UPB Security - Are you concerned?

[blafarm]

I understand that UPB signals transmit over the powerline between 4-40k. I also understand that they will leave your house and be transmitted to every other home hanging off your transformer. Conversely, your neighbor's UPB signals can and will do the same.

I also understand that UPB signals consist of a Network ID and Device ID. And that contrary to popular thought, the 4-character UPB password is only used for setup/programming mode - it is not encrypted and, more importantly, it is not used at all as a security layer for any command transmissions.

I have been told that sniffing and hijacking UPB is easy and that the potential for misuse is real. This has been confirmed by PCS/PulseWorx (inventors of UPB), Simply Automated and HAI.

While those three companies seem to recognize the need for a whole-house filter solution (either incoming, outgoing, or both) - none of them have developed one beyond a small version used for training stations.

With the help of the lead PulseWorx engineer, I was pointed in a direction to begin searching for a whole-house filtration solution to prevent the penetration of UPB signals originating from outside the house. I spent some time researching this product:
http://0036102.netsolhost.com/Docs/RP135.pdf
Unfortunately, the company will not provide specs regarding the actual 4-40k attenuation and I'm not willing to buy one to find out. I have looked high an low for a "Plug and Play" alternative - but I have come up short.

Now, I imagine this may not be important to someone controlling a lamp or two - but most people on this forum probably don't fall into that camp. I, for one, would prefer bi-directional unit (preventing outgoing and incoming UPB) - but I'd settle for incoming if I had to.

Questions:

1. Am I alone with this UPB security concern - or do any of you share this concern?

2. Does anyone else have a suggestion for 4-40k whole house filtration?

Thanks

[DC]

I personally am not concerned about this for two reasons:

1. My house is the only one on my transformer and there will never be another one on it.

2. Even if UPB signals can operate beyond the transformer (ie, could jump to my neighbor's transformer), I'm not terribly worried about it because the worst someone could do is turn lights on and off and maybe a few other devices like water circulation pump, dehumidifier, etc. I wouldn't use it for anything security related like door locks or alarm systems. So, while a "hacker" might be able to annoy me, he wouldn't be able to do any real harm.

[Oman]

1) The signals are not terribly strong at after travelling to the transformer and all the way back, then being branched off again. Thus the need for the panel signal bridge. Locally I get no signal at my neighbor's (new) house. I can't read or control anything from any point beyond the transformer (the electric guys working on my 'hood were nice enough to give me access while they were connecting up the house next door)

2) There is no protocol that can't be sniffed or spoofed. There actually is little security in Z-wave too - there is a sniffer that can be used within 100 feet or so of the house to repeat existing control signals. As with UPB the security is in the setup, and even then there isn't much.

3) Insteon is worse as you just need the ID of a device to program it. SmartHome tries to mask the ID in their PLC but it can still be had pretty easily.

4) Filtering the signal is pretty simple (from an electronics design and manufacturing point of view) but you have to handle large load capacity and get UL approval for anything sold. Supposedly several of the X10 filters are wide enough to block UPB as well. I have not tested any.

There are many factors that would have to come together for this to be a problem. You would have to have a situation where the signal was strong enough to travel to an adjacent house, you would have to have a neighbor who knew you were using UPB, that person would have to want to bother you, that person would have to know enough to sniff the traffic and generate signals that would affect you.

If you want truly secure automation control then you have to go wired. There is no currently available protocol that has what you are asking for. There are practical reasons that the current protcols are are not hard-encrypted. The additional bandwidth, complexity, and thus greatly increased cost would leave most people out of the market.



Jon

I understand that UPB signals transmit over the powerline between 4-40k. I also understand that they will leave your house and be transmitted to every other home hanging off your transformer. Conversely, your neighbor's UPB signals can and will do the same.

I also understand that UPB signals consist of a Network ID and Device ID. And that contrary to popular thought, the 4-character UPB password is only used for setup/programming mode - it is not encrypted and, more importantly, it is not used at all as a security layer for any command transmissions.

I have been told that sniffing and hijacking UPB is easy and that the potential for misuse is real. This has been confirmed by PCS/PulseWorx (inventors of UPB), Simply Automated and HAI.

While those three companies seem to recognize the need for a whole-house filter solution (either incoming, outgoing, or both) - none of them have developed one beyond a small version used for training stations.

With the help of the lead PulseWorx engineer, I was pointed in a direction to begin searching for a whole-house filtration solution to prevent the penetration of UPB signals originating from outside the house. I spent some time researching this product:
http://0036102.netsolhost.com/Docs/RP135.pdf
Unfortunately, the company will not provide specs regarding the actual 4-40k attenuation and I'm not willing to buy one to find out. I have looked high an low for a "Plug and Play" alternative - but I have come up short.

Now, I imagine this may not be important to someone controlling a lamp or two - but most people on this forum probably don't fall into that camp. I, for one, would prefer bi-directional unit (preventing outgoing and incoming UPB) - but I'd settle for incoming if I had to.

Questions:

1. Am I alone with this UPB security concern - or do any of you share this concern?

2. Does anyone else have a suggestion for 4-40k whole house filtration?

Thanks

[blafarm]

Thanks Oman,

All very good points - and right on the money regarding load capacity and UL Approval issues relating to whole-house filters.

Your comment regarding the possiblity of existing X10 filters being wide enough to block UPB is something I explored with Lightolier - but I hit a dead end.

I'm probably over-thinking this, and will eventually let go, but are there any other X10 manufacturers that come immediately to mind that maybe I should explore?

Thanks

[Oman]

This I know because I'm using one to test killing UPB signals - the FlterLincs kill UPB as well as X10 and Insteon. In my earlier post I was thinking whole-house only, of which I don't know of any specifically for UPB. If there is a whole-house filter with the same design as the FilterLinc then that would work very well.

Jon

Thanks Oman,

All very good points - and right on the money regarding load capacity and UL Approval issues relating to whole-house filters.

Your comment regarding the possiblity of existing X10 filters being wide enough to block UPB is something I explored with Lightolier - but I hit a dead end.

I'm probably over-thinking this, and will eventually let go, but are there any other X10 manufacturers that come immediately to mind that maybe I should explore?

Thanks

[anogee]

The UPB password is really intended to prevent interference with neighbors, since there are enough code combinations for everyone to have lots of code combinations. No wireless or wired homeautomation protocol has any type of encryption that I know of. A neighbor would need to be pretty bored to want to spy on your homeautomation signals. If your really worried, you can always go with a system that uses separate wiring, like ALC.

[blafarm]

Thanks Oman. I'll give Smarthome a call to see if they can steer me to a whole-house version of their product.

Anogee, my understanding from conversations with all three manufacturers is that the password has nothing to do with interference with neighbors. My understanding is that its use is limited to program/setup. Meanwhile, I think you are absolutely correct about the "bored neighbor" theory. But, after years of coming home to find X10 lights and appliances turned-on (due to a host of factors), I'm just trying to lock things down a bit.

[Oman]

Remember there is a network ID on every transmission and every device is programmed only to respond to that network ID. This is how they designed UPB to avoid accidental interference from neighbors. The only way to know that your network ID is would be for your neighbor to write a piece of software to decode the network packets. UPStart won't tell you. Interference would have to be intentional.

Jon

Thanks Oman. I'll give Smarthome a call to see if they can steer me to a whole-house version of their product.

Anogee, my understanding from conversations with all three manufacturers is that the password has nothing to do with interference with neighbors. My understanding is that its use is limited to program/setup. Meanwhile, I think you are absolutely correct about the "bored neighbor" theory. But, after years of coming home to find X10 lights and appliances turned-on (due to a host of factors), I'm just trying to lock things down a bit.

[blafarm]

Agreed. I think the probability of accidental interference is very low.
Unless, of course, you live in a very tall high rise in NYC along with a couple of hundred automation freaks.

[JKaplan]

Dear god, I'd be happy if I could get the signals to propagate through my OWN house, much less to the neighbors!

If a neighbor wanted to do mischief, there's a lot easier and more destructive things to do. What the heck kind of neighborhood do you live in anyway?

PS - I like the idea of a high rise full of automation freaks in NYC - "Automation House". Sequel to "Animal House" no doubt, and just as funny.

[blafarm]

Yeh...

1-Building
300-Apartments
900-Unfinished Automation Projects

...and the only switch in the building that works is in the basement - and it was installed in 1957.