SimpliSafe SS3 Unauthenticated Keypad Pairing Vulnerability

Without prior knowledge of the PIN, an attacker with physical access to a base station is able to pair a rogue keypad and subsequently disarm the alarm system.

There is a button on the bottom of the base station (next to the batteries) that, after being pressed, will allow new devices to be paired. Specifically, a rogue keypad (which is already paired to another base station) can be added to facilitate the attack. While paired to both base stations, the attacker can disarm the "victim" base station.

Also, please note that we could not complete the full attack in under 30 seconds (default entry delay before the alarm triggers). This limits attackers to an insider threat. A more feasible scenario is that an attacker could pair the rogue keypad while in the house, and disable the alarm at a later date (e.g. when burglarizing).

Proof of Concept

Note: The PoC below is just one example. We were also able to disarm the victim base station by entering the Setup and Naming menu, and then exiting out.

Follow the steps below to disarm an armed base station.

Assumptions:

1. There is a "victim" base station ("BS1") with a keypad ("KP1") already paired.
2. There is an "attacker" base station ("BS2") with a keypad ("KP2") already paired.

Instructions:

1. Arm BS1 in "home" mode.
2. Power down BS2.
3. Power down KP2.
4. Remove the bottom cover of BS1 to reveal the battery compartment. Press the small white circular button to enable pairing of new devices.


5. Power on KP2. After the power on sequence completes, it should pair to BS1.
6. After KP2 pairs, turn on BS2.
7. Reboot KP2.


8. After KP2 powers on, the display should say "off" (indicating it's talking to BS2).
9. Press "home" on KP2.
10. Press "off" on KP2 and enter the proper PIN for BS2.
11. Press "away" on KP2.
12. Once the countdown has begun, press "off" on KP2.


13. Both base stations will be disarmed. The PIN for BS1 was not required.