How to Hack an ADT Alarm System

Author: Brian Rhodes, Published on Jan 26, 2015

This report explains the key steps in hacking an alarm system, like ADT, as was presented in a Defcon 22 presentation.

The risk of such a hack has become major news as a class action lawsuit was filed against ADT recently, claiming that ADT could be 'easily hacked'.

Summary

According to the Defcon 22 presentation, the most straightforward way to hack / disable an alarm system is to:

  • Find out the frequency the alarm system transmitter uses from publicly available FCC documentation.
  • Get a software defined radio, set it to that frequency to jam it.
  • Periodically, for very short periods of time, stop jamming to overcome / trick anti-jamming functionality in the system.

For those interested in reading the original research, see Logan Lamb's Defcon 22 whitepaper and presentation.

Finding Frequencies

The hack relies on knowing which unencrypted wireless frequencies are used by intrusion alarms. Specifically, the frequency band used by individual types of sensors and devices. In the US, commercially sold wireless devices are issued licenses by the FCC and the specific frequency they use for communication is public record.

For example, Honeywell's license catalog includes over 300 license applications since late 2011. The record includes frequency information for devices like:

Indeed, even 'proprietary' systems sold to major alarm companies carry public FCC filings, like this ADT keypad and the entire wireless 2GIG catalog.

A quick search of most major alarm companies return records, including

Get Video Surveillance News In Your Inbox
Get Video Surveillance News In Your Inbox

  • UTC (GE, Tyco, ADT) (310.0 MHz to ~990 MHz)
  • Vivint (~905.0 MHz)
  • Napco (~319.0 MHz - 320.0 MHz )
  • Sensormatic (~550.0 MHz - 927.25 MHz)

See the full list of companies with FCC applications on file here.

To exploit this weakness, the main challenge is knowing which system / transceiver the site being targeted uses. This would be easiest for inside jobs, but possibly quite hard going after a facility one has never been in. In any case, prominently displaying window stickers or yard signs could actually assist a hacker into zeroing in on a specific range of frequencies:

Software Defined Radio

The equipment needed to search out, monitor, and jam these frequencies are commonly classified as 'SDRs' or 'Software Defined Radios' and are widely available. The primary function of these devices is to scan a range of radio bandwidth for activity on known frequencies. Using USB connected scanner cards and laptops, an entire spectrum of wireless traffic is visable:

The specific type of SDR demoed in the Defcon hack is profiled in the video clip below:

Once wireless alarm activity is observed, exploiting it is straightforward. For example, this Vivint Motion Detector is shown to operate at 345.0 MHz. Disrupting normal communication with the wireless control panel requires overpowering or jamming alarm signal from that sensor using the same setup.

Overcoming Anti-Jam Protection

Some alarm systems are equipped with anti-jamming features that monitor for this tactic. The cyber-researchers found that if the jamming is turned off for a fraction of a second, and right back on that it would still stop the system from triggering its anti-jam alert while still blocking real alerts from being sent when an intrusion occurs. In general, panel RF Jamming features must be enabled by the installer.

For example, the researchers defeated Honeywell's protection by running a jam for 20 seconds, turning it off for one second, then rerunning the jamming routine. (See Defcon Whitepaper Section 4.3.2) This process effectively defeated the panel's anti-jamming protection. Another exploit for 2GIG/Vivint panels modified the process by turning the jam on for 50 seconds, but turning it off for 0.2 seconds.

The specific parameters of an anti-jam process vary according to panel type, but researchers found the protection could be defeated with trial and error in test systems.

Not a Cheap Hack

The equipment cyber-researchers used to pull off the exploits are quite expensive. The pricing for the requisite SDR with ample power ranges between $1000 and $4000 USD, and require a high level of technical experience to deploy effectively.

The Defcon researcher reported his setup cost more than $2000, a cost that will certainly be out of reach or tolerance for many 'smash & grab' criminals.

While SDRs are easy to get and inexpensively available online, like this $15 example from Amazon, their effectiveness has not been evaluated. The whitepaper only reflects results achieved by using moderately expensive, professional gear.

Other Advanced but More Complex Exploits

The equipment and basic process of this exploit can be modified into other methods for tricking alarm systems. For example, the basic jamming attack might also be used to spoof the (non-alarming) presence of supervised alarm sensors if exact device details are known. However, such an attack would likely require significant time investment not typical of random 'smash and grab' robberies. These are explained in more detail in Logan Lamb's Defcon 22 whitepaper.

2 reports cite this report:

Bosch Intrusion Detection Profile on Aug 10, 2016
This is a first in a new IPVM series profiling intrusion detection / alarm offerings. In this series, starting with Bosch, we examine: Key...
ADI Scare Tactics Against DIY Security on Nov 27, 2015
ADI wants you to buy alarm system parts from them, not those kits on the Internet. Leveraging scare tactics, they have made an unsurprisingly...

Comments (1)

Only IPVM PRO Members may comment. Login or Join.

Great article, we do our best to stay away from wireless alarm devices. However, when we do use them we use spread spectrum, 2 way wireless.

Related Reports on Wireless

IP Networking Course January 2017 on Jan 12, 2017
This is the only networking course designed specifically for video surveillance professionals plus it includes live training, personal help and...
Honeywell Ademco Vista Intrusion System Tested on Jan 11, 2017
One of the biggest brands in security holds one of the most common intrusion lines. We bought and tested a Honeywell Vista 15P intrusion...
10 Key Comparison Metrics For Intrusion Panels on Jan 10, 2017
In this note, IPVM reviews fundamental features and attributes for evaluating and comparing intrusion alarm panels.  These criteria are: Number...
Ubiquiti $99 Mesh Node Challenges Wireless Competitors on Jan 05, 2017
Ubiqiuti has become a significant force in wireless video surveillance applications but they have never done mesh. Historically, mesh has been...
Introduction To Burglar Alarm Systems on Jan 04, 2017
While alarm systems are popular, balancing between the right level of protection, the appropriate components and an acceptable price can be very...
Secured Combo Controller - Hartmann Access on Dec 12, 2016
Typically, combo controllers are risky, because they combine sensitive door controllers with readers on the exposed unsecured side of the...
No One Should Ever Use Simplisafe on Dec 12, 2016
Simplisafe, the upstart DIY intrusion alarm system, is increasingly Public Enemy Number One in the alarm business. Recently, Security Sales ran an...
The Russian SMP Security Robot on Dec 08, 2016
A Russian manufacturer, SMP, has a commercially available outdoor security robot, at a lower price and with much less marketing than their main...
Allegion NDE Wireless Lock Examined on Sep 29, 2016
While wireless locks are one of the hottest areas of access control, two of its biggest challenges are high cost and limited integration with...
Totally Wireless IP Camera (IPVideo Corp NomadHD) on Sep 21, 2016
Wireless battery powered cameras have been a surveillance pipe dream for years, limited by camera power consumption, battery technology, and...

Most Recent Industry Reports

Jim Cramer Sucks Up To Knightscope on Jan 19, 2017
Credit must be given to Knightscope. They are raising money right now and despite their $80 million pre-money valuation against a lowly sub $1...
ADT Launches Canopy - Professional Monitoring For DIY Devices on Jan 19, 2017
The intrusion industry has criticized DIY security systems for years, claiming systems like Canary or Scout cannot match professionally installed...
Dahua (Un)Favorability Results on Jan 19, 2017
Dahua, the mega-Chinese surveillance manufacturer not primarily owned by the Chinese government has been trying to break out of the shadow of...
Paxton Hosted Access - Disruptive Low Dealer Pricing on Jan 19, 2017
Paxton is entering the hosted access game, with BLU, at a cost that is a fraction of key competitors. The different approach could be very...
Geovision Launches Direct Cloud Offering on Jan 18, 2017
Add cloud, subtract integrator. Geovision has launched myGVcloud, an offering that allows consumers to buy cameras and cloud services directly...
Anixter / Bosch Sells Direct to Amazon on Jan 18, 2017
Anixter regularly says they do not sell direct to end users or that they do not do it anymore. However, over the past year, Anixter has sold Bosch...
Smart Power Tools For Security Installs on Jan 18, 2017
Installing a smart camera? Perhaps you should use a 'smart' drill. The intelligent appliance / IoT trend has hit power tools. In this note, we...
Canon 250MP Prototype Targeted At Surveillance on Jan 17, 2017
At one point Axis declared the megapixel race was over, but now parent company Canon is showing an imager that would be a rocket ship in a...
Cut in Half, Everfocus Shifts Strategies on Jan 17, 2017
The race to the bottom impact continues. Now, Everfocus, who used to be one of the larger budget providers, is shifting strategies after years of...
Top ISC West 2017 Booth Moves on Jan 16, 2017
There are significant moves among many major manufacturers on the ISC West show floor, and very few prime spaces left unoccupied. In this report we...

The world's leading video surveillance information source, IPVM provides the best reporting, testing and training for 10,000+ members globally. Dedicated to independent and objective information, we uniquely refuse any and all advertisements, sponsorship and consulting from manufacturers.

About | FAQ | Contact