DAS Hills Comnav

[zforum69]

Hi all,

I used to pay for my alarm to be monitored (in my case the provider user used a Permaconn 4G for the communications) but had since cancelled that service which is why I purchased a ComNav earlier this year. After using the ComNav I still wanted to try and get the same equivalent service I had with the monitoring service, butwithout having to pay for it. After a bit of work I managed to do that and will describe it in this post. At the same time I will also consolidate all the great info I found from this thread along with other info I have found from other places, to save people from having to read all those posts going back 10years!!!

Security Vulnerability
First thing to be aware of is that older versions of ComNav has security vulnerabilities. Information can be found at CISA:. Information from the manufacturer, Carrier Global Corporation, can be found in their website:

To resolve the vulnerability you need to be at version 4000-12 or later. As I bought mine this year my ComNav was at version 4000-16 (A55P004000-16). Not sure if you can get the firmware upgraded, I've seen bits of information indicating certain upgrades cannot be done remotely, so I assume it would still be possible doing it with a directly connect PC.

Need to be in program mode
With the latest firmware that addressed the security vulnerabilities you must always be in program mode to browse to the ComNav to configure it. That is feature 19, segment 6 has no effect.

Notification via the app
The ComNav allows you to enter three different email addresses to send alerts. In order to be alerted via the app (Ultrasync+) you need to configure one of those email addresses to the one defined in the app. You can find that email address in the app where you configure the settings for your ComNav. Amongst other settings like serial number, passcode etc, there is one for Notification Services. When you enable that feature there will be an odd looking email address under "Push Notifications" like phone@uUs.n. That is the email address you need to use if you want app notifications.

Voice or SMS reporting
The ComNav is able report alerts via voice or SMS, noting SMS requires access to an SMS gateway. The issue is that it does this via the telephone line. Fewer and fewer people use a fixed telephone line. Alarm panels used to call their monitoring station via the telephone line, but since NBN and its use of VoIP, alarm panels use of telephone lines has at best been problematic, which is why things line the Permaconn are used. The voice or SMS reporting might actually work, but many no longer have a fixed telephone line. I still have a fixed phone line on VoIP but all the handsets are cordless and the base station has an Ethernet connection, that is I don’t have anything where I can plug in an analogue telephony device. Furthermore, I have have used the one cable run to connect the ComNav Ethernet port.

Instead you can use a voice or SMS gateway service that can receive an email, which will then convert that email and send it to you as an SMS or voice call. I have used a few SMS gateways but for the ComNav I use ClickSend because it supports both voice and SMS (and has a great API, see description further down). Currently it costs $0.07 for an SMS or $0.15 for a voice call. When you signup you get some free credit to try it out ($2 I think). Minimum top up is $20.

This type of service does not have very strong authentication. Basically in your ClickSend account you configure which email addresses you will be sending from. I actually send ComNav email reports to myself first and then resend it to ClickSend with a new From: email address, so that ClickSend processes a unique email address rather than the generic do-not-reply@message-report.com. If you don't do this then anybody can configure their ComNav to send to ClickSend and make you pay for it. In fact you don't even need a ComNav as you can spoof any email address including do-not-reply@message-report.com.

You will have to look into your email provider if you want to do the same as me. On some basic providers it may not even be possible.

Emulating an alarm monitoring service
What I described above should be achievable by most people, but as I mentioned earlier I wanted to replace my monitoring service. My monitoring service would keep trying to call me or other numbers until somebody has acknowledged the report. If I received an alert relating to my ComNav I could easily miss/ignore it, especially with all the other messages trying to get my attention. What I needed was for the ComNav to keep trying to call me until I acknowledge the call.

I originally tried looking at using various no-code automation platforms like IFTTT, Zapier and Make, but all had restrictions on what can be done on theIR free tier and ultimately could not do what I needed to do. The only one that had a small chance of doing it might have been Make, but I needed to spend more time on it.

A colleague mentioned to me that Gmail had a powerful scripting capabilities. I had no idea free Gmail had this capability. The whole Google ecosystem has a development environment called Apps Script that can be used on any of the Google assets, including Gmail. It is surprisingly powerful with its own IDE, uses Javascript, and best of all it is all free. Using Apps Script I was able to do everything I needed, but please remember it does require an ability to write code.

Using Gmail with Apps Script I was able to make API calls to ClickSend. ClickSend's API is quite extensive, easily better than any other gateway provider I have used. It does not cost anything extra to use it, you just pay for the SMS or voice call costs. Essentially, I programmed Gmail to recognise an alarm report from ComNaso that when it receives the alarm report it gets ClickSend to try to make 5 phone calls to me, each 2 minutes apart (or any number of calls with any wait period I wanted). If I answered the call I could acknowledge that I heard it by pressing a key on phone. If I pressed a key ClickSend would stop trying to call. Furthermore I also did this via SMS. When Gmail received an alarm report it also got ClickSend to send me 5 SMS messages each 2 minutes apart. I could acknowledge I saw the message by sending a reply like "Y", which will then tell ClickSend to stop trying. If ClickSend received an acknowledgement from either the phone or reply SMS, it would stop trying on both.

Phone line reliability
When I had my alarm monitored, also installed a mobile GSM module as a backup path for the alarm panel. I didn't wanted my alarm monitoring communications to be dependent on the telephone line which can easily be defeated as the phone line is necessarily easily located from the outside which can then be cut. With the 2G shutdown and NBN, it was later changed to a Permaconn device.

My Internet service at home is FTTN, so it uses the old copper phone line but it can survive a phone line being cut. I use a modem that has a 4G SIM as a backup. I bought a Telstra Smart Gateway 2, and hacked it. You can buy these from various marketplaces for around $30 as many people are trying to offload them. I only use the modem in bridging mode as it is one of the best modems for line synch. The modem is then connected to my pfSense firewall and the rest of my network. I hacked the modem to allow me to use the 4G when needed and to also keep the 4G connection up all the time. The modem in its normal state activates 4G only when it detects a line failure, which introduces several minutes delay before Internet communications is restored. My pfSense firewall will use the 4G path when it sees the FTTN connection is not working, it looks out for packet loss or high latency. I tested it in a worst case scenario when the FTTN connection has just died followed immediately by an alarm event. I still received the alarm notification within a minute.

To do this will require some networking expertise. There is a massive thread on Whirlpool all about hacking this modem. Note, you don’t have to be with Telstra to use this modem. I am not and furthermore the 4G sim still works. I think it only gets disabled if you start to use it a your primary connection. At ~$30 each I bought a second one as a spare.

Final comments
It was reasonably easy to get a prototype working (voice only at the time). Most of my time was spent trying to learn Javascipt, last time I did any coding in anger was 30 years ago using Pascal, so had to get the hang of the new programming world like object oriented programing, no need for explicit type declarations etc. After getting the prototype working I then did other improvements. There was a bit more work to address cases like receiving multiple alarm reports etc. There was also a bit more work to accommodate some restrictions on Apps Script like 6min execution time on the free tier. For example 5 calls, 2minutes apart could run out of execution time. Of course expanding it to support SMS ... and so forth.

Using this I have effectively replaced the primary function of a monitoring service and the only costs that are incurred are the costs of the SMS messages or voice messages ... just need some coding skills.

Z