OpenHAB and 2Gig Control Panel

That makes sense. The device does have what looks to be a jtag interface, but the references on the web point to it for updating the firmware.
A quick search on google doesn’t have much to offer ether, any sites you’d recommend before I get started?

Thanks!

Well I’m going full geek on this. Running ESX on a latitude laptop that lost its monitor. I purchased a usb3 card for it which i am using as a passthrough pci device to my vm. I’m also running a dyi cctv dvr on the same vm which connects via usb dongle to several BNC security cams. I’m about half way done putting the hardware together and working out the bugs I’ve inflicted on myself. I’ll post more when i reach another milestone. I hope to start playing with that 2gig panel after the hardware is running smoothly.

I’ve been doing some research on this, and noticed google picked up this thread when searching for OpenHAB and 2GIG panels, so I’ll try to post relevant info to that search.
I may be able to get into my Vivint Sky Panel (v-mp2-345) via SSH vulnerability posted HERE:

In case that thread disappears here are the relevant bits:

…This exploit applies to the Vivint SKY control panel

Quote Originally Posted by Anonymous
"There’s a port that is serving a maintenance website with no credentials. You can turn on SSH from there. Also on that page you can get the root password from the source html. Then you can SSH to the system as root, and you’ve got full access to the OS.

I exfilled the whole filesystem and have been poking through it - looks like all the useful information is in a few sqlite tables, it’s possible to do, well, just about everything from this access, as you could imagine…"

I’v got most stuff working via my zwave stick but my ultmate goal is to figure out how to get root on the 2GIG (or Vivint) paneI and find a way to tie it into OpenHAB. I have a full time Job and family so progress is slow. It may be a month before I post again, but if anyone has tidbits please feel free to add them to this thread.

Ok final update for the Vivint Sky Control Panel for this thread. Ill post another for the 2GIG after I poke around on it. I’ll also start a new thread for all of the Vivint and 2GIG equipment that I’ve taken over and moved to my OpehHAB box.

The Vivint Control panel I’m convinced would integrate into OpenHAB quite well but for one final hurtle. Maybe someone can take it from here and share.

  1. To get into my Vivint Sky Panel I had to reset using this thread: http://www.2gigforum.com/threads/99-Sky-Panel?p=1319&viewfull=1#post1319
  2. Then you can log in with the default installer code 2203 and migrate to the installer toolbox, network settings, advanced. Then toggle on “use ethernet port for troubleshooting”
  3. then you can use a free portscan utility to find the open ports, the highest one I found is running a https maintenance website that is protected by a login. (Good luck)

If this post is to be believed (first part of the post): http://www.2gigforum.com/threads/129-Alert!!!-Vivint-Honeywell-2GIG-ADT-panels-hacked-compromised?p=288#post288
Then that portal probably didn’t have a password on some older version of the firmware, but allowed you to enable ssh and thus start really trying to integrate into external systems like OpenHAB.

My 2GIG Panel does not have a network interface and is too old to use the one from the Vivint panel… However I expect it to play nicer once I find a way to interface… updates to come.

I forgot to mention that I was able to connect the panel as a secondary controller, but several sensors were non-zwave and so would not be shared. I did not experiment further.

I’m very very interested in what you discover here. I purchased this house with a 2gig alarm system installed and would LOVE to have OH send me notifications and avoid a monitoring fee.

If it helps at all I’ve got PDF copies of the Quick Program and User Guides.

Hi Keith, so this is what i have figured out so far for integration. Both my 2gig and vivant control panels have 1 or 2 alarm out contacts on the back of the panel. You should be able to connect those to a openhab sensor without too much problems. Unfortunately I still don’t know how to get detailed info from the panel. Maybe you could play around with the rules on your 2gig to produce different alarm patterns?
If you get anywhere with it post your results here. Email me if you get stuck, I’ll dig my 2gig back out and and see what it can do.

Interesting read so far completely over my head, but maybe after i read everything a couple hundred time, I’ll understand more.

I got sucked into a 5 year contract with vivint, which expires in 2020 because i didn’t want to mess around with setting up stuff myself, and the pay as you go for the equipment was the ONLY way i could get a decent system installed.

I currently have:
doorbell camera
old style ip camera with ethernet port should be easier to setup
1 motion sensor
an element thermostat
several open/close sensors (3 windows and two doors)
Smoke dectector/heat sensor/flood sensor
C02 dectector
a crapton of z-wave devices that i added myself

right now, i’ve read an article about using an RF sensor to decode the door/window sensors. And I imagine you could do the same thing with the motion dectector. It makes me wonder if you could use a broadlink to pick up the RF signals, which would be nice, because the remote i use to control my portable air condition is radio frequency and it would be nice to connect that to OH

The thing that really stumped me was the Vivint doorbell camera, i read you’re initial post but am a little confused about exactly how to convert to my own wifi settings you mention something about using automatic pairing but i can’t find that specific post

I’m glad i found this post tho

Honestly, i would be happy if there was a way to use the cameras, sensors etc by using some sort of gateway using my login credentials.

Vivint does have an option for no monitoring…

I couldn’t agree more. Setting up the RF devices is just a bit more work than I want to invest, (until something happens that makes it a higher priority.) I posted some instructions on paring the doorbell here: (Scroll down a ways.)

thanks. Turns out the thermostat is z-wave so that’s one more thing at least…

I did find the ip address of the door camera, so I may try to see if I can ‘hack’ into it before re-pairing

A lot of the Vivint security sensors (door/window, smoke, motion) broadcast unencrypted at 345 MHz. For less than $30 you can get a USB software defined radio and use some software like: https://github.com/mcolyer/Honeywell5800/network/members to read the state of the sensors. There is an MQTT project that you can use to quickly integrate with OpenHAB.

Here is where you can buy the software defined radio: https://www.amazon.com/dp/B011HVUEME/ref=as_li_ss_tl?ie=UTF8&linkCode=sl1&tag=rsv0f-20&linkId=983e9b382e58ce311dbc03b00457d4c1

Hi Luke,

Have you been able to access the installer toolbox with their latest firmware? 3.10.16.25207.

From my understanding the installer toolbox can only be activated remotely through their support center.

I don’t think doing a hard reset on mine would revert the firmware. My contract ended and they basically de-activated my panel. I had to remove the cellular module and hard reboot it to get it back up.

Hi Luke, it has been about 3 years since you were posting here so hopefully you will get this. Were you ever able to gain root control of your Vivint Skypanel? We have been on month to month payments with ours since we moved a year ago. I took our old system with us and I have not got it fully set back up in the new house. There are several enhancements I would like to add if possible and any help would be appreciated.

Thanks.

Joe McElprang

joseph.mcelprang@gmail.com

Thanks for posting, I actually started replacing most of the vivent gear with more open hardware a while ago. I found that almost all equipment is relatively cheap these days and less hassle than hacking when its made to integrate into various 3rd party hubs. The only piece of hardware i still need to reverse engineer are the inexpensive cameras.

Well I guess it is time to open the Kimono. Over the last 9 months or so I have managed to take over the security panel.

When I bought this house a year ago in July (2018) it had a Vivint system installed. I looked into taking over the contract and they told me I had to upgrade to a new panel for $640. At the time the cable guy was here and said he had a system installed recently and it had the same panel that I had. I dropped the subject and moved on to the thousand other things one has to do when they move. Later I called Vivint again and this time I was told that for a $100 charge I could assume the contract. I said, “Wait a minute, you want me to pay $100 for the right to pay you $50/month? I don’t think so ! You should be giving me free months”.

So, come last January, after reviewing the outstanding work by dengland (https://denglend.github.io/decode345/) on his Honeywell sensor, I decided to take on the Vivint system.

It consisted of:
4 door sensors,
5 window sensors,
2 smoke/heat sensors,
2 co sensors but these are expired so I am looking for substitutes.
1 glass break sensor,
1 Thermostat
1 Door lock.

Currently I have a security HABpanel setup that shows me the state of all the sensors and if I enable email and/or text, if any sensor indicates “Open” or “Fire/Heat” or “Glass Break”, I get an email and my phone gets a text message.

I don’t know where to go from here. This was my first project using:
Raspberry Pi,
Linux,
SDR,
GRC,
z-wave,
C programming,
mqtt,
And do doubt a few more firsts that I can’t remember.

Needless to say the route that I took to get here is full of so many fits and starts and two steps forward, 1.9 steps back. To keep track I “scrawled” my notes into a Word document. It is about 7 pages long and I don’t remember what many of the items are for. And then there are all these “auxiliary” tools I created. What do I do with them? For example I built an Excel spreadsheet to help recognize the messages I was detecting and try to match them to previous messages and devices.

I don’t know what to do with this information. Github I guess. But github is another thing I know nothing about.

What do I do?
Pete Calinski

I have now placed my project in a repository on GitHub

It is titled:

DACSS = Duplicate A Commercial Security System

I can’t seem to find it anymore. Do you still have it up? I’m trying to hack my Ping cameras.

I can get to it at this:

1 Like

Thanks!