Netflix shows how to hack the Ajax keyboard: the company says it’s impossible

In one of the episodes of the Berlin series, Netflix streaming service showed a security system being hacked through the Ajax keypad. The company reassured us and explained why we shouldn’t trust what we saw in the movies.

Ajax noted that hacking is usually performed in three stages: searching for a keypad, gaining physical access or intercepting a radio signal, and hacking the system through third-party software.

Search for a keyboard

This stage in the movie seems very simple – the criminals immediately find where all the devices they need are located. They can also easily distinguish between wired and wireless devices, although this is not easy.

To determine the exact location of the wired keyboard, the criminal must use a powerful multiscanner to find the desired cable in the wall. But it doesn’t determine which cable is found. In addition, a multiscanner is useless in a room with thick walls.

If you’re talking about a wireless keyboard, a multiscanner won’t help. Criminals can scan the radio signal to determine the location of the wireless device. However, the data exchange between the device and the hub using TDMA technology takes a short period of time. The rest of the time, their communication modules are inactive.

“It will take tens of minutes for a criminal to identify the source of the signal. And even then, there is no guarantee that the detected signal source belongs to the device he needs,” Ajax explained.

However, to catch the radio signal, criminals use a code grabber. This is a special device for intercepting the signal transmitted when arming or disarming the system.

“However, it is impossible to hack an Ajax device in this way due to signal encryption and a proprietary communication protocol,” the company added.

Physical access

To attack the security system, criminals try to gain access to the device quickly and quietly. Ajax listed what is wrong with this stage in reality.

As a rule, keyboards are installed at the entrance to the premises. Usually, these are load-bearing walls made of brick, concrete or reinforced concrete with a thickness of 25-50 cm. It is impossible to drill such a wall quickly and quietly. Attempts to do so may not only attract the attention of neighbors, but also damage the device itself.

“The Fibra line of the wired keypad passes through the cable channel in the SmartBracket mounting panel. These channels have a curved design, and the cable is fixed with ties. Therefore, if criminals drill through the SmartBracket, they will most likely cut all the wires,” Ajax noted.

In addition to damaging the device, users and the Central Monitoring Station (CMS) will be notified of an intrusion attempt.

If a criminal tries to damage the security system with electrical sabotage (e.g., a stun gun), LineProtect Fibra will absorb the shock. All devices between LineProtect and the hub will continue to work.

Sometimes criminals in movies tear the keyboard off the wall and break it, which leads to a security system failure. But the keyboard is only a part of the system, so its damage doesn’t make much sense in terms of threatening the security of the system as a whole.

“In addition, Ajax keypads have a tamper that notifies users and the CMS when the device body is opened, the device is removed from the attachment panel, or it is detached from the surface,” the company emphasized.

Hacking

Ajax did simulate a situation where a criminal connected to the keypad and went unnoticed by the system. The company says that this is only possible with Fibra. However, there are many nuances in this situation as well. For example, Fibra has four wires (two signal and two power), so connecting to a single wire, as shown in movies or TV shows, makes no sense.

Fibra uses floating-key encryption to protect data. Hacking and accessing data requires the capabilities of a supercomputer, so it’s a futile exercise.

“However, even encrypted data must first be received. Each communication session between the hub and the device begins with authentication: unique tokens and properties are compared. If at least one parameter fails to pass the verification, the hub ignores the device commands. Therefore, there is no point in falsifying or intercepting data,” the company also explained.

The keyboard does not store user codes, which makes it impossible to guess them. It is also impossible to guess the code using a brute force attack. After all, it’s impossible to hack the system without being noticed. Any disarming of the system is recorded, and users and the CMS receive notifications. No one can delete notifications from the hub’s event feed.

With this in mind, the company reminded that events in movies, TV shows, or advertising are subject to the laws of drama. So they advised me to be more skeptical about what I saw.