Ring, SimpliSafe, and Three Other DIY Home Security Systems Vulnerable to Hacking - ConsumerReports.org

Consumer Reports shared its findings with the five manufacturers and asked each if it would update its systems to prevent jamming. Only Eufy explicitly said it will fix the jamming issue (the company plans to release a software update in early April). Cove said it is considering moving to encrypted sensors for a future version of its system and has "been monitoring whether the cost and complexity is justified by the threat in the field." Ring said it has "implemented safeguards in our Ring Alarm system to help address wireless signal jamming, and we will continue inventing ways to help protect our customers," but did not get more specific.

SimpliSafe responded that it continually refines its jam detection algorithm and releases "security updates to safeguard our system against jamming vulnerabilities." Abode pointed to the fact that it offers jam detection as a standard feature but did not address the jamming itself.

Manufacturers that don't currently offer jamming detection were mixed on whether they would add it. Cove said it plans to add jam detection to its system next year, but likely as an optional feature. Eufy said it would not add the feature to its system. Ring wouldn't directly answer our question about whether it will add that feature to its system.

There may be a reason for their reluctance. "Jam detection can create false positive alerts due to interference from other wireless devices, which might be why some brands opted not to implement the feature," Garcia says.

In addition to the vulnerabilities related to jamming, Abode and Cove had a handful of small, lower-risk security issues that we found, which they did fix.

Bruce Ehlers, vice president of product development and engineering at Cove, adds that the residential security industry doesn't see these types of attacks as a huge issue, with millions of these systems in US homes today. The deterrence value of an affordable home security system is proven in the market and "the industry has not experienced significant real-world intrusions due to replay or jamming attacks," says Ehlers.

Glenn Gomes-Casseres, vice president of product and design at SimpliSafe, points out that these attacks are difficult to pull off in the first place.

"In order to jam a device, one would have to perfectly execute a highly nuanced protocol with devices specifically tuned and configured for this purpose," says Gomes-Casseres. "And even if successful, thanks to SimpliSafe's built-in detection, customers are alerted, and cameras are queued to record and capture evidence, during jamming attempts."