SimpliSafe SS3 PIN Add Using Rogue Keypad

We have discovered a vulnerability in SimpliSafe SS3 which is an incomplete fix to TRA-2020-03.

An attacker, with physical access, can add PINs without prior knowledge of the PIN. This allows the attacker to disarm the system.

There is a button on the bottom of the base station (next to the batteries) that, after being pressed, will allow new devices to be paired. Specifically, a rogue keypad (which is already paired to another base station) can be added to facilitate the attack. While paired to both base stations, the attacker can add PINs to the victim base station. This can be accomplished with a victim system armed as "away" or "home".

Also, please note that we could not complete the full attack in under 30 seconds (default entry delay before the alarm triggers). This limits attackers to an insider threat. A more feasible scenario is that an attacker could pair the rogue keypad while in the house, and disable the alarm at a later date (e.g. when burglarizing).

Proof of Concept

Note: In our testing, the victim and attacker systems had different versions. The victim was fully patched, while the attacker is out of date.

Victim: Keypad 1.4.20, base station 1.4.62
Attacker: Keypad 1.2.16, base station 1.3.2

Follow the steps below to disable an armed base station.

Assumptions:

1. There is a "victim" base station ("BS1") with a keypad ("KP1") already paired.
2. There is an "attacker" base station ("BS2") with a keypad ("KP2") already paired.

Instructions:

1. Arm BS1 in "home" mode.
2. Power down BS2.
3. Power down KP2.
4. Remove the bottom cover of BS1 to reveal the battery compartment. Press the small white circular button to enable pairing of new devices.
5. Power on KP2. After the power on sequence completes, it should pair to BS1.
6. After KP2 pairs, turn on BS2.
7. Reboot KP2.
8. After KP2 powers on, the display should say "off" (indicating it's talking to BS2).
9. Press "menu", and enter the PIN for BS2.
10. Select "PINs"
11. Modify the Master PIN to a new value or add/modify a user PIN.
12. Back out of the menu.
13. Press "off" and enter the newly created PIN.
14. Both base stations will be disarmed. The PIN for BS1 was not required.