LifeSafety Power NetLink Vulnerabilities And Problematic Response

By: John Scanlan, Published on May 20, 2019

'Power supplies' are not devices that many think about when considering vulnerabilities but as more and more devices go 'online', the risks for them need to be considered as well.

Indeed, Security researcher Bashis has discovered various vulnerabilities in LifeSafety Power NetLink devices.

LifeSafety Power NetLink Vulnerability1

IPVM spoke with both Bashis and executives at LifeSafety Power. Inside, we provide details on this vulnerability including:

  • Vulnerabilities overviewed
  • Devices affected
  • Impact of vulnerability
  • Why Life Safety Power failed to respond to multiple reports until IPVM intervened
  • What Life Safety Power says they are doing now to improve their cybersecurity process

Related, see IPVM's Cybersecurity Vulnerability Directory

'***** ********' *** *** devices **** **** ***** about **** *********** *************** but ** **** *** more ******* ** '******', the ***** *** **** need ** ** ********** as ****.

******, ******** **************** *** ********** ******* *************** in********** ***** ******* *******.

LifeSafety Power NetLink Vulnerability1

**** ***** **** **** Bashis *** ********** ************ *****. ******, ** ******* details ** **** ************* including:

  • *************** **********
  • ******* ********
  • ****** ** *************
  • *** **** ****** ***** failed ** ******* ** multiple ******* ***** **** intervened
  • **** **** ****** ***** says **** *** ***** now ** ******* ***** cybersecurity *******

*******, *** ****'************** ************* *********

[***************]

LifeSafety ***** ******* ************* ********

******* ******* *** **** with ****** ******** ******* to ****** ******* *** control ****** ***** *** receive ****** ********* ****** or ******** *********.

Impact ** *************

********' ***** ** ******* report *****, *** ******** ** high, **** ******* *************** including ************ ****** ** clear **** ***********, ** the ******* **** *** PoC *****:

***** ******** ** ** cameras, ***** *** ****** far **** ** ***** devices, ***** ******* *** generally **** ** ****** security ********** ***** ************ of **** *************** ***** be **** ***********.

Patch *** *************

***** **** ******** ******* can******** ******* ******** **** their ******* ****. *** ***** ******* ******** NetLink ******* ** ***** network, *** ********** *** ** downloaded ****, *** ** **** to ****** *** ***** upgrade ********.

Devices ********

*** ******* ******** ******* the NL2 *** *** ******* firmware ******** *.**, *.***-** and *.***-***.

Poor ******** ** ******** *************

****** ****** **** ******* attempts ** ******* *** before **** ******* *********. The ******** ***** ***** this **** **** ******** 2018 - ***** ****.

******** **, ****: ****** contacts ******** ******** **** VDOO **** *** ********, and **** ******* ** contact *** **** *** findings ******** ***** ** no *****.

******** **, ****: **** returns *** **** ** him ***** *** *** failed ** *******. **** the **** *** **** Bashis ******** ** ******* LSP *******, ***** **** ignored, ******* **** **** thought ** *** * phishing *******.

******** **, ****: ** a ***** ****** ** provide *** * ****** to ****** ***** ******** and ******* ****** ********** his ********, ****** ******* out ** ****. **** was **** ** *** in ***** ********** ***** and ******* **** **** Bashis.

***** * ****: *** firmware *** ******** *** provided ** ****** *** testing.

***** * ****: ****** confirmed *** ******** *** corrected.

*** ********* ****:

***** *********** ********** ***** was * ******* **** **** ** stating * ************* *** found ** ******* *** ** appeared ** **** **** a phishing email and so wasn’t ***** **. **** *** our *******.

**** ** ****** ***** of *** ******** ***** in ******** (*** **** Honovich ****** ** *****) we ***** ********** *** matter **** ***.

Improvements ********** *******

*** **** *** **** will ** **** ******** about ******** ********:

***** ******* *** *** and *** ********* **** will ** ****** ** *** ************* ******* *********, ** matter *** ******.

**** ****** ********* ************ in ***** ******** *********** process:

*** ***** *** ********** during ******** ***********. ** have ******** *** **** review **** * ***** security ****** *** **** plan ** ********** ********** external ***** ***** *******.

Default ******** *******

*** ******** ******* **** with ******* *********** ***** are ********** ** ** changed **** * ***-** message *** *** *** required ** ** *******. Due ** *** **** associated **** ******* ***********, they **** ********* ** ****************** ** ******* ****.

Response ** ******* ******** *****

*** ********** ** ***** allowance ** ******* *********:

*** ******* ******** ** ******** provided for ******* ***** *** testing ** *** ****** (common ******** ** *** industry). To ****** ***** ** setup ****** ********, ** ***** a “***” ******** **** *** default ******** ** *** ****** and ** ****** ** changed to * ******* ******** password ********** ** *** customer ** *** **********. *** warning ******* ******** ***** time ** ***** ** long ** *** ******** has *** **** ***** properly.  **** * ******** is ******* ** ** required ** **** * -14 ********* **** * mix ** *******, **** sensitive *******, *** ******* characters. We **** ******* * survey ***** *** ******** base *** *** ** we ****** **** *** Netlink ******** ***** ***** to ***** ****** ******** the ***** **** **** login. ********* ** *** survey *******, ** *** change *** ******** ** force ***** ** ****** the ******* ******** ***** their ***** *****.

****: ** ******** ***** it ***** '******** ********' in ****, ************ ********* have ********** *** ******* password, ******* ***** ** set * ******** ** first ***.

Device ********* *****

*********** ********* ************* *** ** ****, recommending ***** * ****** IP ******* ** * cybersecurity **********, ******* ***** alerts, *** ***** **** rather **** ***** ** you **** **** ******* is ******:

Reminder ** ******* *****

**** ** * **** reminder **** ** **** devices **** *** '******** of ******', *************, ***********, and ***** **** ** be ******** ***** ************* vulnerabilities. 

Comments (27)

Undisclosed Integrator #1

05/20/19 02:40pm

"****** ****** **** ******* attempts ** ******* *** before **** ******* *********. The ******** ***** ***** this **** **** ******** 2018 - ***** ****."

******, **** *** **** difficult ** *********** ****.  Communications **** **** ******* are ****** ***-********, **** have ***** ******** ***** no ****** **** *** question...  *** **** **** too ****, ************ ** just ***** ********?

**** *** ******* ** their *********, *** *** to ***** ***-**************, *** only ****** **, "****"!

Undisclosed Manufacturer #2

05/20/19 04:19pm

**** ****** **** *** message ** *****-*******. ********* basic ********* ********* ** *** switch ** ******** * manufacturer's ********. *** *******/******** prevention, ******** **********, ******** turned ***, ***** *********** all *** **** *******/******** exploitation, **** ** *** absence ** * ***.

Undisclosed End User #3

05/20/19 05:15pm

***** ****** *** *** uniqie ** ***, **** is * ******** **** probelm **** *** *-***** better *** *** ** front ** ****** *** comes **** ** **** them ** *** **********. 

* ***** **** ** see ******** ** *** IPVM ********* ** *** who **** ****** ***** concerns ***** (****** *** pun) *** ********** ************ of *******.  * **** want ** **** **** LSP **** **** * cyber ********** *** **** curious *** **** ****** cyber ** #* ******* when ********** ********.

* ******** *** ******** but ***** *** ** are ******** *** ******* until ***** ** **** EIT/EIS ********** ** ******* pen-tesing **** ** ******* else ***** **** ************ or ***** *** *****.   I **** *** *** LSP **** *** ******* modular ** * *** use *** ******* *** and *** ** *** '"connectivity" ** * ***** date.

John Honovich

IPVM | In reply to Undisclosed End User #3 | 05/20/19 05:46pm

***** *** ** *** removing *** ******* ***** there ** **** ***/*** Evaluation ** ******* ***-****** dont ** ******* **** other **** ************ ** thier *** *****

*** ***** ** ****? 

Undisclosed End User #3

In reply to John Honovich | 05/22/19 05:17pm

** ******** *** "************ Piece" ** ****** ** to **** ** * non-technology ***** (********** **********) and ***** **** ** deploy *** *** ******* Solutions ** ******* ********** and *********** ****** *** enterprise (**** ***+ ********). 

**** ***/*** *** **** to ******** *** **** Test *** ******* *** approves ** ** * "Connected ******" **** * can *** **** ** the *** *** **** advantage ** *** *** monitoring *********.

** ** ***** (********* institutions) ********** ********** ** the **** ** *** game, ** ****** ********** requirements ******!  ** ** is "** *******" **** it ******* ******* ***********, long **** *** *** days ** **** ***** a ******/******** *** ** host ***** *******.

bashis mcw

05/20/19 06:12pm

**** ****** ** **** for ******* ** ************ the ******* **** ***, its *** ***** *** last ******** *** **, and **** ****** ** LSP *** **** ******** and ******* ** ***** this ************ ** ****.

John Olliver

05/20/19 09:31pm

********** ***** ***** **** responsibility *** *** ************* found ** *** ********** Bashis.  ******* *** *** the ******** ***** ***** penetration ******* **** ********** had ********** **** ******* so ** ******* ***** that ** ***.

***** ********** **** ******, a ******** ***** *** done *** ******** ** him *** ************ ** operation. ****** ****** *** confirmed ******* (**** ***********) and ** ******** *** new ******** *** *****.

*** *** ***** *** reputation ** ******* *** response ** *** ********** which *** **** * key ****** ** *** growth ***** ***** *** beginnings.  ** ******* **** those ********** *** ******** to *** ***/*** ***** was ********, *********, *** acted **** ****** *** day ** ******** ************. Up ** **** *****, there *** **** *** email ** *** ******** of * ******* **** the ***/***. **** ***** sender *** ******* ** us, *** ** ******* identification, ** ***** ****** and ** *********** ******** affiliation *** *** ******* in * ****** **** did *** ****** ********. There ** ** ****** within *** ***** ** a ******* ********** ** VDOO *** ** **** never **** ******** ****, or *** ******* **** that *******.

*** **** ******* ***** uses *** **** “***************” (plural), ****** *** ********** that ***** *** ******** issues **** *** ****** but **** *** **** changes *** ******* ** “vulnerability” (********). “***************” ** misleading. *** ***** ** the *********** ******** ** not * ************* *** the ****** ** ******** request ** **** ****** to *** ** ****** for **-***** ***** *** configuration ******* *** **** to **** ******** ******** records ***** ** *** unit ***** ** **** and ****. **** *** be ******* ** ********* (or ****) ******* **.

**** ******** *** ******** in * ****** ****** LSP ** *** ********** involved ** ******** ********** such **** **** **** of ***** ** ********** and * ****** **** will ****** ** ************* queries ***** ********.

*** ********** ** ****** first *** ******** ** our **** *** ** will ****** **** ******** steps *** ********* ** uphold ** *** *** responsibility ** *** *********. 

**** *******

** ** ***** *** Marketing

********** *****

 

** *********** ********** #*...

*** **** **** ** highly ******* ** ******* and ******* ** **** comment **** *** ****"***** *** * ****** call"  ***** ****** *** ** character.  ** ** **** a *********** ******* *'* not ***** ** * would **** ** ********** that *** ******* **, so ****** ******* **. Direct **** (***) ***-****.

* **** ****** **** call.

John Honovich

IPVM | In reply to John Olliver | 05/20/19 09:38pm

*** **** ******* ***** uses *** **** “***************” (plural), ****** *** ********** that ***** *** ******** issues **** *** ******

***, ****'* ************* *** ***** ******** vulnerabilities(******), ** ************ *****:

** *** *** ** into *** ******* ** each ************* *** ****** of ***** *** ********* complexity *** ***** *** multiple ***************.

Undisclosed #4

In reply to John Olliver | 05/20/19 09:39pm

******* *** *** *** multiple ***** ***** *********** testing **** ********** *** identified **** ******* ** we ******* ***** **** he ***.

** *** *** ******* did *** ******* ****** code ******, **** ** is ******** *** ***** ever **** *************** **** this. ******** *** ******* tends ** ****** ***** on ******* *** ***** exploits *** ****** ****** like *** ********* ** form ************. 

** **** *** ******* included ****** **** *******, then *** ****** ******** ask *** * ****** (not ******** ***** *************** were **** ** ****, but * ****** **** should **** ***** ** least **** ** *** basics.

Undisclosed #5

05/21/19 01:49am

***** ********' *** *** devices **** **** ***** about **** *********** ***************...

*’* ***** **** *** fact **** ****** ** now ******* ***** ******** as * *********** **** that ** ******* *** have ******** ********.

** ****** *******, *’* an *****.

 

Undisclosed #6

05/21/19 07:49pm

*****, * (************* *********) disclaimer -- ***** **** to ****** *** ******* this *************. * **** it **** * *** that * ***** *** that *** ************* ** the ***** ******* ** the ******** ******** ******** the ****** **** ** IPVM ********.

**** **** ****, ***** it's ************ **** **** a ************* ******* ** the *** ******* ** the ***** *****, ** I ** ************* ** correctly **** *** ******** versions ***** **** ************* was ********** *** *.* and *.**, **** ** another ******* ******* ** how ***********/********* ********** **** cyber ******* ** *** first ***** ***** ******** this ************* ** *** first *****. **** ******** release *****, ** ***** like *.** *** ******** in ******* ** ****, and *** **** *.* revision *** ** ******** of ****. * **** that *** ** **** were ******** ** *.** last *****.

***** ************ ** *********, but ************ * ********* check ** *** ******** revisions *** *** *******-********* devices ****** ** * bare ******* *********** ***** days. **** **** ****** to ** ** **** often, *** ****** ***** an **********-***** ******* ****** be **** ** ** quarterly ******* *** *****.

***** -- ***** ** all ******** *** ******* the *************, *** ** LSP *** (**********) ****** it.

** * ********, *** those *** *** **** LSP ** ************, *** literally **** ** ******* the ***** ****** ** just **** ****** *** luck. ****'** *** ** the *** ************* *'** dealt **** **** ******** respond ******* ****** ***** time * **** ******* them.

John Honovich

IPVM | In reply to Undisclosed #6 | 05/21/19 08:40pm

* ***** *** **** his ************* ** *** cyber ******* ** *** security ******** ******** *** entire **** ** **** combined.

****** ************* *** **** significant **** *** ****** industry ********. **'* ********** vulnerabilities ******,*****,*********,*******,***, ** **** **** a ***, **** *** made *** ******** *** more ***** ** ***** risks.

** *** *** **************, the **** **** **** though ** ***** **** 'bahis' *** ******** ** a **** ************* ** the ********* ** ************* issues ** **** ******** and ****, **** *************, their ******* ******** '******'***** ***** *** ******** prominent ********** ** *** work.

Undisclosed #6

In reply to John Honovich | 05/21/19 11:39pm

****, ******* ****** *** knowledge ** **** ******** Bashis **** ** ***** out ** ****, * would ******** ** ** the **** ***** ********* that ****** *** ******* was ********* *********** ** an ***** ******** ** that ** *** **** by * ***-***** ******** service ****** *** *********, either ******* **** *** no **** **** ** was ****** ** ******* they **** **** ** was **********. *****, *** the ****** ** *** world ** ****** ****, but * ***'* ***** it's ********** ** ****** to *** **** ******'* written ******* *** ********* come ****** ** *********** from ****** ** *** ******* King ** ******* ** ********* *******...** ********** intended, *** *'* **** saying...

****** ***, ** ***** is **** * ***** hope **** **** ******* doesn't ******* *** ** an ****** ******** ***** as "************" ** *** caring ***** ***** ******. My ********** -- *** obviously *** ********** ** others -- ** ******* the ******** ** **** regards, *** ****'* ******* evidenced ** *** ********** quick *** **** **** released **** **** ******** it *** *****.

John Honovich

IPVM | In reply to Undisclosed #6 | 05/21/19 11:49pm

** **** ** *** read ** * ***-***** customer ******* ****** *** discarded

****'* * **** *******. They ***** **** **** the ***** *** ***** vulnerabilities *** ** ***** that ****** *** *** name *****. ***** ** them ** **** *** not **** *** ****** is *** *** *** think ***** ******** ***, which ***** **** ****** and ******* ********* **** it ****** ** ** examined *******.

* ***'* ****** ***, I ***'* **** **** Olliver, ** * ** not ****** **** *** good ** *** *********, just **** ***** *********** for *** ********** ** the ************* *****(*) **** not **** **** ***** to **.

Undisclosed #5

05/22/19 05:41am

*) ***** ****** *** typically **** ********* (****** windows).

*) ** ** ********** that ****** ** ************ ** * *********** ******(*** ****** ***** *****) and ****(** ***** ****** ************).

*) **********, *** ********** clearly *** ******** ** all ***** **** ********* of *** ******, ***** by *** *** *****.

*) **** ** **** don’t ******* **, ***** hackers *** ***** ********* to ***** ***** ** gaffes.

*) ********* *** ** big ************ ***** ****** ********* dissonance ** *** ****** researcher, ** ** ************** feels ******** *********** ***** with *** ******* ** the ********* *********** ****-**.

********* *** *** ** the ********** ****** ****** ** ********** ** once ** ***** ** the ***************, ** ***** *****.

 

bashis mcw

In reply to Undisclosed #5 | 05/22/19 05:26pm

*** *** *** *** of *** *****, *** me ******* *** * bit **** **** ********* URL 

*****://***.********.***/****-******?*******=******

 

Undisclosed #5

In reply to bashis mcw | 05/23/19 12:28am

* ***** *********, **. w.

bashis mcw

In reply to Undisclosed #5 | 06/06/19 06:57pm

*** * * *****, my **** ** ******* "bashis" *** *** "******", however *'* *** ** sensitive ***** ****  ;)

Undisclosed Integrator #7

05/24/19 03:00am

*********:  ****** ** **** what *** ** *** a ****** ** ** this * *****?  *'* not ******* *** **** gets ********* ** *** I ***.  *** *** doing ********** **** *** I **** ***** ** some ****** ** **** for ***.

bashis mcw

In reply to Undisclosed Integrator #7 | 05/24/19 07:39am

** ** **** ****, reward ** ******* **********.

Avatar

Scott Napier

08/26/19 05:09pm

** * *** *** is ******* ** *** for * ****** **** will ** ***** ** least ** ** *****, now * **** ** verify **** **** **** actually ***** *** *******. My **** *****.

bashis mcw

In reply to Scott Napier | 08/26/19 07:40pm

* ***** ********* *** to **** **-** **** with ****** **, **** you “******” ** **.

Rodney Thayer

Smithee Solutions LLC | In reply to Scott Napier | 08/26/19 08:45pm

*********** ******** ********* ** a *********** ******. ** yes ***'* **** ** verify **'* *** ****** version, *** *** ****** have ******* **** ******** the *******...

Avatar

Scott Napier

In reply to Rodney Thayer | 08/26/19 09:53pm

**** ** * ****** thing. **** *** ********* yet.

Jim Elder

09/11/19 03:46pm

* ********** **** *** has **** **** ** Assa *****. ** *** think **** *** **** or ****** *** ******** with ********?

Avatar

Brian Rhodes

IPVMU Certified | In reply to Jim Elder | 09/11/19 04:04pm

***** ***, *** *** post ** *** ****:**** ******** ********** *****.

** ** ********* ** be ******** ******* *** buy ***** ** ***** LSP ****** *********, *** it ** ***** ******** out **** **** **** week ****** * '***** ******** *******' ************* **** *** in ******.

*** ****** ********* *** responsibility ** ************* ** a ********** ***** ** people ****** **** ** likely ** ****** ** a *********** ***** ****** brands, ****** **** ********** be ******** *** ******** within * ***** ******* like ********** ***** *****.

Undisclosed #8

09/11/19 04:52pm

*** *** * **** the "***** ******** ****** (HID5442)" **** ** **** Long *****. ***** ** not * *** *****, Mercury *** ***** ***** "we **** *****" ********* noise ;-)

Login to read this IPVM report.
Why do I need to log in?
IPVM conducts unique testing and research funded by member's payments enabling us to offer the most independent, accurate and in-depth information.

Related Reports

China Uyghur Analytic Projects Require Intel And NVIDIA, Intel Condemns, NVIDIA Silent on Dec 02, 2019
At least 8 PRC China police projects require NVIDIA and Intel chips to power their Uyghur-detecting analytics, according to procurement documents...
Directory of Access Reader Manufacturers on Nov 27, 2019
Credential Readers are one of the most visible and noticeable parts of access systems, but installers often stick with only the brand they always...
Wireless / WiFi Access Lock Guide on Nov 12, 2019
For some access openings, running wires can add thousands in cost, and wireless alternatives that avoid it becomes appealing. But using wireless...
The Access Control Codes Guide: IBC, NFPA 72, 80 & 101 on Nov 07, 2019
For access, there is one basic maxim: Life safety above all else. But how do you know if all applicable codes are being followed? While the...
Access Control Door Controllers Guide on Oct 22, 2019
Door controllers are at the center of physical access control systems connecting software, readers, and locks. Despite being buried inside...
Altronix Claims Tango 'Eliminates Electricians' on Oct 15, 2019
Power supply provider Altronix claims its new Tango power supply 'eliminates the need for an electrician, dedicated conduit and wire runs'. In...
Last Chance - Register Now - October 2019 IP Networking Course on Oct 10, 2019
Last Chance - Register Now - Fall 2019 IP Networking Course. The course starts next week. This is the only networking course designed...
HID Fingerprint Reader Tested on Oct 09, 2019
HID has released their first access reader to use Lumidigm optical sensors, that touts it 'works with anyone, anytime, anywhere'. We bought and...
Avigilon H5A Analytic Cameras Tested on Oct 07, 2019
Avigilon has released its H5A analytic cameras, claiming to "detect more objects with greater accuracy even in crowded scenes." We tested the...
'Bunker Busting' Wireless Access Startup: Sure-Fi Profile on Oct 03, 2019
An access startup is claiming its 'bunker busting' wireless Wiegand radios can punch through 'any obstruction'. We examine their offering,...

Most Recent Industry Reports

Video Surveillance 101 Course Opened on Dec 12, 2019
IPVM is adding a Video Surveillance 101 course, designed to help those new to the industry to quickly understand the most important terms,...
Verkada Notification Outage on Dec 12, 2019
Verkada is suffering an event notification outage and analytic search failures. Inside, we examine what the issues are, what Verkada told IPVM...
Hikvision DS 2nd Gen Intercom Tested on Dec 12, 2019
With its newest IP intercom, Hikvision proclaims users can 'get full control over an entrance' regardless of where it is installed, home or office...
Honeywell 30 Series Cameras Tested Vs Dahua and Hikvision on Dec 11, 2019
Honeywell has infamously OEMed Dahua and Hikvision for years, but now they have introduced an NDAA-compliant line, the 30 Series, claiming "lower...
"Good Market, Bad Business Models" - Residential Security on Dec 11, 2019
Industry banker John Mack, at his company's annual event, took aim squarely at the problems in the residential security...
IP Camera Browser Support: Who's Broken / Who Works on Dec 10, 2019
For many years, IP cameras depended on ActiveX control, whose security flaws have been known for more than a decade. The good news is that this is...
Acquisitions - Winners and Losers on Dec 10, 2019
Most major manufacturers have been acquired over the last decade. But which have been good deals or not? In this report, we analyze the...
IP Camera Installability Shootout 2019 - Avigilon, Axis, Bosch, Dahua, Hanwha, Hikvision, Uniview, Vivotek on Dec 09, 2019
What are the best and worst cameras to install? Which manufacturers make it the hardest or easiest to install their cameras? We tested 35 total...
Viisights Raises $10 Million, Behavior Analytics Company Profile on Dec 09, 2019
Viisights, an Israeli AI analytics startup marketing "Behavioral Understanding Systems", announced $10 million Series A funding. We spoke to...
Disruptor Wyze Releases Undisruptive Smartlock on Dec 06, 2019
While Wyze has disrupted the consumer IP camera market with ~$20 cameras, its entrance into smart locks is entirely undisruptive. We have...

What IPVM Is

The world's leading authority on video surveillance, with 200,000+ visits monthly.

  • Articles on cameras, video analytics, VMS, and trends
  • Tests showing actual performance and problems
  • Courses in surveillance, access control, etc
  • Camera Calculator for designing systems

Dedicated To Independence

We're dedicated to staying independent and objective. We're the only industry source to refuse any and all advertisements, sponsorship, and consulting from manufacturers. Why?