Industry News and Discussions Posts

Posted By

Older IPCAM-WIC1, IPCAM-WIC2, IPCAM-WOC1, and IPCAM-WOC2 cameras need an update to keep working with Total Connect 2.0. If you have an affected camera and it hasn't been powered up with a network connection between June 30, 2024 and now, power it on and connect it for at least two (2) days.


You can read the full notice from Resideo here. This notice has been distributed to all Total Connect 2.0 alarm dealers. The gist is this, if you have one of the legacy IPCAM-WI or IPCAM-WO cameras listed, and your camera has been connected to a TC2 system and working for any consecutive two (2) day period between June 30, 2024 and now, you don't need to worry. The update should already be completed.

Any of the above mentioned cameras that don't receive this update will cease to be recognized by the Total Connect 2.0 server beginning on November 1, 2024. Any such camera will no longer receive updates from the server and will cease being supported by Resideo.

You can verify your camera's firmware version by logging into the Total Connect 2.0 app. Go to Cameras. Tap the More icon in the upper right (⋮) of the camera. Tap Settings, then scroll down to Camera Info. The firmware version will be displayed. For IPCAM-WIC1/IPCAM-WIC2 the firmware version should be 2.07. For IPCAM-WOC1/IPCAM-WOC2, the firmware version should be 2.09. Cameras showing these versions have already been updated.

There are three (3) scenarios where one of these legacy cameras may still need to be updated. The first situation won't usually affect DIY users, but the second and third are strong possibilities. We'll discuss each scenario below.

Scenario 1: A Brand New Camera That Has Never Been Installed

This scenario will more than likely only be experienced by an alarm dealer who keeps physical inventory on their premises. Any camera that is new in the box and has never been powered on, connected to internet, and registered with a TC2 account will require some intervention before October 31, 2024. Without this intervention, the camera will cease to be compatible with Total Connect 2.0.

If you're a homeowner with a new security camera that hasn't been activated, you should do so at least two (2) days before October 31, 2024. Failure to activate your camera and give it enough time to receive the update may prevent it from working with any Total Connect 2.0 security system.

Scenario 2: A Previously Used Camera That is Offline and Deleted from TC2

If you have a legacy Total Connect 2.0 camera that hasn't been powered on, connected to the internet, and registered to a TC2 account for at least two (2) consecutive ays between June 30, 2024 and now, you need to take action.

To complete the update, power on your camera, connect it to the internet, and register it to your TC2 account. The update will happen automatically once the camera registers. Keep your camera powered on and online for at least two (2) days to ensure the update finishes successfully.

Scenario 3: Previously Registered Camera That Is Offline

If your legacy camera hasn't been online for at least two (2) consecutive days since June 30, 2024, you need to power it on, connect it to the internet, and verify the connection by checking its live view in Total Connect 2.0. Keep your camera connected for at least two days. This will allow the update to complete.

If, after November 1, 2024 you decide to purchase a used IPCAM-WIC1/IPCAM-WIC2 or IPCAM-WOC1/IPCAM-WOC2 make sure that the camera has received this update prior to the purchase. Any of these legacy cameras that have not been updated will be useless as anything other than a unique paper weight.

Tags: , , , , , , , , , , , ,

Comments


Posted By

The Alarm Grid offices will be closed on Labor Day, Monday, September 2. This allows our team members a chance to enjoy the final holiday this summer season. We will return on Tuesday, rested and ready to help you protect your home or business from burglary, fire, carbon monoxide, and flood.

Our monitoring station partners, Criticom Monitoring Service (CMS) and Rapid Response, are available 24/7/365 to respond to any alarms, troubles, or environmental situations that may arise from an Alarm Grid-monitored system.

Alarm Grid customers in the United States receive monitoring service through Criticom (CMS). When your Alarm Grid system sends a signal, a CMS operator receives and processes it based on a pre-set list of instructions. Alarm processing may involve immediately sending authorities or calling the premises and a list of contacts to determine if an emergency exists before dispatching. Whatever the instructions, the process takes only moments to complete.

If you need to contact CMS, either to put your system on test or to report that an alarm does not require dispatch, you can do so by calling (888) 818-7728 and choosing Option 9. When you contact them, be sure to have the proper information ready. They will need your name, address, and your false alarm password or phrase. This is very important! If you call the monitoring station during an alarm and provide an incorrect password, they will be required to dispatch authorities.

For Alarm Grid's Canadian monitored customers, monitoring service is provided by Rapid Response. If you need to contact them, you can call (800) 932-3822 and follow the prompts. You should only contact them for issues such as putting your system on test or canceling a potential dispatch due to an accidental alarm.

Neither monitoring station can provide technical support or make changes to your account, so if you need that type of help, please contact Alarm Grid instead. You can email support@alarmgrid.com with details of what you need, and we will respond as quickly as possible when we're back in the office on Tuesday, September 3. Our support hours are from 9:00 AM to 8:00 PM EDT if you prefer to call, but please be patient as we clear any backlog of requests.

We hope you have a relaxing holiday weekend with your loved ones. Stay hydrated, use sunscreen, and make sure your pets have plenty of fresh, cold water. If you'll be traveling during the holiday, be sure to arm your alarm system before you leave. And most importantly, have fun!

Tags: , , , , , ,

Comments


Posted By

In the coming weeks Total Connect 2.0 users on app version 6.44.1+ with a SkyBell will be prompted to update the SkyBell Video Doorbell's firmware. This update is part of a backend migration process. There will be an option to skip the upgrade, but eventually an update will be automatic.

This affects any TC2 users with any of the following SkyBell Video Doorbells. All of these units have been discontinued:

  • DBCAM-TRIM
  • DBCAM-TRIMBR
  • DBCAM-TRIM2
  • DBCAM-TRIMBR2
  • DBCAM
  • DBCAM-BR

It's possible this migration has some correlation to our report from December of last year. In the prior blog, we discussed how SkyBell users were receiving recommendations to upgrade their SkyBell to "Gen5". But after this upgrade, any access the user had to their SkyBell through third-party apps, like Total Connect 2.0, would be removed. The move to Gen5, once completed, can't be undone.

Phased Process for Upgrade and Migration of SkyBell Video Doorbells with Access Through Total Connect 2.0

  1. Phase I: In the coming weeks Total Connect 2.0 users will be prompted, presumably via a push notification since a particular app version (6.44.1+) is required, asking them to perform a firmware update of the video doorbell. Any user who originally set their video doorbell up through the SkyBell HD app will need the login credentials they used for that app to complete this process. The user will be prompted through a few easy steps to complete the update and migration.
  2. Phase II: At some point, users who ignore the initial prompt will receive a popup dialog box when logging into Total Connect 2.0 asking them to update. If the user chooses the option "UPGRADE LATER" they can skip the upgrade temporarily. But the next time they log into TC2 the SkyBell will be upgraded and migrated without prompting. If the user accepts this invitation to upgrade, they will immediately be guided through the upgrade and migration steps. Again, any user who originally used the SkyBell HD app to configure their video doorbell will need the credentials for that app to complete this process.
  3. Phase III: Any user who ignores the first two phases will eventually have their SkyBell Video Doorbell updated and migrated automatically. Please note, only Skybell doorbells that are powered up and online can be updated and migrated. Presumably, and I'm attempting to confirm this, any SkyBell video Doorbell that is not online or powered on in time for the upgrade and migration process may lose the ability to access the device through Total Connect 2.0.

For the most part, users won't notice any difference in the way their device works or appears in TC2 after this process is complete. However, this migration does mean that the SkyBell doorbell, once upgraded, will no longer be accessible through SkyBell HD or any new SkyBell apps.

In addition to no longer being accessible through any SkyBell apps, all settings in the SkyBell Video Doorbell will be set back to their factory defaults during the update and migration. Affected settings include:

  • LED Color
  • Motion Detection
  • Motion Sensitivity
  • Image Quality
  • Speaker Volume
  • Indoor Chime
  • Outdoor Chime
  • Digital Chime
  • Outdoor Chime Volume

These settings can be readjusted using the TC2 app once the upgrade and migration have been completed. Another post-migration change is that SMS notifications will no longer be available for SkyBell Video Doorbell events after the migration. Push notifications and email notifications will still be available.

Changes for Users of PROSeries Panels:

Users of the Honeywell Home PROA7PLUS and Resideo PROA7PLUSC who have the panel configured to allow SkyBell viewing at the panel will need to be sure their panel is updated to firmware 03.2305.91+ in order to retain this functionality. If you need a firmware update, contact your alarm dealer. If you're an Alarm Grid customer in need of a firmware update, send us an email at support@alarmgrid.com.

To verify the version of your panel's firmware tap the Menu Icon (≡) at the bottom of the screen, then tap Tools > enter either Installer or Master Code (4112 or 1234 by default, respectively) > tap System Information > tap General Information. If your version shows lower than 03.2305.91, request a firmware update from your alarm dealer.

After the update and migration the Honeywell Home PROWLTOUCH and Resideo PROWLTOUCHC keypads will no longer support viewing of SkyBell video on their touchscreen, regardless of firmware version.

Tags: , , , , , , , , , , , , ,

Comments


Posted By

Update 09/25/24: We noticed the display issue, where apparent programming information was displayed is resolved. There's no information on exactly when this occurred.

Update 08/29/24 2:12 pm EDT: According to Resideo, they have received reports of this same behavior from other dealers. Alarm Grid alone reported no less than 17 accounts with the issue. Per engineering, the notification issue was resolved at approximately 10:09 am EDT this morning. The other issue, with erroneous programming information being displayed on the screen is ongoing.

Original Post 08/29/24 9:55 am EDT: So far, we've only seen this reported with PROSeries panels. At the top of the Activity screen some coding information is being displayed. In addition, each time a Sensor Open notification is added to the Activity screen a Disarm notification is also added, even though no disarm occurred.

Below is an example of the coding information being displayed at the top of the activity screen:

In this screenshot, you can see a disarm with the same timestamp as the preceding event:


The PROSeries panels include the Honeywell Home PROA7 and PROA7PLUS and the Resideo PROA7C and PROA7PLUSC. These panels are collectively known as the PROSeries.

This appears to be a coding error, and will hopefully be a simple fix. We have reported this to Resideo, but haven't heard back from them yet. This is a developing situation, so we will update this post as more information becomes available.

The main thing to understand at this point is that although this is an annoyance, it doesn't seem to affect the ability to control your system remotely. It also appears to have no effect on your system's ability to report alarm signals to the monitoring station, when central station monitoring is being used.

Tags: , , , , , , , , , , ,

Comments


Posted By

Alarm.com introduces a new floodlight and 4MP camera. The ADC-V729AC connects to 110V AC wiring, the ADC-V729 plugs into a standard outlet, and the ADC-VC729P offers PoE. The floodlight delivers a bright 3,000 Lumens while the camera offers onboard recording, PIR motion sensing, and more.


Alarm.com continues to raise the standard for video solutions in residential and small to medium commercial spaces. Consistently rolling out innovative and sought-after products, their latest ADC-V729 series floodlight and video camera combo fills a crucial gap in the market.

With a variety of options to power the unit, the ADC-V729 series can solve nearly any outdoor monitoring and viewing need. By combining PIR motion sensing with Alarm.com video analytics, onboard recording, and a bright pair of floodlights, you can protect even the darkest corners of your property.

Since there are three (3) different versions of this new device, there are three different sets of specifications. Be sure to pay attention to the correct documentation for the product you intend to use. The specifications for all versions are included in a single specification sheet located here. In the table below, we'll include the specifications that are common to all three (3) versions.

Alarm.com ADC-V729 Series Common Features

The following features are found in all versions of the ADC-V729, regardless of input power type:
Feature Value
Image Sensor 4MP 1/2.7” format
Recording Compression H.264
Live Resolution Options Up to 2688 x 1520
Recording Resolution Options Up to 2688 x 1520
Horizontal Field of View 117°
Vertical Field of View 62°
Diagonal Field of View 141°
WIFI Support Dual-band 802.11 b/g/n/ac 2 x 2
(ADC-V729AC and ADC-V729DC versions only!)
Ingress Protection IP66
Low Light Sensitivity 0.5 Lux
IR Range 49.2' (15m)
Floodlight Brightness 4000K, 3000 Lumens Floodlights
Image Adjustment Options Flip, Brightness, Contrast, Saturation, Sharpness, Exposure
Operating Temperature -4° F - 122°F (-20°C - +50°C)
Operating Humidity 20% - 100%
Dimensions (L x W x H) 12" x 9.25" x 7.79" (30.5cm x 23.5cm x 19.8cm)

Power Requirements By Product Version

Product SKU Power Requirements
ADC-V729-DC DC 24V 2A, DC PSU
ADC-V729-AC AC 100-240V
ADC-VC729P-POE/DC DC 24V 2A, DC PSU, or PoE++ (802.3bt)


All Related Product Links

Product SKU and Link Description
ADC-V729 Floodlight and 4MP Camera that uses 24 VDC Plug-in power supply (included).
ADC-V729AC Floodlight and 4MP Camera that uses hardwired 100 - 240 VAC.
ADC-VC729P Floodlight and 4MP Camera capable of using PoE++ or 24 VDC plug-in transformer.
ADC-VC729P-BNDL Bundle comprised of ADC-VC729P and TL-PoE170S PoE++ injector for power.
ADC-PSU-24V2A Replacement power supply for ADC-V729DC. It can also be used to power ADC-VC729P when PoE++ is not available.
ADC-VPE-729DC 19' (5.79m) extension cable for ADC-V729DC and ADC-VC729P power connection.

The ADC-VC729P can be powered using PoE++ (802.3bt), as shown in the middle table above. This is particularly important because the earlier PoE standards (IEEE 802.3af and 802.3at) do not provide enough power for this device. Only a PoE device that supports IEEE 802.3bt can deliver the required current. Since these devices use all eight (8) pins on the RJ45 connector, make sure you use cabling that includes all four (4) wire pairs.

That brings us to another point. Because both the camera and the floodlights are being powered, the ADC-V729 Series devices use a 24 Volt power supply (ADC-V729-DC and ADC-VC729P) or 100-240 Volts AC (ADC-V729AC). A 12 Volt DC power supply that is sufficient for other Alarm.com cameras will not provide enough power for this device.

The ADC-V729 and the ADC-V729AC both support dual-band WIFI. The ADC-VC729P supports wired ethernet only. If you don't have a PoE ++ capable switch or a PoE injector available, then the ADC-VC729P can use the ADC-PSU-24V2A DC Power Supply Unit. This is also the replacement power supply for the ADC-V729 if its original power supply is lost or damaged. In the table above you'll see a link to a bundle that contains both the ADC-VC729P and a compatible PoE++ injector.

We think this is an exciting new product that fills a previously overlooked niche in the security market. Let us know your thoughts in the comments below. Do you have an idea for a video or automation product? Let us know and we'll pass your feedback along to Alarm.com, Qolsys, Resideo, 2GIG, or any of our other manufacturing partners.

Tags: , , , , , , , , , ,

Comments


Posted By

Apple will end support for the legacy Alarm.com Today widget in its iOS 18 update, coming in September. As a result, Alarm.com will be removing this widget in app update 5.6.0, due in October. But widget lovers take heart! Alarm.com has plans for new widgets that will be available soon!

The use of the Alarm.com Today widget required that a user be on iOS version 11.0+, and Alarm.com app 3.7+. Successful use also required that the user be logged into the Alarm.com app with "Seamless Login" enabled and the "Remember Me" option checked upon logging in.

Without these login features set, each time the user logged out, the "Today View" widget for Alarm.com would be cleared. Once the feature was configured, up to twelve different items could be configured and organized within the view. This allowed a user to quickly determine the status of various elements of the system, and control them.

System Control Widget

According to Alarm.com: "The System Control widget empowers iOS customers with quick-access, one-touch command of their smart security systems at their fingertips. Customers can create custom widgets and place them conveniently on their Home screen or Today View for effortless control of their lights, locks, garage doors, gates, and security panels from anywhere. Plus, they can activate Scenes for whole-home automation."

Saved Clips Widget

According to Alarm.com: "iOS customers can create widgets for video clips to effortlessly keep tabs on their properties and monitor important activity—without having to open the app. Right from the Home screen of their iPhone or iPad, they can choose from a variety of size options to see thumbnails of their most recently saved clips at a glance. Customers can also long-press the widget to change the view to include only clips from a single camera, a camera group, or all cameras on the account. Once set up, they can simply tap the thumbnail of interest to quickly take a closer look and watch the recorded footage."

Safety Button Widget

According to Alarm.com: "With the Safety Button widget, customers have the comfort of round-the-clock personal protection with professional response when help is needed most. With the press of a button on their phones’ Home screen, customers can swiftly and silently summon police, fire, or emergency medical assistance from wherever they are in the U.S., day or night. Once activated, they’ll be connected directly to a trained operator who will promptly dispatch responders to their precise location. This feature requires the In-App Safety Button service package add-on."

Alarm Grid is evaluating the In-App Safety Button feature. If we determine it's a good fit for our customers we'll make it available. Once Alarm.com introduces the new widget, our customers will be able to enable this feature. Stay tuned for more information on this potential new feature.

Tags: , , , , , , ,

Comments


Posted By

Resideo has identified an issue with some Total Connect 2.0 passwords. Apple iOS users on firmware version 17.6.1 may be unable to log into the Total Connect 2.0 app due to certain special characters. Passwords containing a plus sign (+) or exclamation point (!) will cause a login failure.

This issue can also affect account usernames. However, since we typically use the customer's email address as the username, it's rare for these special characters to be present. After we reported a customer who suddenly couldn't log into their account, Resideo informed us of this issue. Interestingly, we tested a login using an exclamation point (!) in the password on iOS version 17.6.1, and it worked for us, so the information remains somewhat unclear.

If your password worked before but no longer does after updating your iOS device, or if you're a new TC2 user on iOS and can't log in after creating an acceptable password, the only option is to change your password.

  1. Go to the Total Connect 2.0 login page.
  2. Accept Cookies if prompted. Until you do, you won't be able to successfully perform Step 3 and Step 4 below.
  3. Click "Problems Signing In?"
  4. Click on either "Forgot Username" or "Forgot Password".
  5. Follow the prompts to reset either your username or your password. If you need to reset both, you'll have to first reset one, and then follow these same steps to reset the other credential.
  6. Once you've created both a Username and a Password without a plus symbol (+) you should be able to log in.

As you can see from the password reset screen, both a plus symbol (+) and the exclamation point (!), which we have verified will work, should be acceptable special characters:


HTML browser logins are not affected, nor does the issue affect Android devices. This is strictly an issue with Apple iOS devices, and as far as we know, only with firmware version 17.6.1. An iOS user who does not want to change their username or password can elect to use a browser to access their Total Connect 2.0 account instead.

This issue will likely be resolved, but whether the fix will come from Resideo through a TC2 update or from Apple via an iOS update is uncertain. If we receive any updates, we'll post them at the top of this page, so stay tuned!

Tags: , , , , , , , , , , ,

Comments


Posted By

Update 08/30/24: Resideo posted its final update on this issue today. To summarize, they found an issue with the battery charging scheme in the doorbell's firmware. A firmware update is being applied to future stock and will automatically be rolled out to devices in the field. You can read the full notice here.

Update 08/13/24: Resideo posted an update today regarding this issue. According to the update:

"We have determined that, if the doorbell isn’t installed within 1 year of production, the embedded battery, which is responsible for powering the doorbell while the external chime is activated, will not support a smooth installation."

This is a particularly thorny issue given that the battery in the VX1 Video Doorbell is non-serviceable. After the three (3) to five (5) years of expected battery life, when the battery begins to fail, the entire VX1 must be replaced.

You can read the full updated notice here.

Original Post 08/08/24:Yesterday, Resideo released a Technical Notice about its First Alert VX1 HD Video Doorbell. A small number of units display a red LED for an extended time after installation. If you have a unit displaying this behavior, you can return it to where you purchased it or contact your alarm dealer.

First of all, if you have a First Alert VX1 HD installed and it is working as expected there is nothing you need to do. This issue has been reported in a small number of units and only very recently. If your VX1 HD was affected, you would know almost immediately after installation.

Next, it's important to clarify which LED we're talking about here. The VX1 HD has a Status LED which is located above the doorbell button and microphone. In addition to the Status LED, the doorbell button itself has an LED surrounding it. This notice refers to the small Status LED. According to the Installation Instructions, a solid red Status LED indicates that the battery is not charging.


It's not uncommon, after installation, for the Status LED to show either red or amber. An amber Status LED indicates that the battery is below the normal operating threshold but is charging. However, if, after 90 minutes of charging, the Status LED remains red, and assuming the input power and wiring are confirmed to be good, there is a problem.

Because of this issue, Resideo has chosen to put the First Alert VX1 HD on sales hold. This means that if you attempt to order a new unit from the distributor, it won't be available. Alarm dealers may have stock on their shelves that they can continue to sell, but they run the risk of encountering this issue.

Alarm Grid doesn't keep stock, ensuring that when you order from us, the product you get is the most recently manufactured version possible. Though distributors do keep stock, so there is always a chance that a seldom-ordered product may have been on their shelf for some time.

We will not discontinue the First Alert VX1 HD, as we assume this hold will be brief. You can still order the doorbell on our site. Currently, if you do you'll receive an email that the product is on backorder and that it will be shipped as soon as stock becomes available again.

That's all we know at this point. There is not enough information to determine if this is a problem with the battery, the charging circuit, or if this is just a status indication malfunction. It's unlikely that Resideo manufactures the battery. Is it an issue with the battery vendor? Is it something anomalous that occurred during manufacturing? That's why the product has been put on hold so they can perform testing and diagnostics.

In some cases, the manufacturer may need customers to send them problem units. It's difficult to confirm and fix an issue if you can't reproduce it. If that's the case here, it's possible Resideo may ask your alarm dealer to send returned VX1s directly to them for testing. As an end-user, this won't really affect you. It's just nice to know what goes on behind the scenes sometimes.

Depending on what they find, Resideo may require that any existing distributor stock be returned to manufacturing to be reworked or retrofitted. This is usually accompanied by some type of marking on the box, like a green dot. This will usually be located near the box date code. In this way, everyone will be able to tell that a newly purchased First Alert VX1 HD Video Doorbell does not suffer from this issue.

Tags: , , , , , , , , , , ,

Comments


Posted By

Alarm.com now offers a feature called Alarm Mode. When an alarm occurs on an Alarm.com system the user can access a special Alarm Mode card from the app dashboard. With all relevant alarm-related information grouped together, a user can quickly assess the situation and respond accordingly.

Alarm.com is very proactive in its efforts to innovate and diversify its product offerings. In addition to adding exciting new features that utilize existing hardware and software capabilities, Alarm.com constantly seeks ways to increase user engagement without raising the incidents of unwanted alarm dispatch.

Toward that end, they recently rolled out Alarm Mode. Beginning with version 5.4.1 of the Alarm.com customer app, nearly any system alarm occurring on an Alarm.com panel will trigger Alarm Mode. This feature is a segment or card located in the customer dashboard. When you log into the app and tap on Alarm Mode, you can view all activity related to the alarm.

This can include video clips, a link to live video, video doorbell camera information, and door lock status. What you see will depend on which hardware and features you have, and what's happening at, and just before, the time of the alarm. With all the relevant information in one easy to access location, you can make an informed assessment and either cancel the alarm, or verify that dispatch is necessary.

A full guide to using this feature is available here. There are exceptions to which alarms initiate Alarm Mode so be sure to check out the guide. If you happen to have the In-App Cancel/Verify feature enabled on your account, Alarm Mode makes that feature even easier to use. Once you open the Alarm Mode card within the customer app you'll see the buttons to Cancel or Verify the alarm. You still have two (2) minutes from the time the alarm is reported to choose either option.

When you tap Cancel (holding for three (3) seconds is not required), a disarm is sent to the system and an alarm cancel message is sent to the monitoring station. Because the time to process every alarm varies, it is still possible that you will receive a call from the monitoring station, so be ready to provide your verbal passcode to the operator.

When you tap Verify Alarm the system will continue to display and sound the alarm locally and the monitoring station will receive a signal letting them know that a dispatch is requested. They can then contact the authorities to dispatch and they will likely still call you to gather additional information to provide to the responding authorities.

If two (2) minutes pass and you don't choose either Cancel or Verify, the option will go away and will be replaced with a "Disarm to Clear" button. For users who don't have the In-App Cancel/Verify feature enabled, this button will show up immediately in Alarm Mode and will remain until the alarm is cleared. Tapping this button will send a disarm command to the system to silence the alarm. Once the alarm is cleared, the Alarm Mode card will disappear and the app will revert to the standard dashboard.

What do you think of Alarm Mode? Do you agree that Alarm.com works hard to add value to their product and service offerings? Leave a comment below to start a discussion! We'd love to hear your thoughts.

Tags: , , , , , , , , , ,

Comments


Posted By

The cyber incident on Friday July 19, 2024 was caused by a code error in an update pushed to Windows machines by CrowdStrike. This was not a malicious attack. CrowdStrike Falcon, the specific product impacted, is a cloud-based product with a small local footprint, designed to detect breaches.

CrowdStrike Falcon is a cloud-based protection product. CrowdStrike describes the product this way: "Falcon is the CrowdStrike platform purpose-built to stop breaches via a unified set of cloud-delivered technologies that prevent all types of attacks — including malware and much more."

A small file, termed a sensor, is installed on the computer. This sensor monitors for viruses, malware, zero-day (emerging), and other types of threats. The sensor communicates with CrowdStrike through the cloud, and if a breach is detected, CrowdStrike can then respond. By keeping the bulk of the service in the cloud, the protected computer isn't bogged down with a resource-heavy software package. The sensor file is only about 5 MB.

CrowdStrike recommends that their Falcon customers use an N-2 update cadence, or at least N-1. This means the sensor file software runs either one update (N-1) or two updates (N-2) behind the current version. Ideally, this allows any issue with an update to be found and resolved before it ever reaches a client computer.

The update that caused the Windows Blue Screen of Death (BSOD) and boot-looping issue last Friday wasn't controlled by the N-1 or N-2 policy that is set up on most systems. The update was to the signature files, which help the Falcon Sensor determine what is a threat, and they need to be updated as quickly as possible. For this reason, they aren't covered by the usual update cadence.

The U.S., Canada, the UK, Europe, and Asia experienced disruptions to various services during the outage. While Mac and Linux computers remained unaffected, over 4,000 flights worldwide were canceled. The financial and healthcare sectors were severely impacted, with many elective medical procedures postponed. Numerous payment systems were also unavailable in the early hours of the incident.

There's much more information about this available online if you want to find it. CrowdStrike has been very transparent in dealing with this issue. But what we're discussing is why this issue manifested the communication troubles some of you saw last week. For that, we'll talk about how alarm communicators are supervised.

Generally speaking, when an alarm system has a signal to report, it does so using whatever channel or channels are available to it. This could be through a POTS phone line, a WIFI or Ethernet connection, an LTE or LTEM Cellular connection, or some combination of these paths. The important thing to know is that when an alarm panel sends a signal, it looks for an acknowledgment that the signal was received successfully. If it doesn't receive that acknowledgment, it will send the signal again (and again) until eventually it either reaches the destination, the retransmission limit, or the time limit, depending on the path used.

At the other end of this communication is the Alarm.com or AlarmNet server. This system receives those signals and processes them. This may include forwarding the information to a central station, to an online platform for logging and distribution to the end-user, or both.

Since the system may never have an alarm, there are measures in place to send periodic test messages from the alarm system communicator to the server. This ensures that all aspects of any communication pathways are open and working. This usually involves setting a communication test interval. For cellular communication in particular, it's desirable to minimize unnecessary signals, so this is customarily a "smart" test.

For example, you may set a system for a daily or 24-hour test. This is a setting at both the alarm panel and the signal processing server. That means every 24 hours, the system will send a test message to the server to verify communication. If no test message is received, the server generates a central station message that the system failed to properly test.

With a "smart" test, any signal sent by the system resets the test timer. So, the only time the server will receive an actual test message is if the system hasn't sent any other type of signal for 24 hours. In either case, based on this example, if the signal processing server goes 24 hours without receiving either a regular signal or a test signal, a trouble condition is generated.

From here, we can only assume that the signal processing server or servers were impacted by the CrowdStrike Falcon update. We can safely assume this because Verizon and AT&T LTE cellular communications were not affected by this issue. The way I see it, this incident was a blessing in disguise.

Though this probably seems like a catastrophic event, it's actually an opportunity. Because this was not a malicious attack, the least possible harm has come from it. Those with robust disaster recovery plans got a real-world chance to put them to use. Those without robust disaster recovery plans now know what's at stake and can plan accordingly. Catalysts for change and improvement are rarely painless, and this is no exception.

Tags: , , , , , , , ,

Comments