Comcast Xfinity Security System Helps Burglars Break into Homes

Comcast Xfinity Security System Helps Burglars Break into Homes

Our new digital age gives us the benefit of being able to check up on our homes while we are away. The newest and most popular security systems are able to send texts and digital notifications right to your phone so that you can be aware of problems while you are away. Pretty great, isn’t it? But what if your system isn’t protecting your home, instead sending false reports while someone is in your home?

Security researchers at Rapid7 have found vulnerabilities in Comcast’s Xfinity Home Security system that would cause it to falsely report that a property’s windows and doors are closed and secure even if they have been opened. It could also fail to sense an intruder’s motion.

The system uses a ZigBee-based protocol to communicate and operate over the 2.4 GHz radio frequency band. All a thief has to do is use radio jamming equipment to block the signals that pass from a door, window, or motion sensor to the home’s baseband hub. Instead of signaling that something is wrong, the system will send a false positive and continue to report that everything inside the house is intact and safe.

Once the signals are open again, it can take the sensors anywhere from a few minutes to three hours to re-establish communication with the hub. And once they do, the base station hub, which has a digital readout, provides no indication that conditions changed during that period.

Once the sensor for a door or window comes back online, there is no way to let the base station know that something was tampered with because no signals were being received at the time.

It makes sense that the home base would ignore small communication breaks, because you wouldn’t want to be alerted every time you turn on the microwave, but this kind of device could take hours to come back online, limiting the amount of security you are paying for.

The most problematic thing is that Comcast gives home security systems a sign to put in their front yard that signifies that the home uses the service. This gives anyone who knows how to jam the signal a path to the most vulnerable homes.

While homeowners aren’t able to take any practical movements to mitigate their risk of an attack, the vendor could easily fix the problem with a firmware patch that would instruct the system to send alerts when something is not okay with it.

It is unclear, whether Comcast plans to issue a patch. Rapid7 has tried several times to contact the company, but has not received any communication back.   

About the Author

Sydny Shepard is the Executive Editor of Campus Security & Life Safety.

Featured

  • Mall of America Deploys AI-Powered Analytics to Enhance Parking Intelligence

    Mall of America®, the largest shopping and entertainment complex in North America, announced an expansion of its ongoing partnership with Axis Communications to deploy cutting-edge car-counting video analytics across more than a dozen locations. With this expansion, Mall of America (MOA) has boosted operational efficiency, improved safety and security, and enabled more informed decision-making around employee scheduling and streamlining transportation for large events. Read Now

  • Security Industry Association Launches New “askSIA” AI Tool

    The Security Industry Association (SIA) has unveiled a brand-new SIA member benefit – askSIA, a conversational AI agent designed to help users get the most out of their SIA membership, easily access SIA resources and find the latest information on SIA’s training and courses, reports and publications, events, certification offerings and more. SIA members can easily find askSIA by visiting the SIA homepage or looking for the askSIA icon in the top left of webpages. Read Now

    • Industry Events
  • Industry Embraces Mobile Access, Biometrics and AI

    A combination of evolving workplace dynamics, technology innovation and new user expectations is changing how people enter and interact with physical spaces. Access control is at the heart of these changes. Combined with biometrics and AI, mobile access control has become increasingly crucial for deploying entry solutions that are seamless, secure and adaptive to user needs. Read Now

  • Sustainable Video Solution Delivered for Landmark City of London Office Development

    An advanced, end-to-end video solution from IDIS, with a focus on reducing waste and costs, has helped a major office development in the City of London align its security with sustainability objectives. Read Now

  • DHS to End ‘Shoes-Off’ Travel Policy

    Homeland Security Secretary Kristi Noem announced a new policy today which will allow passengers traveling through domestic airports to keep their shoes on while passing through security screening at TSA checkpoints. Read Now

New Products

  • Automatic Systems V07

    Automatic Systems V07

    Automatic Systems, an industry-leading manufacturer of pedestrian and vehicle secure entrance control access systems, is pleased to announce the release of its groundbreaking V07 software. The V07 software update is designed specifically to address cybersecurity concerns and will ensure the integrity and confidentiality of Automatic Systems applications. With the new V07 software, updates will be delivered by means of an encrypted file.

  • EasyGate SPT and SPD

    EasyGate SPT SPD

    Security solutions do not have to be ordinary, let alone unattractive. Having renewed their best-selling speed gates, Cominfo has once again demonstrated their Art of Security philosophy in practice — and confirmed their position as an industry-leading manufacturers of premium speed gates and turnstiles.

  • FEP GameChanger

    FEP GameChanger

    Paige Datacom Solutions Introduces Important and Innovative Cabling Products GameChanger Cable, a proven and patented solution that significantly exceeds the reach of traditional category cable will now have a FEP/FEP construction.