4
    \$\begingroup\$ Thumbs up for the first rule of wireless. My colleague is doing search about implementing a "smart" traffic light, he asked me about wireless and I'm going to show him this answer. \$\endgroup\$
    – Marc.2377
    Commented Mar 1, 2017 at 3:34
  • \$\begingroup\$ (OT) I'd really question the value of an alarm system in your case, versus a fake alarm box with flashing light on the side of the house. PIR lights over dark areas and cheap camera recording systems (NOT Internet-linked!) may be a better investment. \$\endgroup\$
    – pjc50
    Commented Mar 1, 2017 at 10:39
  • \$\begingroup\$ Purchasing an alarm siren and entry key panel for visible external placement, second hand may serve the same purpose. Adding your own custom system makes it harder for the thief to bypass because the real alarm is not the popular type XYZ that can be jammed easily. \$\endgroup\$
    – KalleMP
    Commented Oct 22, 2018 at 4:16
5
\$\begingroup\$

Yes, it is possible to jam wireless alarm systems, probably even with low-cost, low-tech DIY devices (google "broadband jamming DIY"). There are a couple of articles online which report successful attempts, for example this one by Cnet and this one by Forbes. There is also a blog post by a producer of such systems. Both Frontpoint and SimpliSafe, two producers of wireless alarm systems, claim to have proprietary algorithms in place which distinguish between random signal loss due to unrelated interference and an actual attack. (This was a concern I had in a comment to one answer here.) Of course it is impossible to verify these except by performing a comprehensive test.

What I take away from the articles and some other discussions on the net is:

  • Yes, it is easy to jam the signal.
  • Such attacks are extremely rare, to the point that Frontpoint claims in the blogpost that no successful jamming attack on their systems has ever been reported. Most burglaries are untargeted crimes of opportunity.
  • The system may or may not respond properly to jamming attacks.
  • Both systems raise an alarm via cell phone which is easy to jam as well, and this time the alarm system can do nothing about it. Of course, cutting the landline is usually easy as well.

tl;dr: Don't worry unless you are a high-profile target.

\$\endgroup\$
1
  • \$\begingroup\$ Good point, the armed security may never know that the alarm panel has detected local jamming because the remote link is also jammed. This can be mitigated in part by always on data connection that also has a heartbeat. SMS systems will usually not send regular heartbeats, they may send a battery status daily or less often and then mains failure and alarm status as it happens (if not jammed first). \$\endgroup\$
    – KalleMP
    Commented Oct 22, 2018 at 4:13
3
\$\begingroup\$

If it is not possible to jam the system and break in, then it should be possible to jam the system and start the alarm. One of these has to be true: if the alarm controller receives no meaningful communication, it has to decide what to do, which can be either "nothing" or "alarm of some sort".

Depending on what the alarm does you'll then have to deal with either your neighbors annoyed by the noise, or police/security coming to your house. If I were to buy such a system, the first thing I'd ask about would be how difficult is to trigger a false alarm and how much it would cost me.

\$\endgroup\$
1
\$\begingroup\$

Most off-the-shelf alarm systems out there are outdated or insecure-by-design crap sold at a huge markup by salespeople who rely on your fears. I've got a storage room full of access control systems and components at my workplace and I haven't seen any single decent one (we ended up developing our own for our clients).

I would not expect any of those systems to either use encryption or protect against jamming, so unless you can have a demo of those features in action, don't buy it. A good system should use good crypto for its communications as well as be able to detect jamming (the wireless devices send a heartbeat every X seconds, and if too many are missing then sound the alarm).

\$\endgroup\$

Not the answer you're looking for? Browse other questions tagged or ask your own question.