Signal jamming is becoming more prevelant and the tools more accessible. There is wifi, cellular and sensor jamming.
Can you discuss the ease or difficulty of disable each one of those signals?
At Surety, when is dispatch sending police? Do IQ4s send any alert when being jammed on any of those signals?
This is a growing problem and I am curious what the industry is doing to address. Are vendors like yourselves bringing up this topic with the manufactures aggressively?
I can’t say I’m an expert on this particular subject but I’m interested in learning more about it. Wireless alarm systems have been adding jam detection in recent years. It’s disabled by default in the IQ Panel 4, I suspect because it can cause false alarms. This is from the IQ Panel 4 manual.
Using PowerG over 319.5 helps by offering jam avoidance which is arguably more useful than jam detection. PowerG was originally created by Visonic for military applications if I remember correctly and was later commercialized and acquired by Johnson Controls. It’s harder to jam because it hops around different frequency bands and the attacker can’t predict which band it will use next because the information about which will be next is encrypted for only the transmitter and receiver to know. I don’t think it’s impossible to jam, just harder than traditional wireless alarm signals.
I think/guess WiFi would be the easiest to jam. It’s designed for high throughput rather than reliability/robustness. It wasn’t made for security systems.
Wouldn’t cellular jamming be noticed by the tower?
Yeah, you all should do a study on this.
Does Surety dispatch receive jamming alerts if the panel detects. Do they send police? I think they should in case it happens as it’s on the rise.
I would Ask that Surety pushes for more answers and solutions from Qolsys and the industry.
Here is the Jam settings. What is Jam detection Local alarm mean? Not sure if 20/20 is the right choice or even what it means Oris it 30/60?
For very important doors, if your panel has multiple RF inputs using different technologies, you could always have more than one sensor on the same door, which would make it exponentially more difficult. (You did mention signal jamming and not magnetic hacks, there are ways to mitigate that too, have a false located reed switch that should never be closed, and hook it to tamper.)
I think sending the police on a jam detected is a very bad idea, as it might randomly happen if there happens to be RF noise for any reason. (RF is inherently an unreliable medium and usually just used for cost/convenience reasons.)
Yes, the monitoring center receives RF Jam signals but they are considered to be trouble conditions not alarms, even when the system is armed. I believe this is specified in the SIA standard for false alarm prevention. Most system trouble conditions are treated this way, except for Tamper signals which are treated as alarms when the system is armed. RF Jam signals are usually malfunction or environmental while Tamper signals more reliably indicate that someone is messing with the panel or a sensor.
If your Alarm.com account is configured to notify you about urgent system actions then you’ll be notified immediately about RF Jam signals and have the option of calling the police yourself. I would recommend verifying somehow first though because most RF Jam signals are not real break-ins.
That means your panel will sound an alarm (locally) if an RF Jam is detected. But it doesn’t change the signal sent to the monitoring center, which is still treated as a trouble condition. This setting requires the Jam Detection settings above it to also be enabled.
If you have a UL installation then pick 20/20. Otherwise, pick whichever one you like.
With the uptick in Jamming crimes, would Surety consider changing the Jam alert to dispatch police? I have had my IQ4 that I bought from you for years and the Jam settings have been set to on. Yet I have never received a notification which tells me I won’t be a problem for false alarms. Especially when it takes 20 seconds of jamming to alert.
Also, I have heard that these news stories are mostly about jamming alarms like Ring where all the sensors are on wifi. They don’t ever say what is specifically jammed. And the main stream media probably have no clue. I also heard ADT systems are being targeted? Maybe they install cheaper wifi sensor systems?
You obviously can break into anything, but maybe these jamming events would not really impact a iq4 panel with the jammer 90 percent of the thieves are using?
Sure would be nice of Surety reached out to Qolsys or other experts to see if the threat is over blown when it comes to IQ4s
I do want to prepare and countermeasure (like the ethernet cable I installed) but I don’t want to be overly paranoid and am hoping Surety can connect, and research and post some accurate data findings
HI Diamond Dog,
Surety (will not speaking for them just using what i know as a physical security professional myself) will most likely be unable to change the response to rf jam signal detections by the central station. This response as they mentioned is set by the SIA (the association that creates standards for the security and monitoring industry) standardizes responses and procedures across the board. While some of this make no sense (like not asking for passcodes on cellular calls - which is something new and totally dumb if you ask me) the treating of jamming is practical as a trouble. I would ask surety if I was you if they can place a note on your account for you to be notified of troubles but be advised trouble signals are low priority for central stations with alarms and supervisorys (a type of alarm from fire alarms) being higher priority, so if they are busy it could be a couple hours before you are notified about a trouble. With the IQ Panels using encrypted signal transmission between the panel and sensors, this also makes jamming and replay attacks much harder as an attacker will not have the encryption key. The news stories you are hearing generally will refer to a much high value target than a residential install in which case in my opinion the installer should have definitely used a hard wired system. Again, I cannot and do not speak for surety or avantguard (the central statation) just my observations on this thread.
I’ve been reading, speaking with other alarm professionals and have come to some conclusions. The bottom line is that if someone wants to break in enough, they will figure out a way to do it.
To obtain equipment that would jam all frequencies would be cost prohibitive and probably unlikely.
It appears that most of the incidents in the media are wifi jamming. and jamming systems that use cameras on wifi or sensors. They also jam outbound wifi signals. An ethernet cable would seem to solve for some of this.
But the takeaway is that it seems like lower end systems are targeted.
I don’t think sensor frequencies (Power G and wireless sensors that have been sold on Surety) are targeted. The criminals would have to know the frequencies and there would be a lot of risk for people that have mixed sensors on different frequencies (e.g. Power G and Legacy 2 Gig Sensors)
Could it happen? Of Course, but I think for the most part they would move to someone that has a Ring or Simplisafe yard sign.
The one thing that is in question is that some media reports ADT systems being targeted. I didn’t think ADT installed really cheap systems such as Ring that use all wifi.
So the takeaway is that there is risk, but for people that have IQ4, its much safer and harder to jam than what is reported on media.
Would love input from Surety and hope they keep us updated with what the industry is saying as well.
It appears that most of the incidents in the media are wifi jamming. and jamming systems that use cameras on wifi or sensors. They also jam outbound wifi signals. An ethernet cable would seem to solve for some of this.
I think much of the time the media segments may be produced without a full understanding of the technology they describe. Overly generic details are possible.
The linked news stories I have looked into were all describing wifi jammers being used to defeat wifi based security and surveillance devices. If everything on the system uses wifi; sensors, cameras, and panel communication, the jammers would be startlingly effective.
A system with multiple communication paths is naturally more resistant and takes more effort. If cutting communication is the goal, cutting the internet cables is a likely tactic as well.
Local recording helps as well with regard to video. An SD card in a compatible camera can’t be defeated by just blocking wifi.
POE cameras, SVR, a variety of devices lend to a more complex system that doesn’t rely on just wifi.
The bottom line is that if someone wants to break in enough, they will figure out a way to do it.
Sadly, yes. An alarm system discourages entry, but it does not prevent it. Collecting and reporting information to the owner and authorities is chief functionality.
For additional peace of mind, hardening the perimeter is a way to go, but can be expensive. Products to reinforce door frames, locks, security film on glass, etc., are a good idea to slow down anyone intent on entry.
Thank you Jason. Great response. Again please let us know industry insights as the become known to you.
Does anyone know what type of inexpensive ADT systems are being installed? Have they moved to all wifi systems on the lower end?
This is true, if they are sophisticated enough. But there are costs (money and effort) for them to do so just like there are costs (money and effort) for you to stop them. It comes down to how much they want to break in vs how much do you want to stop them? And how sophisticated are they?
I haven’t seen statistics that compare different types of alarm intrusion attacks. Those would need to come from the police and would probably vary dramatically by location. I’ll keep looking though. This isn’t data we get directly as the monitoring company. When we hand it off to the police, we aren’t given a police report on exactly how the intruder broke in, if they defeated the alarm system, or even whether it was a real intrusion. We only know if the customer tells us later.
ADT has a network of dealers. They install a variety of equipment and it’s industry standard stuff. When it’s ADT-branded it’s usually an industry-standard system white-labeled and sometimes slightly modified for ADT. Except for their Command panel which is a little more proprietary to them. For example, the model numbers on this page imply Honeywell SiX sensors, which use the 2.4 GHz frequency band like WiFi but I wouldn’t call them cheap. They’re state-of-the-art in Honeywell’s line of sensors.
I suspect they are targeted because of how common their systems are, not because of how cheap they are. At the lower end, I’m sure there are some dealers still using unencrypted Honeywell 5800 sensors.
Agreed, but the real answer is to decide how much money and effort you want to put in to staying ahead of them. From a jamming perspective:
Wired > PowerG > SRF & 319.5 MHz
If you really want to beat jamming attacks, use wired sensors. Since that’s not feasible for many who don’t already have wires run, use PowerG (with FHSS). If you aren’t willing to pay the premium for PowerG, use SRF.
As @linagee pointed out, you can do clever things like combine technologies for extra security. If you use an SRF sensor and a PowerG sensor on a door, and you have a sophisticated intruder who might try to use a jammer, it’s more likely that they would be able to jam SRF than PowerG so the SRF sensor is kind of a decoy and the PowerG sensor still gets them.
Also, as @jwcsurety said, hardening the perimeter is a smart thing to do and compliments alarm systems (detection) nicely.
Encryption makes replay attacks difficult or impossible, but does not affect how difficult jamming is.
We know that PowerG operates (at least in the US) on the 915MHz band. It is not difficult to jam the entire band, but, you’re going to piss a lot of people off and make hams get out their RDF equipment and find you and report you to the authorities. (But, it wouldn’t be instant.) RF is always a less reliable communication method than wired. It’s all about cost and time to deploy an RF security system.
That being said, there was a talk on RE-ing PowerG just last month apparently. They are “knocking at the door” of the proprietary nature of PowerG. (It was only a matter of time.)
Ryan,
thank you for your response.
I wish more people knew how much support and insight Surety Provides. Thank you for your willingness to keep us updated and thank you for helping us keep this all in perspective.
I came across Surety many years ago when the Alarm installers abandoned my job. They also said there was no way to accommodate all the hard wired sensors.
I am kicking myself for removing all of those as its hard to run new wires now. But wouldn’t I have had to run all the hardwires to a module that eventually becomes wireless with the GoControl2 panel? Maybe I had no choice?
How many wireless sensor bands are there? I ask this as if you don’t advertise the system you have, the brugalar would have to guess and that is risky and they probably will move on
Even in my current state, I have a mixture of frequencies with legacy and Power G sensors., addind more risk.
The 2GIG GC2 had two wired inputs on its terminal block, so you could have two zones directly wired to it with no wireless link between.
Beyond those two, all zones would have a wireless link either they are RF sensors or wired sensors communicating through a wired to wireless translator.
I wouldn’t be confident in being able to name every band used for security products. Consumer products use a variety of them. The bands I am familiar with having sensors marketed for security; there are 433, 319.5, 345, a range around the 900mhz band (PowerG, zigbee, z-wave), 2.4Ghz (believe SIX sensors use this) I’ve heard of 5Ghz ones as well but I don’t think they are common. There are some odd cases like the Alarm.com Flex-IO which has a direct cellular link to ADC.
Thanks. How many wired sensors can IQ 4 have without wireless translator. ?
The IQ Panel 4 does not have a wired terminal block for sensors. All wired sensors would have a wireless link.
The IQ Pro is a hybrid panel that includes wired sensor terminals and PowerG support.
