ID

VAR-201903-0070

CVE

CVE-2019-9860

TITLE

plural ABUS In product PRNG Inadequate entropy vulnerability

DESCRIPTION

Due to unencrypted signal communication and predictability of rolling codes, an attacker can "desynchronize" an ABUS Secvest wireless remote control (FUBE50014 or FUBE50015) relative to its controlled Secvest wireless alarm system FUAA50000 3.01.01, so that sent commands by the remote control are not accepted anymore. ABUSSecvestFUBE50014 and ABUSSecvestFUBE50015 are both wireless remote controls from ABUS, Germany. A security vulnerability exists in ABUSSecvestFUBE50014 and ABUSSecvestFUBE50015 that originated from program unencrypted signal communication and used a rolling code that was easily guessed. An attacker could exploit the vulnerability to cause a denial of service. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2018-036 Product: ABUS Secvest Remote Control (FUBE50014, FUBE50015) Manufacturer: ABUS Affected Version(s): n/a Tested Version(s): n/a Vulnerability Type: Denial of Service - Uncontrolled Resource Consumption (CWE-400) Risk Level: Low Solution Status: Open Manufacturer Notification: 2018-11-21 Solution Date: - Public Disclosure: 2019-03-25 CVE Reference: CVE-2019-9860 Authors of Advisory: Matthias Deeg (SySS GmbH), Thomas Detert ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Overview: ABUS Secvest FUBE50014 and FUBE50015 are wireless remote controls for the ABUS Secvest wireless alarm system. Some of the device features as described by the manufacturer are (see [1]): " * User-friendly remote control with easily identifiable symbols * Features \x91arm\x92, \x91disarm\x92 and \x91status query\x92 keys * 8 LEDs provide an overview and display current system status * Button for custom configuration available (Secvest wireless alarm system only) * Optional manual panic alarm available (Secvest wireless alarm system only) * Encrypted signal transmission * Rolling Code Thanks to the rolling code process this product is protected against so-called replay attacks. All controlling signals between this product and the Secvest alarm panel are in individualised and thus, are not able to be reproduced by third parties. This process is protected from third party tampering, and exceeds the requirements of the DIN EN 50131-1 level 2 security standard. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Proof of Concept (PoC): Thomas Detert developed a Teensy-based PoC tool using a CC1101 sub-1GHz transceiver that allows disarming the alarm system in an unauthorized way. He provided his tool including documentation and source to SySS GmbH for responsible disclosure purposes. Based on Mr. Detert's PoC tool, SySS GmbH developed a Python tool for the RFCat-based radio dongle YARD Stick One (see [4]) for demonstrating this simple denial-of-service (DoS) attack against the ABUS Secvest wireless remote controls FUBE50014 and FUBE50015. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution: SySS GmbH is not aware of a solution for this reported security vulnerability. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclosure Timeline: 2018-11-21: Vulnerability reported to manufacturer 2018-11-28: Vulnerability reported to manufacturer once more 2018-12-12: E-mail to ABUS support asking if they are going to give some feedback regarding the reported security issue 2018-12-12: Phone call with ABUS support, the reported security advisories were forwarded to the ABUS Security Center Support 2018-12-12: E-mail to ABUS Security Center Support asking if they are going to give some feedback regarding the reported security issue 2019-01-14: Updated information regarding remote control ABUS Secvest FUBE50015 2019-03-25: Public release of security advisory ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ References: [1] Product website for ABUS Secvest wireless remote control https://www.abus.com/eng/Home-Security/Alarm-systems/Secvest-wireless-alarm-system/Control-devices-and-extensions/Secvest-Wireless-Remote-Control2 [2] SySS Security Advisory SYSS-2018-035 https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2018-035.txt [3] SySS Security Advisory SYSS-2018-034 https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2018-034.txt [4] Product website YARD Stick One https://greatscottgadgets.com/yardstickone/ [5] SySS Security Advisory SYSS-2018-036 https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2018-036.txt [6] SySS GmbH, SySS Responsible Disclosure Policy https://www.syss.de/en/news/responsible-disclosure-policy/ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Credits: This security vulnerability was found by Thomas Detert. Mr. Detert reported his finding to SySS GmbH where it was verified and later reported to the manufacturer by Matthias Deeg. E-Mail: matthias.deeg (at) syss.de Public Key: https://www.syss.de/fileadmin/dokumente/Materialien/PGPKeys/Matthias_Deeg.asc Key fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclaimer: The information provided in this security advisory is provided "as is" and without warranty of any kind. Details of this security advisory may be updated in order to provide as accurate information as possible. The latest version of this security advisory is available on the SySS Web site. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Copyright: Creative Commons - Attribution (by) - Version 3.0 URL: http://creativecommons.org/licenses/by/3.0/deed.en -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE0fCgNfBs5nXNuQUU2aS/ajStTasFAlyUoMMACgkQ2aS/ajSt TatXPw/8CKe79eTckW/tXs4iIXP3hRTwy3+doB5r92txbd5OkayGRvfY6nGLX+LB naael/ZimlLq6QfNZsMiFli1+L9PS3IB52Suo2w7thHcTvz+fPJVfMt0fTkeGTvX mTfm8/ZsQ1vH0uU2EccwL5aVatiVHzuowJd6yv9afWBQ+ci8fShFmm7FGgfeCWoP Z3iOfttXlpPNMUsk9gMum+UeyqBsGSj0KjJxy3Cuugz783IPB+hdDWLPigmdtZPO chO7jEC6JXQJXt5UK/F8CdSZ1xF1NhfpQ9NvzvIBeEMy7V19S3EUnsow88i8HOSL pkRtISvp98QHfomJMCUUXRe6DSnXFyVy416zgw753610vCvlVH9pgKZ2JlyHragA YKSbadah2qqmYOm6Z7NMuXVNA+TqNh70u14IOl1bdr+Gp1nbvdcORMdU0aoBZfO+ KdyVBbeZgOQ9jOFs8dZzzMCuCx3eMsby4Ynwwnuu/YS4j1fwaK6l+G+nOEHLzc+J U2txKilfISr3kupFj/UBYzd7AjHul7C7Uu8LzI/HcAWSlv/zwtc0PiluAjFV1C7x pyaICS9AISt4YzNXUyH/bm2NkehxXz6lMnvJ4j8jvJJbdbvlgyhnKXovZMzRlN8Y 0WLRQtlTx/zYjZyD+qw5/L53qx3An0OYBVLLYFduU9FgZbgnbnM= =Zb9J -----END PGP SIGNATURE-----

IOT TAXONOMY

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

lack of information

CONFIGURATIONS

EXPLOIT AVAILABILITY

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Matthias Deeg

SOURCES

LAST UPDATE DATE

2024-11-23T22:48:29.379000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE