Last Updated on
Arvind Vishwakarma, a Rapid7 researcher, has made his findings regarding the Fortress S03 Wi-Fi Home Security System public yesterday. This comes after waiting for three months for Fortress to respond to multiple vulnerabilities found in the security system. According to the article, “These vulnerabilities could result in unauthorized access to control or modify system behavior, and access to unencrypted information in storage or in transit.”
This again raises the issue of smart home security, our top tips can be found here. For those looking for specifics, Rapid 7s vulnerability reference CVE-2021-39276 is a form of CWE-287 (This is a reference from the Common Weakness Enumeration, which is a community-developed list of software and hardware weaknesses). CWE-287 encompasses any instance of someone attempting to log in or breach software/hardware whilst impersonating you. For example, someone could grab your Fortness registered email address and get into your account, taking over your security system and possibly your home network altogether.
The other vulnerability is a radio signal error, ref. CVE-2021-39277. It describes an instance of CW-294, whereby anyone within the Radio Frequency (RF) range can replicate previously sent commands and re-send them with slightly altered commands. It’s another way to breach the smart security companies’ tech and can be easily done.
CVE-2021-39276 is further illustrated, courtesy of Rapid 7, by publicly showing how easy it is to send a command code to the smart security company security system to request an IMEI number for the hardware.
The hacker can then use the email address and IMEI to disarm the system, leading to all kinds of dangerous outcomes for the user:
The big issue here is how smart security companies deal with holes in the security of their products. Fortress has done 3/4s of nothing to deal with this situation since they were first alerted to the issue on May 13th, 2021. Rapid 7 gives three months for security companies to deal with issues before making them public, which should be more than enough time.
Ultimately, any Wi-Fi or wirelessly enabled device is open to vulnerabilities. It’s more about trying to prevent vulnerabilities rather than solve them, which is why your smart home hub tech requires firmware updates from time to time. Make sure to set a reminder to check your smart home hub apps once a month for firmware updates, even light bulbs could provide a back door to your home network.
Also, make sure to do your research before purchasing smart devices. Smart home hubs such as Google Nest and Amazon Echo are pretty tight and self-update, but some third-party products may skip security to hit a budget price point. For all things smart home, make sure to visit and bookmark our smart home hub
