8 Charles Parker II "Consumer Electronic Security Systems"

### Overview In this talk, Charles Parker II discusses the inherent security weaknesses found across modern consumer electronic security systems. Despite aggressive marketing framing these products as dependable, professional-grade home protection, laboratory testing demonstrated that widely sold systems can be trivial to defeat using inexpensive, off-the-shelf items such as magnets, metallic potato chip bags, and ham radios. Parker presents practical physical bypass attacks against entry sensors and base stations, explores tracking behaviors in mobile companion apps, and covers hardware and software analysis of an indoor consumer smart camera.

### Key Topics - **Physical Sensor Bypass via Magnetism**: The underlying flaw in magnetic reed switch door and window sensors that permits external or internal defeat. - **Base Station RF and Notification Failures**: Suppressing alerts and base station communication via makeshift Faraday shielding (metallic potato chip bags) or RF jamming. - **App Tracking and Aggressive Retention**: Telemetry and aggressive user engagement patterns observed in consumer security mobile applications. - **IoT Camera Hardware & Software Analysis**: In-depth inspection of the Nooie Cam Indoor (IPC007-1080P), including APK permission overreach, unencrypted QR code credentials, and shell access. - **Responsible Disclosure Realities**: Challenges in reporting vulnerabilities to manufacturers, with multiple vendors failing to respond after dozens of contact attempts.

### Technical Details - **Reed Switch Defeat**: Consumer window and door contact sensors rely on magnetic reed switches—two overlapping pieces of metal encased in glass or plastic. When doors or windows close, an accompanying magnet pulls the reeds together to complete the circuit and arm the system. Attackers can defeat this mechanism simply by introducing an external magnetic field (using an $8 to $13 magnet, or magnets mounted on a probe/stick inserted through a gap) to keep the reeds closed while opening the door. During testing on simulated 1.25-inch wood doors, sensors could be separated by 2 to 2.5 inches without triggering an alarm chime due to overly strong magnets or loose tolerances. - **Base Station Suppression**: The central hub that collects sensor data can be blinded by placing a thick, metallic-lined potato chip bag (tested with an Ace potato chip bag) over it to block signals. Alternatively, attackers can jam base station frequencies using a $60–$70 ham radio. Furthermore, at least one tested system failed to report to the user that its base station had been offline for 39 hours. - **Nooie Cam Indoor (IPC007-1080P) Vulnerabilities**: - The companion Android application (APK) requests extensive permissions, including Bluetooth administrative access, precise GPS coordinates, Wi-Fi state changes, keyboard disabling, and silent background downloads. - App code selectively handles devices based on phone manufacturer strings (e.g., Xiaomi, Huawei, Baidu, Ali, Tencent). - The setup QR code transmits Wi-Fi credentials in plaintext (encoding BSSID, SSID, security type, and network password directly). - Analysts extracted local storage from the MicroSD card, identified hardcoded values and disguised Wi-Fi routines in code, and achieved root/interactive shell access during setup.

### Takeaways Many consumer home security systems provide a false sense of security, relying on vulnerable, low-cost hardware mechanisms lacking anti-tampering defenses. Complete physical and communication bypasses can be executed with approximately $110 in accessible equipment and no specialized tools. Consumers and organizations deploying low-cost or commercial variants of these units must recognize their physical bypass limitations, while manufacturers must prioritize hardware tamper detection, encryption of setup credentials, and responsive vulnerability disclosure channels.