While working on a project to reverse engineer some of the internal communication protocols used in a Paradox security alarm system, the author discovered a shocking secret on the COMBUS – the common bus connecting the control panel with keypads and other peripherals. Turns out that COMBUS isn’t protected either electrically, nor logically, thus rendering the security system effectively broken.
This talk takes us through the discovery process, allowing to replicate research results, the findings, and some theoretical attacks that are possible as a result.
As part of responsible disclosure process, the author has notified Paradox, the Canadian company that offers physical security devices, most notably – home/office security alarms, about the discovered vulnerability. The company responded that the information brought forward by the author “has been dealt with”. The author sincerely hopes that means “fixed”.
