SimpliSafe Base Station (SSBS3)
From Wiki-IoT
Revision as of 15:06, 25 October 2026 by TJUTZT (talk | contribs) (Student assignment submission for IoT security assessment)
(diff) ← Older revision | Approved revision (diff) | Latest revision (diff) | Newer revision → (diff)
| SimpliSafe Base Station (SSBS3) | ||
|---|---|---|
|
Security Grade
Calculator v1
|
SimpliSafe Base Station (Gen 3)
Brand: SimpliSafe (Parent: SimpliSafe, Inc. (no parent company)) Category: Base Station • Model / Gen: 3rd generation (Gen 3) SSBS3 Release Date: 2018-01-01 • Status: In sale Classification Date: 2026-10-25 • Official Website | |
Contents
Security Evaluation
1. Device Security
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Known hardware tampering | Rare | https://nvd.nist.gov/vuln/detail/CVE-2019-3997 https://www.tenable.com/security/research/tra-2020-03 🔗 Proof | CVE-2018-11400: Original base failed to detect battery/power removal. CVE-2019-3997: SS3 firmware 1.0-1.3 allowed rogue keypad pairing via a physical button; fixed in 1.4. |
| Known vulnerabilities | Rare | https://nvd.nist.gov/vuln/detail/CVE-2019-3997 https://nvd.nist.gov/vuln/detail/CVE-2019-3998 🔗 Proof | NVD lists 7 SimpliSafe CVEs, mostly Original. SS3 issues are keypad-pairing bypass and Wi-Fi configuration tampering, requiring physical proximity; both fixed in 1.4+. |
| Prior attacks | Rare | https://www.tenable.com/security/research/tra-2020-03 https://www.cisa.gov/known-exploited-vulnerabilities-catalog 🔗 Proof | 2016 IOActive replay/jamming demo on Original and 2019 Tenable keypad-pairing demo on SS3. Vendor reports no confirmed customer compromise; no CISA KEV entry. |
| Updatability | Very common | 🔗 Proof | Wi-Fi-connected base receives automatic firmware updates after disarming (2.15+); manual checks via app or keypad are documented. Vendor can push patches. |
| Category Score | Score: 2 / 3 | ||
2. System Security
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Authentication with other systems | Partial | https://support.simplisafe.com/articles/orders-warranty/upgrade-to-bestinclass-security 🔗 Proof | Base uses proprietary RF, so sensors cannot be used with other systems; integration is limited to Alexa/Google Assistant through the cloud account. No open local API. |
| Communications | Encrypted with up-to-date encryption | https://support.simplisafe.com/articles/orders-warranty/upgrade-to-bestinclass-security 🔗 Proof | Vendor states Gen3 encrypts all communications (RF, cellular, Wi-Fi to backend) and adds bank-level Wi-Fi encryption; Wi-Fi requires WPA2/WPA3. |
| Storage | Encrypted with up-to-date encryption | https://simplisafe.com/smart-alarm-wireless-indoor-camera 🔗 Proof | Vendor states all communications are encrypted and camera data is encrypted at rest/in transit; base-station local config/PIN storage is not separately documented, so this is partly inferred. |
| Category Score | Score: 2 / 3 | ||
3. User Authentication
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Account management | Full | https://support.simplisafe.com/articles/account-billing/multifactor-authentication-mfa-for-simplisafe-accounts https://support.simplisafe.com/en_GB/articles/app-features/additional-user-access-for-simplisafe 🔗 Proof | Account creation, recovery code, mandatory MFA/biometrics, Owner/User roles and up to 25 additional users are supported. |
| Authentication | Secure | https://support.simplisafe.com/articles/account-billing/how-to-create-a-simplisafe-account/66200333a9ac7835e7b98fad 🔗 Proof | Password plus mandatory 2-Step Verification/MFA (email or SMS/call) on new-device login; biometric authentication is optional, making a strong login design. |
| Brute-force protection | Exist | 🔗 Proof | MFA codes are capped at 10 calls/texts per hour; exceeding the limit locks login for at least one hour. This is an effective rate-limit/lockout control. |
| Event logging | Access event logged | 🔗 Proof | App/web Timeline records arming, disarming, alarms, device additions, Wi-Fi loss/restore, firmware updates and power outages. |
| Passwords | Require change after setup with complexity requirements | 🔗 Proof | Account password requires 8+ chars and 3 of 4 classes (upper/lower/number/special). Master PIN is user-set 4 digits with no default; forced-change wording is only partly applicable. |
| Category Score | Score: 1 / 3 | ||
Technical Specifications
| Property | Details |
|---|---|
| Operating System & App | Proprietary embedded firmware (v2.x) (Companion App: SimpliSafe Home Security app; online account) |
| Hardware (CPU / GPU) | CPU: N/A • GPU: N/A |
| Memory & Storage | Memory: N/A • Storage: N/A |
| Power, Battery & Charging | Battery: 4 x 1.2 V, 1300 mAh NiMH; up to 24 h • Power: AC adapter with 6-ft cord; voltage not published • Charging: NiMH continuously recharged while AC-powered |
| Display & Camera | Display: LED status ring/light; no screen • Camera: None |
| Sound & Connectivity | Sound: 100 dB siren • Connectivity: Wi-Fi 2.4 GHz (WPA2/WPA3), cellular backup, proprietary RF |
| Physical (Dimensions & Mass) | Dimensions: 8.25 in tall, ~4 in widest (4 x 8.25 x 4 in) • Mass: N/A |
Student assignment submission for IoT security assessment.
