Noncompliant Equipment - GIAC

Operating Temperature: 32° to 150°F (0° to 65° C)
Output Protocols: TCP/IP
Input Protocols **** (SIA format)
Connectors: 4-pin header for the ***** &RJ-45 for Ethernet
Inputs & Outputs: 1 programmable output & 1 tamper input
Network: Ethernet LAN/WAN 10BaseT or 10/100BaseT
Call Direction Options: Primary or backup communicator
**** Information Guide 11 Rev. 003
Downloading Support: Using ***** and or System Administrator software
Programming: Panel keypad
Multiple Central Stations: Primary and backup
Approval Listings: FCC/IC and CE (UL and ULC pending)
Substitution Detection: Monitoring of MAC address
At this point, it’s obvious that the introduction of this device to the network needs to be prohibited by
the IT group from the outset. The developer’s understanding of the IP stack is questionable at best, and
it is certain that the deficiency in skill level will be passed down through the vendor channel and come
to rest as a problem for the IT group, not the least of which will be security issues.
There is no description of the IP stack of the device, (that is, list of protocols), and no visibility into the
device if deployment requires administrative involvement by the IT group.
The IP stack of the device is so under-developed that there is absolutely no way to predict how it will
perform in a production environment. The apparent purpose of the device is to transmit security alarm
signals over the network to eliminate a telephone line. This trivial expense advantage is certain to be
eliminated in ongoing support costs.
Using what tools would be available to a typical networker, we examine traffic from the device that we
can see in the most basic implementation, which is a cross-over cable connected to a PC.
When we sniff the traffic, we see ARP requests coming from the device, which at least allows us to
discover the MAC address.
Ethernet II (Packet Length: 64)
Destination:
Source:
ff-ff-ff-ff-ff-ff
00-03-4f-00-15-20
Type: ARP (0x0806)