Slashdot Mirror
75 Percent of Bluetooth Smart Locks Can Be Hacked (tomsguide.com)
It turns out, the majority of Bluetooth smart locks you see on the market can easily be hacked and opened by unauthorized users. The news comes from DEF CON hacker conference in Las Vegas, where security researchers revealed the vulnerability, adding that concerned OEMs are doing little to nothing to patch the hole. Tom's Guide reports: Researcher Anthony Rose, an electrical engineer, said that of 16 Bluetooth smart locks he and fellow researcher Ben Ramsey had tested, 12 locks opened when wirelessly attacked. The locks -- including models made by Quicklock, iBlulock, Plantraco, Ceomate, Elecycle, Vians, Okidokey and Mesh Motion -- had security vulnerabilities that ranged from ridiculously easy to moderately difficult to exploit. "We figured we'd find vulnerabilities in Bluetooth Low Energy locks, then contact the vendors. It turned out that the vendors actually don't care," Rose said. "We contacted 12 vendors. Only one responded, and they said, 'We know it's a problem, but we're not gonna fix it.'" The problems didn't lie with the Bluetooth Low Energy protocol itself, Rose said, but in the way the locks implemented Bluetooth communications, or with a lock's companion smartphone app. Four locks, for example, transmitted their user passwords in plaintext to smartphones, making it easy for anyone with a $100 Bluetooth sniffer to pluck the passwords out of thin air.
More like 100%. 75% just had easily exploitable attacks.
I go by the notion that locks are for honest people and things like smartlocks and connected locks are primarily for the convenience of the owner. Realistically, for most consumer applications of locks, if someone wanted to get in, the lock isn't keeping them out. So while I'm disappointed at the overall non-concern for real security by the manufacturers, I'm not incredibly surprised and I'd be really surprised, outside of a handful of specific targetted cases, that any real thief would even bother with hacking a lock.
"had security vulnerabilities that ranged from ridiculously easy to moderately difficult to exploit."
and
"We contacted 12 vendors. Only one responded, and they said, 'We know it's a problem, but we're not gonna fix it.'"
Soooo... pretty much the same standard as most consumer (non-smart) locks? I agree that it's pretty pathetic, but given that most locks are susceptible to a "bump key" and that even some supposedly secure safes can be easily opened with a magnet, the locks are mostly about keeping honest people honest, and do little to deter thieves.
For the price of smart locks though, perhaps one should expect a slightly better attitude regarding security. General for $100-200 you can get a fairly decent door-lock in the non-smart variety.
We all know most people only have 2-3 passwords, which get used for the dozens of times a password is needed. If I sniffed a password I wouldn't bother with the lock, I'd start seeing what else used that same password.
I go by the notion that locks are for honest people and things like smartlocks and connected locks are primarily for the convenience of the owner. Realistically, for most consumer applications of locks, if someone wanted to get in, the lock isn't keeping them out.
That's true but there is no point in making it easier than necessary for a lock to get picked. At least with the deadbolt on my door someone would either have to A) smash the door which tends to leave evidence or B) pick the lock which (should) take non-trivial amounts of time. You are quite correct that locks are generally more for keeping honest people honest than to keep out determined criminals but that doesn't excuse making a shoddy, easily bypassed product.
75% sound more secure than pin tumbler lock to me.
If you can not hack my lock you can always break my window or force a door open.
I am not willing to pay or put up with the inconvenience of perfect physical security for my home.
I agree that this is a clear vulnerability... but seriously: if a single lock is the only thing separating an intruder and your valuables, bluetooth isn't going to save you anymore than a standard tumbler lock.
If anything, the data spillage on the password is the biggest problem (given people's propensity to recycle passwords). NOW the *ahem* "hacker" probably has a good guess on the login to your computer, wifi, bank account, etc. To prevent this human performance error, they should probably ditch the password in preference to some other key salted from a sensor on the device itself. That way, it's set once, provides a key to input to your mobile devices, and then be changed whenever you find out your spouse is cheating on you.
In deference to the XKCD, though, said spouse would probably kick the door down... so better make sure there's a backup plan!
Mod me down, I shall become more off-topic than you could possibly imagine.
There's an increasing number of security-related Slashdot stories. While not necessarily a bad thing, perhaps an easier way should be provided to browse non-security-related stories when one wants to. Suggestions welcome.
Security certainly is a growing problem, I don't dispute that, but reading too many gets depressing.
A preliminary suggestion is to adjust the top "Categories" to have checkmarks. Your preferred (default) checkmarks would be stored with your user profile, along with a link next to the category menu to change preferences (to avoid hunting around in menu trees).
Draft categories:
* Hardware
* Security
* Development
* Open Source
* Non-IT STEM
* Politics
* Social Media / Entertainment
* Other
One would uncheck categories they don't want included.
Many stories will fall into multiple categories, which could make things tricky. There are of course UI's for fancier filtering, but that may be overkill. Maybe color coding of some kind?
Table-ized A.I.
Four locks, for example, transmitted their user passwords in plaintext to smartphones, making it easy for anyone with a $100 Bluetooth sniffer to pluck the passwords out of thin air.
Right
I wonder, does this attitude have any effect on sales? To explicitly state this publicly must mean they are very confident that it doesn't.
“He’s not deformed, he’s just drunk!”
Only 75%
Omg. It's almost as if their interest ends at getting your money. Who'd have thunk?
Requiem for the American Dream
That's because the default pin for 75% of Bluetooth locks is either 0000 or 1234.
Most house deadbolts take about 1 second to covertly open:
https://www.youtube.com/watch?v=iaBIvKzBCxI
Hopefully you bought a replacement for the junk the builder installed.
I have purchansed a domain from namecheap and also brought hosting from bluehost...My site url is : http://www.myespressoinfo.com.
now my question is will my site be hacked by others because i have not buy domain name from same hosting company.
thank you
Master Lock's Bluetooth padlock has a body that's just straight up pot metal and won't stand up to a decent smack. https://www.youtube.com/watch?...
Most locks can be opened in 5 seconds with a 'bump key'.
Even the best locks can easily be defeated by a sledge hammer.
The real advantage of most locks is that it TELLS you when they have been attacked. A good Bluetooth lock should keep an easily accessible record of how many times and when it was opened.
But yes, this should be fixed. Even simple encryption is better than plain text password transmission.
excitingthingstodo.blogspot.com
Sjbe, I was sorely disappointed to discover how NOT NON trivial it is to pick most commercial locks (meaning, of course, that it IS trivial.) - after watching a 25 minute DVD and practicing for less than 15 minutes (meaning my total investment in this skill is less than one hour), I myself am able to do it in less than 20 seconds. I can only imagine that for an actual thief with experience, that the time is less than 5 seconds. -- That seems pretty trivial to me. That's why I have a mechanical, electrical and biological system of overlapping security systems now.
___ I don't respond to Anonymous Cowards, and I Never Mod them UP.
I am not willing to pay or put up with the inconvenience of perfect physical security for my home.
The thing is, perfect smart lock (I mean, at least perfect on the software side) are technically possible.
There are modern cryptographic method that could work very well in this situation.
The smartlock makers where simply too lazy to even try it.
And that's sad.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Masterlock Bluetooth lock opens after three to four blows with a hammer
75% today, but it'll be 100% in a few weeks or maybe a few months.
Just cruising through this digital world at 33 1/3 rpm...
I think you are still more at risk from the low tech methods of getting past locks, but the "fuck you, we don't care" additude these companies are showing is very alarming.
75% of dumb locks can be hacked too, with a lock pick.
does anyone else think all the "smart" devices are really just stupid ways of solving a previously solved problem?
Anons need not reply. Questions end with a question mark.
Rather than some cheap bluetooth lock that someone is just going to pry open with a WIFI-enabled jackhammer eventually, I would propose the use of wild attack dogs to secure the contents of your house. Look for something a bit like the ones they used to take down that JFK double that no one had any further use for...
Shocked that the "hackers" can only break 75 percent.
They must be n00bZ
-- Tigger warning: This post may contain tiggers! --
Not all Kwikset but apparently the new ones that you can re-key yourself. He said the tool that's supposed to let locksmiths pick them won't even work. Locked myself out one day and discovered that my only option was basically going to be to drill through it.
Made me both happy and sad at the same time....
"Don't teach a man to fish, feed yourself. He's a grown man. Fishing's not that hard." - Ron Swanson
Whew! August lock wasn't on the list. But I always knew there was probably a way to hack them when I installed in on my front door. The thing is...if someone really wanted to break into my house, they could just break the window and then just reach in an unlock the deadbolt by hand anyway. With all of my large windows on the front of my house, short of barring my windows or replacing them with "unbreakable" glass there isn't a whole lot I could do to stop someone who was really intent on breaking in. So I just take comfort that I live in a nice neighborhood. The biggest security feature of my house is that I live up a steep hill from downtown on a low trafficked, but well lit street.
If they used LUDDITE locks instead of APPY locks, then those APPY hackers wouldn't have been able to hack the LUDDITE locks
Luddite!
It sounds too inconvenient for most people. One more lock, and it will be faster to break in than use to keys.
Not that reporting insecurities in Bluetooth implementations isn't important, but the reality is someone is far more likely to kick your door open or manipulate your mechanical lock than they are to go to the trouble of sniffing your short range BTLE traffic to find a way to electronically open your lock.
mosty physical locks are also pickable — with a pick and a tension bar — at 25% — the electronic locks might be less pickable than their physical counterparts.. :-p
Honestly... who cares, really. Smart locks aren't about security, they are about convenience. The fact that most residential mechanical locks can be picked in mere seconds by a skilled lock smith with cheap tools should be more concerning. A hacker will need specialized software to hack bluetooth locks, greatly reducing the likelihood of a bad-dooer doing something to your house.
Further, locks don't stop dishonest people from doing dishonest things. You could kick down a door faster than you can pick the lock or bluetooth hack it. Its just a hell of a lot noisier. Locks stop honest people from trying to be dishonest people.
Lock picking is actually a bit rare. Most B&E's are smash and grab operations. The lock is forced and the criminal doesn't care about the damage. The whole dynamic of a B&E is to get in, grab some stuff and get out fast. The criminal is exquisitely sensitive to the amount of time they are in the home. Also, lock picking strands you on the wrong side of the door, exposed to the neighborhood doing something suspicious. This is all bad news for the criminal, really bad news.
So fix the plaintext passwords and all that BS, just understand that you are fixing a secondary problem.
Wasn't this understood about bluetooth from the start? That it was not and never supposed to be secure? It became the defacto short range tool because it was handy, not secure.
And it would have nearly cost them as much to only obtain the *electro-mecanical* guts from Chinese (i.e.: physical lock + motors + power stage),
hire some cryptography master student for an internship to write actually competent security code,
and flash and solder some ATMega or other pico controller themselves.
It would be both way much more secure.
And they could proudly write some "assembled in USA" sticker on the box, knowing that they keep some jobs inland (the master student writing the picocontroller code and the assembly line that assembles the chinese electromecanical part and the picocontroller).
It would cost a little bit more, but they have good marketing arguments to make up for it (security and keeping jobs).
Still, they didn't do it. They went instead for the cheap lazy shitty route.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
You want the Nordic nRF51-DK, a devboard which, when loaded with some free Nordic-provided firmware, is a most excellent BLE sniffer ("nRF-Sniffer") - plugs into Wireshark. You can probably lash one together for less than $39 (it's just an NRF51822 and a USB-UART) but this board is quite tasty.
Anyway, $39 online. Highly recommended, I use it all the time.
https://www.nordicsemi.com/eng/Products/nRF51-DK
[FrLz]
Remember the annual World Wide Wardrives from years back? You know... where 10s of thousands of people would wardrive for wi-fi (and upload aggregate results to a central repository) in the name of bringing awareness to crappy wifi security to the world (and, by default, the router & modem manufacturers)? That's what gave the big push for the (basic) security we now have in our home systems. I suggest something similar for these locks; otherwise, the manufacturers will have no reason (shame) to change.
~dos4who