Many door and window sensors, motion detectors and keypads that are part of security systems used in millions of homes and businesses can be bypassed by using relatively simple techniques, according to researchers from security consultancy firm Bishop Fox.
The researchers presented some of the bypass methods they discovered in a talk at the Black Hat USA security conference in Las Vegas on Wednesday, but declined to name any vendors whose products are affected.
"We started looking at security sensors, going from the outside in, and we found a few implementation issues that we can take advantage of," said Drew Porter, a senior security analyst at Bishop Fox.
For example, many door sensors rely on magnetic fields to work and if you hit them with a high enough magnetic field, they trip, Porter said. Window sensors are vulnerable to the same issue, he said.
These sensors have a basic design so bypassing them is not hard, but that wouldn't get intruders very far. The next thing they would need to do is move around the building without setting off motion detectors.
Most motion detectors, even newer ones, use infrared to detect significant changes in the surrounding room's temperature, Porter said. Normally, walking around in a room would set off these sensors, but using something as simple as a piece of styrofoam to shield your body can trick them, he said.
However, since walking around with a large piece of styrofoam can raise suspicion, the Bishop Fox security consultants who frequently assess physical security systems for clients, looked for other ways to bypass these sensors.
They found a few families of motion detectors that can be reset by pointing a source of light of a certain wavelength -- infrared or near infrared -- at them. This blinds the sensors for as long as the light source is pointed at them plus an additional three seconds, Porter said.
The motion detection sensors of this type are deployed quite often as part of different security systems, the researcher said.
Moving forward from the motion detector sensors, the researchers analyzed the keypad systems that send out calls to reporting centers if the alarm is tripped.
These keypads can use cellular networks or landlines to communicate, Porter said.
Many keypads are using old cellular technology and can be easily fooled by setting up a rogue base station -- a small cell tower -- the researcher said. The keypads will then connect to the attacker-controlled base station instead of the real cellular network, meaning that even if they send out an alert, it wouldn't reach its intended destination, he said.
