-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Advisory ID:               SYSS-2024-045
Product:                   Mengshen Wireless Door Alarm M70
Manufacturer:              Jingzhou Mengshen Electronic
                           Technology Co., Ltd
Vulnerability Type:        CWE-294: Authentication Bypass by 
                           Capture-replay
Risk Level:                High
Solution Status:           Open
Manufacturer Notification: 2024-05-28
Solution Date:             tba.
Public Disclosure:         2024-07-12
CVE Reference:             CVE-2024-37016
Author of Advisory:        Sebastian Auwärter, SySS GmbH

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Overview:

Mengshen Wireless Door Alarm is a door alarm system which uses a
sub-gigahertz remote for arming and disarming.

The manufacturer describes the product as follows (see [1]):

"Thanks for coming, you deserve the best! This is Mengshen's Wireless
Sound Light Alarm M70.

This compact wireless window door alarm will be a home guard to protect
you and your family whether at home or go out. It can be widely used in
home, shop, office and other needed places.

Easily arm by pressing the Arm key. Once triggered, 105 db super loud
voice comes with flash light, for any intruders, it will be a terrible
nightmare and a great deterrence."

Due to the absence of any security mechanism like message signatures
or rolling keys, the door alarm is prone to a replay attack.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Vulnerability Details:
The signals are easily sniffed and replicated by sub-gigahertz antennas
and a software-defined radio or, in this case, by specialized hardware 
like a Flipper Zero. By capturing a signal from a safe distance and 
replaying the same signal later, an attacker can circumvent the alarm 
and break into secured facilities.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Proof of Concept (PoC):
A Flipper Zero device (see [2]) can be used to capture the signal and to
store and send the signal again. To store the signal, navigate to "Sub
Gigahertz" -> "Read RAW" -> "Config" and set the frequency to 433,92 MHz.
Afterward, the "disarm" signal sent by the remote can be recorded using the REC
button. The signal can now be sent again or saved for later with the
"Save" option. The replicated signal disables the door alarm.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Solution:

Use a challenge-response method for disarming the alarm system or, if 
this is impossible, implement a rolling key solution to prevent easy 
attacks.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclosure Timeline:

2024-05-24: Vulnerability discovered
2024-05-28: Vulnerability reported to manufacturer
2024-06-10: Reminder sent to the manufacturer
2024-06-19: Reminder sent to the manufacturer
2024-07-12: Public disclosure of vulnerability
tba.: Patch released by manufacturer

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

References:

[1] Product website for Mengshen Wireless Door Alarm M70
    https://imengshen.com/collections/anti-theft-alarm/products/mengshen
    -wireless-door-alarm-with-remote-control-anti-theft-burglar-alarm-id
    eal-for-home-garage-apartment-rv-personal-security
[2] https://flipperzero.one/
[3] SySS Security Advisory SYSS-2024-045
    https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/
    SYSS-2024-045.txt
[4] SySS Responsible Disclosure Policy
    https://www.syss.de/en/responsible-disclosure-policy

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Credits:

This security vulnerability was found by Sebastian Auwärter of SySS
GmbH.

E-Mail: sebastian.auwaerter@syss.de
LinkedIn: https://de.linkedin.com/in/sebastian-auw%C3%A4rter-156035305
Public Key: https://www.syss.de/kontakt/pgp-keys
Key Fingerprint: F98C 3E12 6713 19D9 9E2F BE3E E9A3 0D48 E2F0 A8B6

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclaimer:

The information provided in this security advisory is provided "as is"
and without warranty of any kind. Details of this security advisory may
be updated in order to provide as accurate information as possible. The
latest version of this security advisory is available on the SySS
website.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Copyright:

Creative Commons - Attribution (by) - Version 3.0
URL: http://creativecommons.org/licenses/by/3.0/deed.en

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE+Yw+EmcTGdmeL74+6aMNSOLwqLYFAmaOK2YACgkQ6aMNSOLw
qLb3tg//QRQGIfYWtKXoYYepAnw7zBzaQ62U0kxiTANWJ1g66eiIMVOcCHLLTbR/
vcTWvvCbJzXjieGZNSVQX3jjqX2Et6o8E/pTdSin/i3ygZJNazeud/UoAYCw3Zi4
n0u2YG1AZNaMCOr/NdHn5Ro2MiBxfuOMg9BWr71EoaOEuTsjD18aG7Pw2PHlIPVd
/DBmMaD3ShyyDIE7qN7HLPvhZpR4IMIP2mPXQyaFLmvcMzIy/r66l2WLj7ef737l
s3jFwjHcPhDOeh7oMFxxOPoD57IvuUzEwjE4GSkBy+3bt2sw7P8/KMGZNHfbBt6/
fLLiCgIHpjzLrOYpyCkpXU58YLr83Ig/PLfMWVvK7sL/x2Lys2LXaIIW5Khqb5Hs
VLRDI71zQmGGJqPJxqYycJtd7DZ2s4SMT8s5YNtV5BkRY5SuShUR/dgwCr/qxhrV
wqNrPRiP3e22vLGj4gS/cp9PwGaQ4O1iCS+0VeckVeO3guKTaYn1eV11XE4XVLWQ
J6tWKUqZC+PloCjbD5xTjp8zGu39sLVa3SHXEGz+8QSlSKi/+4wVaIZi570m6hZ4
AH810oVO/CHmNbKQXltj0UwdGqDOKp7FijhLq6c6A8n62zB978d0G/vEf/WQ05dD
EsO1Hit5j1Yy8k1wPl37nG8Lf8QBuNUejh9/6QunH8KYIiEtvpM=
=k+zW
-----END PGP SIGNATURE-----