Slashdot Mirror
The 'World's Worst' Smart Padlock Is Even Worse Than Previously Thought (sophos.com)
Last week, cybersecurity company PenTest Partners managed to unlock TappLock's smart padlock within two seconds. They "found that the actual code and digital authentication methods for the lock were basically nonexistent," reports The Verge. "All someone would need to unlock the lock is its Bluetooth Low Energy MAC address, which the lock itself broadcasts." The company also managed to snap the lock with a pair of 12-inch bolt cutters.
Today, Naked Security reports that it gets much worse: "Tapplock's cloud-based administration tools were as vulnerable as the lock, as Greek security researcher Vangelis Stykas found out very rapidly." From the report: Stykas found that once you'd logged into one Tapplock account, you were effectively authenticated to access anyone else's Tapplock account, as long as you knew their account ID. You could easily sniff out account IDs because Tapplock was too lazy to use HTTPS (secure web connections) for connections back to home base -- but you didn't really need to bother, because account IDs were apparently just incremental IDs anyway, like house numbers on most streets. As a result, Stykas could not only add himself as an authorized user to anyone else's lock, but also read out personal information from that person's account, including the last location (if known) where the Tapplock was opened.
Incredibly, Tapplock's back-end system would not only let him open other people's locks using the official app, but also tell him where to find the locks he could now open! Of course, this gave him an unlocking speed advantage over Pen Test Partners -- by using the official app Stykas needed just 0.8 seconds to open a lock, instead of the sluggish two seconds needed by the lock-cracking app.
Today, Naked Security reports that it gets much worse: "Tapplock's cloud-based administration tools were as vulnerable as the lock, as Greek security researcher Vangelis Stykas found out very rapidly." From the report: Stykas found that once you'd logged into one Tapplock account, you were effectively authenticated to access anyone else's Tapplock account, as long as you knew their account ID. You could easily sniff out account IDs because Tapplock was too lazy to use HTTPS (secure web connections) for connections back to home base -- but you didn't really need to bother, because account IDs were apparently just incremental IDs anyway, like house numbers on most streets. As a result, Stykas could not only add himself as an authorized user to anyone else's lock, but also read out personal information from that person's account, including the last location (if known) where the Tapplock was opened.
Incredibly, Tapplock's back-end system would not only let him open other people's locks using the official app, but also tell him where to find the locks he could now open! Of course, this gave him an unlocking speed advantage over Pen Test Partners -- by using the official app Stykas needed just 0.8 seconds to open a lock, instead of the sluggish two seconds needed by the lock-cracking app.
Oh wait, we don't need to monitor Trump's campaign manager's location, because they locked him up in prison.
He'll be drinking toilet wine with Moscow Donald before long...
wow - sign me up!
nothing to see here - move along
It's almost like hiring people straight out of college for pennies (or getting free interns) for your startup is a bad idea.
Just make it a social networking program. You log in, everybody sees your data. They're already half way to being FaceBook. Social is where it's at. Nobody wants real security. They want companionship. This company could be perfectly positioned to combine a new kind of security with a new kind of social network. They could call it Social Security.
For all intensive purposes, "whom" is no longer a word. That begs the question, "who cares"?
Give me a pat on the back for being 1337 h4x0r
This is a very predictable result of crowdfunding. No need to demonstrate competence or experience in a market since your funders are even more ignorant.
Working to get venture capital serves are real purpose, now we see the result when that is bypassed.
Go search "Lockpicking lawyer" on Youtube. That guy shows how useless locks are, mechanical or digital.
Come on give 'em a break, this company is still learning. Their next product will be SO much more secure!
12 inch HFT bolt cutters $8.99
Trivial BT software unlock $0
Single gun metal Tapplock one $84
Another app knowing your precise location for no reason PRICELESS
Padlocks rarely lock anything of great value. They are usually just there to keep the local kids from playing with your stuff. If breaking into a shed, bolt cutters will usually do but a tire iron is more readily available in most people's trunk and will almost always rip latches or hinges off with no trouble.
People place way too much confidence in locks and doors in general. Glass breaks easily, and I've seen steel doors with fancy locks on wood houses. Most break-ins occur during the day to avoid the night time burglary penalty if caught. Rather than go through the door, a chainsaw or sawzall can cut a hole in the back of the house in a couple of minutes. There is usually even a handy plug if you'd like to use a quieter electric chainsaw but bring your wire detector with you so you know where to cut.
If you accidentally leave your garage open, the wall between the garage and house is usually just wallboard. You can kick your way through or use tools in the garage to go through even more easily. Often there is a handy axe or sledgehammer.
The idea that security measures protect you is a fantasy. They are just a way to take more of your money. We spend many times more more on security than the total take in all robberies. Luckily, most of the threat the media works so hard to convince us of is fantasy too. We live in the safest times in 50 years.
You mean, like wipe the lock with a cloth?
Wow, it sounds like this company has hit upon the trifecta of incompetence ... they're crooks, assholes, and idiots.
Sorry, but this bullshit "me too" endless stream of utterly shit quality products rushed out the door to say "yarg, we have teh bluetooths lock" ... this results in an endless stream of products made by crooks, sold by assholes, and bought by idiots. They're usually not fit for what they claim it is, and they've been so incompetently built there's no fucking point in owning one.
So, as usual, the people who run this company and do the sales are lying sacks of shit who can't help but know their product is inferior. But, they've pushed them out the door for the unsuspecting public to buy.
Honestly, I think that shitty/shady products should have a Yakuza type punishment -- we're going to lop off bits of the CEO as a demonstration that failure will not be tolerated. When the thieving crook of a fucking CEO has no digits or arms left, we throw them off a fucking dock.
The sad thing is, the people who made this? They knew goddamned well they were selling shitty products, they just didn't care.
Fuck all this connected shit. I don't want it, don't care about it, and have no reason to believe you're qualified to make a lock, let alone a connected lock.
Whoever the people are who run this company, they know they're crooks and assholes. They are just hoping to cash in on the hype.
Fuck 'em, kill 'em all.
because it takes a smart person to develop and secure them...
too bad they didn't have one of those.
their product and site security was probably managed by their accountant: "don't fuck around with details, just give me the cheapest and fastest. i've got investors to kiss-up to and i need something yesterday."
What is the company's association with Microsoft? With this type of security, there just has to be.
If there were ever a product that was defective and incapable of working in its intended capacity, this is it.
How rubbish is a justice system if it can't slap the everloving crap out of this company?
---
According to the latest ruleset, this post should be modded as Vorpal Flamebait +5.
When you live in a bubble, you think all your ideas are great. All the echoes tell you so.
From that big, overpopulated, Asian country many we all so love. The customer support capital of the world.
This is just pathetic. While I do not like the idea of requiring an engineering certification for work like this very much, it seems we need it to remove said certification from the utter and complete fuckups that create atrocities like this one.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
HDHomeRun CONNECT/PRIME calls home every 10 minutes uploading a complete list of available channels and device information including internal IP address of HDHomeRun devices.
All data is unencrypted and transmitted entirely in the clear.
SiliconDust operates an API ipv4-api.hdhomerun.com that is in no way secured or CSRF protected. API transmits the response header "Access-Control-Allow-Origin: *" explicitly enabling XMLHttpRequest to be trivially leveraged against owners of HDHomeRun devices by ANY malicious website the owner happens to stumble upon.
Attempting to block HDHomeRun from calling home by blackholing hosts within hdhomerun.com domain results in HDHomeRun switching to Google DNS server 8.8.8.8 BYPASSING ACCESS CONTROL users have explicitly put in place to prevent this behavior. It is necessary to also block access to 8.8.8.8 or block access to every address referenced by ipv4-api.hdhomerun.com in order to stop this behavior in its entirety.
A simple call to http://ipv4-api.hdhomerun.com/... by any web browser on your network provides a JSON formatted list of HDHomeRun devices on your network. The call includes unique device ID and internal URLs within your network that like ipv4-api.hdhomerun.com not only are not CSRF protected they openly invite malicious access to any website you happen to visit via CORS headers explicitly granting global XMLHttpRequest access.
This vulnerability can be trivially leveraged by malicious websites to track you via unique Device ID, gather device AUTHORIZATION CODE, tune to channels, scan channels, transcode, gather data on current shows watched and view system logs all without any protection or authentication of any kind whatsoever.
There was no clickwrap agreement notifying the customer of this behavior or any indication that HDHomeRun would be calling home and doing so in such a ridiculously insecure manner.
To be perfectly clear the problem is NOT the inherent lack of authentication and encryption. Problems are threefold:
1. Calling home without obtaining explicit consent
2. Once consent is obtained transmitting data including unique identifiers in the clear
3. HDHomeRun able to be accessed and data exfiltrated by ANY external website anyone on the users network happens to visit
If you own a HDHomeRun device for your own security and privacy please take the following steps immediately:
- Blackhole DNS access to ipv4-api.hdhomerun.com
- Block access to Google public DNS servers @ 8.8.8.8
Donald Trump's campaign manager is in prison though... lol.
And he's trampolining your mom Hillary there.
Go search "Lockpicking lawyer" on Youtube. That guy shows how useless locks are, mechanical or digital.
if locks are useless then why is it that the vast majority of the world's storekeepers show up every morning to find that their goods have not been stolen in the night?
Clearly you are some sort of stupid automaton, incapable of registering actual reality in your brain
Hillary is taking a walk in the woods while Moscow Donald and his co-conspirators go down for high treason.
Only thing left to say is "but her emails"...
Have gnu, will travel.
No, it is not theft. You are violating their intellectual property.
Just read up on the inherent infeasibility of wireless house alarms...as a thief, either you RF jam them and they don't go off - or you RF jam them and they go off, so you just jam them until they become a nuisance (until the owner disables them - and you even have a way to verify they're off as well, then...).
Look, utility people (i.e. the person installing your alarm...) are the people who scout your houses for robberies - usually passing that information on to others for a bit of cash, so that they can perform the robbery - and that's why nearly all home security systems are inherently vulnerable/insecure, with the person who installed them usually knowing the technical requirements or even codes (e.g. the manufacturing code, which overrides even your normal code...), for disarming them - or even worse, having a monitored alarm system, where the guy at the central monitoring office knows ALL the places whose monitored alarms aren't functioning, and can tip off thieves for a bit of cash.
The goldmine of information in security companies, is the knowledge of who is safest to rob - it's a multi-million industry.
its not a bug, its a feature. they meant this, obviously.
Or is it just impossible to find someone ethical enough to be trusted to make smart locks?
Trump 2020. Your suicide 2020.
Kill yourself. It will fix everything.
2 seconds? Really?
This is typical Engineers not accounting for time correctly.
Like the "I can make an app in a day" - Yeah! Sure! Testing must be non-existent and you didn't account for getting the idea, setting up, etc etc.
Should account for time like you were going to be paid for it.
They are for the amateur, to lock them out long enough that activities are suspicious or even downright impossible for them. I have two U lock on my (rather expansive) lying-bike. They are not there for any Pro wanting to steal my bike which would knack them in 1 to 3 second each. They are there for the kids or adult wanting to have a joy ride on it.
C. Sagan : A demon haunted world:
http://www.amazon.com/gp/product/0345409469/
visit randi.org
Check out how easy the lock is to open with simple force. https://www.youtube.com/watch?...
Moscow Donald will be sentenced to life in prison for high treason well before I kick the bucket.
Just in case, here is the National Suicide Prevention Lifeline
Call 1-800-273-8255
Available 24 hours everyday
as community-based possession-sharing system
The ideas were pretty good, it's the implementation that's the hard bit...
They got money. That idea is great.
This lock will have a bright future for geocaching use.