If your home is equipped with the Fortress S03 security system, you may inadvertently be putting your safety at risk. According to cybersecurity company Rapid7, a pair of major vulnerabilities makes it possible for potential intruders to disarm the system using relatively simple tactics. The company says it first discovered the security lapses three months ago and reached out to Fortress about the potential risks, TechCrunch reports. Rapid7 publicly released information on the vulnerabilities after Fortress failed to respond to messages and saw the only acknowledgment of outreach was to close a support ticket without comment. According to Rapid7, the Fortress S03 system relies on a Wi-Fi connection to maintain its motion sensors, cameras, and sirens and allow customers to check on their homes from a mobile app. It also uses a radio-controlled fob key to turn the system on and off whenever coming or going from their property. However, the cybersecurity company found that the system relies on an unauthenticated API, making it possible for hackers or criminals to gain access to specific devices’ unique International Mobile Equipment Identity (IMEI) numbers simply by knowing the email address associated with an account. This then allows them to arm or disarm the system remotely, TechCrunch reports.ae0fcc31ae342fd3a1346ebb1f342fcb RELATED: If You See This on Your iPhone, Don’t Click It, Experts Warn. But a potential intruder may not even need to know your personal email address to gain access to your home. Rapid7 said it also found that the system’s fobs operated by using unencrypted radio signals to arm and disarm it, making it relatively easy for someone to pick up the unscrambled frequencies and replay them to shut the system down. While the process of snooping a radio frequency might sound lofty, one expert warns that it can be done relatively easily with the right know-how. “The attacker would need to be both reasonably conversant in SDR in order to capture and replay the signals and be within reasonable radio range,” Tod Beardsley, director of research at Rapid7, told Threatpost. “What that range is would depend on the sensitivity of the gear being used, but typically this sort of eavesdropping requires line of sight and pretty close proximity—across the street or so.” For more helpful tech tips delivered straight to your inbox, sign up for our daily newsletter. Ultimately, experts say it’s unlikely that a random intruder will be able to make use of the vulnerabilities in the system. “The likelihood of exploitation of these issues is pretty low,” Beardsley told Threatpost. “An opportunistic home invader is not likely to be a cybersecurity expert, after all. However, I am concerned about a scenario where the attacker already knows the victim well, or at least, well enough to know their email address, which is all that is really required to disable these devices from over the internet.” Beardsley admits that “very little” can be done about the easily exploitable fobs except to avoid using products linked to Fortress. But there’s still a way you can avoid having your system exploited by someone using your email address. “We suggest registering the device with a secret, one-time-use email address that can function as a sort of weak password,” Beardsley told Threatpost. “Absent an authentication update from the vendor, I feel like this is an okay workaround.” RELATED: If You Hear This When You Answer the Phone, Hang Up Immediately.
