LifeSafety Power NetLink Vulnerabilities And Problematic Response

By: John Scanlan, Published on May 20, 2019

'Power supplies' are not devices that many think about when considering vulnerabilities but as more and more devices go 'online', the risks for them need to be considered as well.

Indeed, Security researcher Bashis has discovered various vulnerabilities in LifeSafety Power NetLink devices.

LifeSafety Power NetLink Vulnerability1

IPVM spoke with both Bashis and executives at LifeSafety Power. Inside, we provide details on this vulnerability including:

  • Vulnerabilities overviewed
  • Devices affected
  • Impact of vulnerability
  • Why Life Safety Power failed to respond to multiple reports until IPVM intervened
  • What Life Safety Power says they are doing now to improve their cybersecurity process

Related, see IPVM's Cybersecurity Vulnerability Directory

'***** ********' *** *** devices **** **** ***** about **** *********** *************** but ** **** *** more ******* ** '******', the ***** *** **** need ** ** ********** as ****.

******, ******** **************** *** ********** ******* *************** in********** ***** ******* *******.

LifeSafety Power NetLink Vulnerability1

**** ***** **** **** Bashis *** ********** ************ *****. ******, ** ******* details ** **** ************* including:

  • *************** **********
  • ******* ********
  • ****** ** *************
  • *** **** ****** ***** failed ** ******* ** multiple ******* ***** **** intervened
  • **** **** ****** ***** says **** *** ***** now ** ******* ***** cybersecurity *******

*******, *** ****'************** ************* *********

[***************]

LifeSafety ***** ******* ************* ********

******* ******* *** **** with ****** ******** ******* to ****** ******* *** control ****** ***** *** receive ****** ********* ****** or ******** *********.

Impact ** *************

********' ***** ** ******* report *****, *** ******** ** high, **** ******* *************** including ************ ****** ** clear **** ***********, ** the ******* **** *** PoC *****:

***** ******** ** ** cameras, ***** *** ****** far **** ** ***** devices, ***** ******* *** generally **** ** ****** security ********** ***** ************ of **** *************** ***** be **** ***********.

Patch *** *************

***** **** ******** ******* can******** ******* ******** **** their ******* ****. *** ***** ******* ******** NetLink ******* ** ***** network, *** ********** *** ** downloaded ****, *** ** **** to ****** *** ***** upgrade ********.

Devices ********

*** ******* ******** ******* the NL2 *** *** ******* firmware ******** *.**, *.***-** and *.***-***.

Poor ******** ** ******** *************

****** ****** **** ******* attempts ** ******* *** before **** ******* *********. The ******** ***** ***** this **** **** ******** 2018 - ***** ****.

******** **, ****: ****** contacts ******** ******** **** VDOO **** *** ********, and **** ******* ** contact *** **** *** findings ******** ***** ** no *****.

******** **, ****: **** returns *** **** ** him ***** *** *** failed ** *******. **** the **** *** **** Bashis ******** ** ******* LSP *******, ***** **** ignored, ******* **** **** thought ** *** * phishing *******.

******** **, ****: ** a ***** ****** ** provide *** * ****** to ****** ***** ******** and ******* ****** ********** his ********, ****** ******* out ** ****. **** was **** ** *** in ***** ********** ***** and ******* **** **** Bashis.

***** * ****: *** firmware *** ******** *** provided ** ****** *** testing.

***** * ****: ****** confirmed *** ******** *** corrected.

*** ********* ****:

***** *********** ********** ***** was * ******* **** **** ** stating * ************* *** found ** ******* *** ** appeared ** **** **** a phishing email and so wasn’t ***** **. **** *** our *******.

**** ** ****** ***** of *** ******** ***** in ******** (*** **** Honovich ****** ** *****) we ***** ********** *** matter **** ***.

Improvements ********** *******

*** **** *** **** will ** **** ******** about ******** ********:

***** ******* *** *** and *** ********* **** will ** ****** ** *** ************* ******* *********, ** matter *** ******.

**** ****** ********* ************ in ***** ******** *********** process:

*** ***** *** ********** during ******** ***********. ** have ******** *** **** review **** * ***** security ****** *** **** plan ** ********** ********** external ***** ***** *******.

Default ******** *******

*** ******** ******* **** with ******* *********** ***** are ********** ** ** changed **** * ***-** message *** *** *** required ** ** *******. Due ** *** **** associated **** ******* ***********, they **** ********* ** ****************** ** ******* ****.

Response ** ******* ******** *****

*** ********** ** ***** allowance ** ******* *********:

*** ******* ******** ** ******** provided for ******* ***** *** testing ** *** ****** (common ******** ** *** industry). To ****** ***** ** setup ****** ********, ** ***** a “***” ******** **** *** default ******** ** *** ****** and ** ****** ** changed to * ******* ******** password ********** ** *** customer ** *** **********. *** warning ******* ******** ***** time ** ***** ** long ** *** ******** has *** **** ***** properly.  **** * ******** is ******* ** ** required ** **** * -14 ********* **** * mix ** *******, **** sensitive *******, *** ******* characters. We **** ******* * survey ***** *** ******** base *** *** ** we ****** **** *** Netlink ******** ***** ***** to ***** ****** ******** the ***** **** **** login. ********* ** *** survey *******, ** *** change *** ******** ** force ***** ** ****** the ******* ******** ***** their ***** *****.

****: ** ******** ***** it ***** '******** ********' in ****, ************ ********* have ********** *** ******* password, ******* ***** ** set * ******** ** first ***.

Device ********* *****

*********** ********* ************* *** ** ****, recommending ***** * ****** IP ******* ** * cybersecurity **********, ******* ***** alerts, *** ***** **** rather **** ***** ** you **** **** ******* is ******:

Reminder ** ******* *****

**** ** * **** reminder **** ** **** devices **** *** '******** of ******', *************, ***********, and ***** **** ** be ******** ***** ************* vulnerabilities. 

Comments (27)

Undisclosed Integrator #1

05/20/19 02:40pm

"****** ****** **** ******* attempts ** ******* *** before **** ******* *********. The ******** ***** ***** this **** **** ******** 2018 - ***** ****."

******, **** *** **** difficult ** *********** ****.  Communications **** **** ******* are ****** ***-********, **** have ***** ******** ***** no ****** **** *** question...  *** **** **** too ****, ************ ** just ***** ********?

**** *** ******* ** their *********, *** *** to ***** ***-**************, *** only ****** **, "****"!

Undisclosed Manufacturer #2

05/20/19 04:19pm

**** ****** **** *** message ** *****-*******. ********* basic ********* ********* ** *** switch ** ******** * manufacturer's ********. *** *******/******** prevention, ******** **********, ******** turned ***, ***** *********** all *** **** *******/******** exploitation, **** ** *** absence ** * ***.

Undisclosed End User #3

05/20/19 05:15pm

***** ****** *** *** uniqie ** ***, **** is * ******** **** probelm **** *** *-***** better *** *** ** front ** ****** *** comes **** ** **** them ** *** **********. 

* ***** **** ** see ******** ** *** IPVM ********* ** *** who **** ****** ***** concerns ***** (****** *** pun) *** ********** ************ of *******.  * **** want ** **** **** LSP **** **** * cyber ********** *** **** curious *** **** ****** cyber ** #* ******* when ********** ********.

* ******** *** ******** but ***** *** ** are ******** *** ******* until ***** ** **** EIT/EIS ********** ** ******* pen-tesing **** ** ******* else ***** **** ************ or ***** *** *****.   I **** *** *** LSP **** *** ******* modular ** * *** use *** ******* *** and *** ** *** '"connectivity" ** * ***** date.

John Honovich

IPVM | In reply to Undisclosed End User #3 | 05/20/19 05:46pm

***** *** ** *** removing *** ******* ***** there ** **** ***/*** Evaluation ** ******* ***-****** dont ** ******* **** other **** ************ ** thier *** *****

*** ***** ** ****? 

Undisclosed End User #3

In reply to John Honovich | 05/22/19 05:17pm

** ******** *** "************ Piece" ** ****** ** to **** ** * non-technology ***** (********** **********) and ***** **** ** deploy *** *** ******* Solutions ** ******* ********** and *********** ****** *** enterprise (**** ***+ ********). 

**** ***/*** *** **** to ******** *** **** Test *** ******* *** approves ** ** * "Connected ******" **** * can *** **** ** the *** *** **** advantage ** *** *** monitoring *********.

** ** ***** (********* institutions) ********** ********** ** the **** ** *** game, ** ****** ********** requirements ******!  ** ** is "** *******" **** it ******* ******* ***********, long **** *** *** days ** **** ***** a ******/******** *** ** host ***** *******.

bashis mcw

05/20/19 06:12pm

**** ****** ** **** for ******* ** ************ the ******* **** ***, its *** ***** *** last ******** *** **, and **** ****** ** LSP *** **** ******** and ******* ** ***** this ************ ** ****.

John Olliver

05/20/19 09:31pm

********** ***** ***** **** responsibility *** *** ************* found ** *** ********** Bashis.  ******* *** *** the ******** ***** ***** penetration ******* **** ********** had ********** **** ******* so ** ******* ***** that ** ***.

***** ********** **** ******, a ******** ***** *** done *** ******** ** him *** ************ ** operation. ****** ****** *** confirmed ******* (**** ***********) and ** ******** *** new ******** *** *****.

*** *** ***** *** reputation ** ******* *** response ** *** ********** which *** **** * key ****** ** *** growth ***** ***** *** beginnings.  ** ******* **** those ********** *** ******** to *** ***/*** ***** was ********, *********, *** acted **** ****** *** day ** ******** ************. Up ** **** *****, there *** **** *** email ** *** ******** of * ******* **** the ***/***. **** ***** sender *** ******* ** us, *** ** ******* identification, ** ***** ****** and ** *********** ******** affiliation *** *** ******* in * ****** **** did *** ****** ********. There ** ** ****** within *** ***** ** a ******* ********** ** VDOO *** ** **** never **** ******** ****, or *** ******* **** that *******.

*** **** ******* ***** uses *** **** “***************” (plural), ****** *** ********** that ***** *** ******** issues **** *** ****** but **** *** **** changes *** ******* ** “vulnerability” (********). “***************” ** misleading. *** ***** ** the *********** ******** ** not * ************* *** the ****** ** ******** request ** **** ****** to *** ** ****** for **-***** ***** *** configuration ******* *** **** to **** ******** ******** records ***** ** *** unit ***** ** **** and ****. **** *** be ******* ** ********* (or ****) ******* **.

**** ******** *** ******** in * ****** ****** LSP ** *** ********** involved ** ******** ********** such **** **** **** of ***** ** ********** and * ****** **** will ****** ** ************* queries ***** ********.

*** ********** ** ****** first *** ******** ** our **** *** ** will ****** **** ******** steps *** ********* ** uphold ** *** *** responsibility ** *** *********. 

**** *******

** ** ***** *** Marketing

********** *****

 

** *********** ********** #*...

*** **** **** ** highly ******* ** ******* and ******* ** **** comment **** *** ****"***** *** * ****** call"  ***** ****** *** ** character.  ** ** **** a *********** ******* *'* not ***** ** * would **** ** ********** that *** ******* **, so ****** ******* **. Direct **** (***) ***-****.

* **** ****** **** call.

John Honovich

IPVM | In reply to John Olliver | 05/20/19 09:38pm

*** **** ******* ***** uses *** **** “***************” (plural), ****** *** ********** that ***** *** ******** issues **** *** ******

***, ****'* ************* *** ***** ******** vulnerabilities(******), ** ************ *****:

** *** *** ** into *** ******* ** each ************* *** ****** of ***** *** ********* complexity *** ***** *** multiple ***************.

Undisclosed #4

In reply to John Olliver | 05/20/19 09:39pm

******* *** *** *** multiple ***** ***** *********** testing **** ********** *** identified **** ******* ** we ******* ***** **** he ***.

** *** *** ******* did *** ******* ****** code ******, **** ** is ******** *** ***** ever **** *************** **** this. ******** *** ******* tends ** ****** ***** on ******* *** ***** exploits *** ****** ****** like *** ********* ** form ************. 

** **** *** ******* included ****** **** *******, then *** ****** ******** ask *** * ****** (not ******** ***** *************** were **** ** ****, but * ****** **** should **** ***** ** least **** ** *** basics.

Undisclosed #5

05/21/19 01:49am

***** ********' *** *** devices **** **** ***** about **** *********** ***************...

*’* ***** **** *** fact **** ****** ** now ******* ***** ******** as * *********** **** that ** ******* *** have ******** ********.

** ****** *******, *’* an *****.

 

Undisclosed #6

05/21/19 07:49pm

*****, * (************* *********) disclaimer -- ***** **** to ****** *** ******* this *************. * **** it **** * *** that * ***** *** that *** ************* ** the ***** ******* ** the ******** ******** ******** the ****** **** ** IPVM ********.

**** **** ****, ***** it's ************ **** **** a ************* ******* ** the *** ******* ** the ***** *****, ** I ** ************* ** correctly **** *** ******** versions ***** **** ************* was ********** *** *.* and *.**, **** ** another ******* ******* ** how ***********/********* ********** **** cyber ******* ** *** first ***** ***** ******** this ************* ** *** first *****. **** ******** release *****, ** ***** like *.** *** ******** in ******* ** ****, and *** **** *.* revision *** ** ******** of ****. * **** that *** ** **** were ******** ** *.** last *****.

***** ************ ** *********, but ************ * ********* check ** *** ******** revisions *** *** *******-********* devices ****** ** * bare ******* *********** ***** days. **** **** ****** to ** ** **** often, *** ****** ***** an **********-***** ******* ****** be **** ** ** quarterly ******* *** *****.

***** -- ***** ** all ******** *** ******* the *************, *** ** LSP *** (**********) ****** it.

** * ********, *** those *** *** **** LSP ** ************, *** literally **** ** ******* the ***** ****** ** just **** ****** *** luck. ****'** *** ** the *** ************* *'** dealt **** **** ******** respond ******* ****** ***** time * **** ******* them.

John Honovich

IPVM | In reply to Undisclosed #6 | 05/21/19 08:40pm

* ***** *** **** his ************* ** *** cyber ******* ** *** security ******** ******** *** entire **** ** **** combined.

****** ************* *** **** significant **** *** ****** industry ********. **'* ********** vulnerabilities ******,*****,*********,*******,***, ** **** **** a ***, **** *** made *** ******** *** more ***** ** ***** risks.

** *** *** **************, the **** **** **** though ** ***** **** 'bahis' *** ******** ** a **** ************* ** the ********* ** ************* issues ** **** ******** and ****, **** *************, their ******* ******** '******'***** ***** *** ******** prominent ********** ** *** work.

Undisclosed #6

In reply to John Honovich | 05/21/19 11:39pm

****, ******* ****** *** knowledge ** **** ******** Bashis **** ** ***** out ** ****, * would ******** ** ** the **** ***** ********* that ****** *** ******* was ********* *********** ** an ***** ******** ** that ** *** **** by * ***-***** ******** service ****** *** *********, either ******* **** *** no **** **** ** was ****** ** ******* they **** **** ** was **********. *****, *** the ****** ** *** world ** ****** ****, but * ***'* ***** it's ********** ** ****** to *** **** ******'* written ******* *** ********* come ****** ** *********** from ****** ** *** ******* King ** ******* ** ********* *******...** ********** intended, *** *'* **** saying...

****** ***, ** ***** is **** * ***** hope **** **** ******* doesn't ******* *** ** an ****** ******** ***** as "************" ** *** caring ***** ***** ******. My ********** -- *** obviously *** ********** ** others -- ** ******* the ******** ** **** regards, *** ****'* ******* evidenced ** *** ********** quick *** **** **** released **** **** ******** it *** *****.

John Honovich

IPVM | In reply to Undisclosed #6 | 05/21/19 11:49pm

** **** ** *** read ** * ***-***** customer ******* ****** *** discarded

****'* * **** *******. They ***** **** **** the ***** *** ***** vulnerabilities *** ** ***** that ****** *** *** name *****. ***** ** them ** **** *** not **** *** ****** is *** *** *** think ***** ******** ***, which ***** **** ****** and ******* ********* **** it ****** ** ** examined *******.

* ***'* ****** ***, I ***'* **** **** Olliver, ** * ** not ****** **** *** good ** *** *********, just **** ***** *********** for *** ********** ** the ************* *****(*) **** not **** **** ***** to **.

Undisclosed #5

05/22/19 05:41am

*) ***** ****** *** typically **** ********* (****** windows).

*) ** ** ********** that ****** ** ************ ** * *********** ******(*** ****** ***** *****) and ****(** ***** ****** ************).

*) **********, *** ********** clearly *** ******** ** all ***** **** ********* of *** ******, ***** by *** *** *****.

*) **** ** **** don’t ******* **, ***** hackers *** ***** ********* to ***** ***** ** gaffes.

*) ********* *** ** big ************ ***** ****** ********* dissonance ** *** ****** researcher, ** ** ************** feels ******** *********** ***** with *** ******* ** the ********* *********** ****-**.

********* *** *** ** the ********** ****** ****** ** ********** ** once ** ***** ** the ***************, ** ***** *****.

 

bashis mcw

In reply to Undisclosed #5 | 05/22/19 05:26pm

*** *** *** *** of *** *****, *** me ******* *** * bit **** **** ********* URL 

*****://***.********.***/****-******?*******=******

 

Undisclosed #5

In reply to bashis mcw | 05/23/19 12:28am

* ***** *********, **. w.

bashis mcw

In reply to Undisclosed #5 | 06/06/19 06:57pm

*** * * *****, my **** ** ******* "bashis" *** *** "******", however *'* *** ** sensitive ***** ****  ;)

Undisclosed Integrator #7

05/24/19 03:00am

*********:  ****** ** **** what *** ** *** a ****** ** ** this * *****?  *'* not ******* *** **** gets ********* ** *** I ***.  *** *** doing ********** **** *** I **** ***** ** some ****** ** **** for ***.

bashis mcw

In reply to Undisclosed Integrator #7 | 05/24/19 07:39am

** ** **** ****, reward ** ******* **********.

Avatar

Scott Napier

08/26/19 05:09pm

** * *** *** is ******* ** *** for * ****** **** will ** ***** ** least ** ** *****, now * **** ** verify **** **** **** actually ***** *** *******. My **** *****.

bashis mcw

In reply to Scott Napier | 08/26/19 07:40pm

* ***** ********* *** to **** **-** **** with ****** **, **** you “******” ** **.

Rodney Thayer

Smithee Solutions LLC | In reply to Scott Napier | 08/26/19 08:45pm

*********** ******** ********* ** a *********** ******. ** yes ***'* **** ** verify **'* *** ****** version, *** *** ****** have ******* **** ******** the *******...

Avatar

Scott Napier

In reply to Rodney Thayer | 08/26/19 09:53pm

**** ** * ****** thing. **** *** ********* yet.

Jim Elder

09/11/19 03:46pm

* ********** **** *** has **** **** ** Assa *****. ** *** think **** *** **** or ****** *** ******** with ********?

Avatar

Brian Rhodes

IPVMU Certified | In reply to Jim Elder | 09/11/19 04:04pm

***** ***, *** *** post ** *** ****:**** ******** ********** *****.

** ** ********* ** be ******** ******* *** buy ***** ** ***** LSP ****** *********, *** it ** ***** ******** out **** **** **** week ****** * '***** ******** *******' ************* **** *** in ******.

*** ****** ********* *** responsibility ** ************* ** a ********** ***** ** people ****** **** ** likely ** ****** ** a *********** ***** ****** brands, ****** **** ********** be ******** *** ******** within * ***** ******* like ********** ***** *****.

Undisclosed #8

09/11/19 04:52pm

*** *** * **** the "***** ******** ****** (HID5442)" **** ** **** Long *****. ***** ** not * *** *****, Mercury *** ***** ***** "we **** *****" ********* noise ;-)

Login to read this IPVM report.
Why do I need to log in?
IPVM conducts unique testing and research funded by member's payments enabling us to offer the most independent, accurate and in-depth information.

Related Reports

Altronix Claims Tango 'Eliminates Electricians' on Oct 15, 2019
Power supply provider Altronix claims its new Tango power supply 'eliminates the need for an electrician, dedicated conduit and wire runs'. In...
Last Chance - Register Now - October 2019 IP Networking Course on Oct 10, 2019
Last Chance - Register Now - Fall 2019 IP Networking Course. The course starts next week. This is the only networking course designed...
HID Fingerprint Reader Tested on Oct 09, 2019
HID has released their first access reader to use Lumidigm optical sensors, that touts it 'works with anyone, anytime, anywhere'. We bought and...
Avigilon H5A Analytic Cameras Tested on Oct 07, 2019
Avigilon has released its H5A analytic cameras, claiming to "detect more objects with greater accuracy even in crowded scenes." We tested the...
'Bunker Busting' Wireless Access Startup: Sure-Fi Profile on Oct 03, 2019
An access startup is claiming its 'bunker busting' wireless Wiegand radios can punch through 'any obstruction'. We examine their offering,...
Fail Safe vs. Fail Secure Tutorial on Oct 02, 2019
Few terms carry greater importance in access control than 'fail safe' and 'fail secure'. Access control professionals must know how these...
Lasers Impact on Surveillance Cameras Tested on Sep 25, 2019
Hong Kong protests have brought global attention to video surveillance and the ongoing attempts of protesters to disable or undermine those cameras...
Assa Acquires LifeSafety Power on Sep 04, 2019
Assa Abloy is acquiring LifeSafety Power, adding to their growing collection of access control brands like Mercury, August, Pioneer Doors, and...
Mobile Access Control Guide on Aug 28, 2019
One of the biggest trends in access for the last few years has been the marriage of mobile phones and access cards. But how does this...
Critical Vulnerability Across 18+ Network Switch Vendors: Cisco, Netgear, More on Aug 26, 2019
Cisco, Netgear and more than a dozen other brands, including small Asian ones, have been found to share the same critical vulnerability, discovered...

Most Recent Industry Reports

Government-Owned Hikvision Wants To Keep Politics Out Of Security on Oct 21, 2019
'Politics' made Hikvision the goliath it is today. It was PRC China 'politics' that created Hikvision, funded it, and blocked its foreign...
Integrated IR Camera Usage Statistics 2019 on Oct 21, 2019
Virtually every IP camera now comes with integrated IR but how many actually make use of IR or choose 'super' low light cameras without IR? In...
Alarm Veteran "Demands A Criminal Investigation" Of UL on Oct 18, 2019
The Interceptor's Project pressure against UL continues to rise. Following Keith Jentoft's allegation that "UL Has Blood On Their Hands", Jentoft...
Camect "Worlds Smartest Camera Hub" Tested on Oct 18, 2019
Camect is a Silicon Valley startup that claims the "Smartest AI Object Detection On The Market", detecting not only people and vehicles, but...
Hikvision Global News Reports Directory on Oct 17, 2019
Hikvision has received the most global news reporting of any video surveillance company, ever, ranging from the WSJ, the Financial Times, Reuters,...
Camera Calculator V3.1 Release Improves User Experience on Oct 17, 2019
IPVM has released a new version of our Camera Calculator, V3.1, with significant user experience improvements, a new development plan, and an...
Securing Access Control Installations Tutorial on Oct 17, 2019
The physical security of access control components is critical to ensuring that a facility is truly secure. Otherwise, the entire system can be...
Access Control Course Fall 2019 - Last Chance on Oct 17, 2019
Register Now - Fall 2019 Access Control Course. Thursday, October 17th is the last day to register. IPVM offers the most comprehensive access...
US DoD Comments on Huawei, Hikvision, Dahua Cyber Security Concerns on Oct 16, 2019
A senior DoD official said the US is "concerned" with the cybersecurity of Hikvision, Dahua, and Huawei due to "CCP" (China Communist Party)...
Pelco Sarix Pro3 Camera Tested on Oct 16, 2019
Pelco has released their Sarix Professional Series 3 cameras, claiming "more security detail in challenging scenes with excellent low light and...

What IPVM Is

The world's leading authority on video surveillance, with 200,000+ visits monthly.

  • Articles on cameras, video analytics, VMS, and trends
  • Tests showing actual performance and problems
  • Courses in surveillance, access control, etc
  • Camera Calculator for designing systems

Dedicated To Independence

We're dedicated to staying independent and objective. We're the only industry source to refuse any and all advertisements, sponsorship, and consulting from manufacturers. Why?