ABUS Secvest Spoofing Attack against Hybrid Module FUMO50110 скачать в хорошем качестве

ABUS Secvest Spoofing Attack against Hybrid Module FUMO50110

In this PoC video, SySS IT security expert Matthias Deeg demonstrates a spoofing attack against the insecure wireless communication of an ABUS Secvest wireless alarm system [1] and its hybrid moduleFUMO50110 [2]. Due to missing security features regarding confidentiality and integrity of the used radio communication, an attacker can spoof messages of the ABUS Secvest hybrid module, for instance in order to deactivate the wireless alarm system in an unauthorized way. For example, when a key switch is programmed for an output of the ABUS Secvest hybrid module, a single sniffed status packet, which is sent at regular time intervals (approx. every 2.5 minutes) from the hybrid module to the wireless alarm panel, can be used by an attacker to forge a valid disarm packet. This security vulnerability described in our SySS security advisory SYSS-2020-015 (CVE-2020-14158) [3] was found by Michael Rüttgers and Thomas Detert. Based on a software tool used for exploiting a related security issue (see SySS security advisory SYSS-2018-035 [4]) concerning the ABUS Secvest remote controls FUBE50014 and FUBE50015, a new PoC tool for performing a spoofing attack against the affected ABUS Secvest hybrid module FUMO50110 was developed. [1] Product Website for ABUS Secvest Wireless Alarm System https://www.abus.com/eng/Home-Securit... [2] Product Website for ABUS Secvest Hybrid Module https://www.abus.com/uk/Home-Security... [3] SySS Security Advisory SYSS-2020-015 (CVE-2020-14158) https://www.syss.de/fileadmin/dokumen... [4] SySS Security Advisory SYSS-2018-035 https://www.syss.de/fileadmin/dokumen... #hack #spoofing #attack