Slashdot Mirror
The 'World's Worst' Smart Padlock Is Even Worse Than Previously Thought (sophos.com)
Last week, cybersecurity company PenTest Partners managed to unlock TappLock's smart padlock within two seconds. They "found that the actual code and digital authentication methods for the lock were basically nonexistent," reports The Verge. "All someone would need to unlock the lock is its Bluetooth Low Energy MAC address, which the lock itself broadcasts." The company also managed to snap the lock with a pair of 12-inch bolt cutters.
Today, Naked Security reports that it gets much worse: "Tapplock's cloud-based administration tools were as vulnerable as the lock, as Greek security researcher Vangelis Stykas found out very rapidly." From the report: Stykas found that once you'd logged into one Tapplock account, you were effectively authenticated to access anyone else's Tapplock account, as long as you knew their account ID. You could easily sniff out account IDs because Tapplock was too lazy to use HTTPS (secure web connections) for connections back to home base -- but you didn't really need to bother, because account IDs were apparently just incremental IDs anyway, like house numbers on most streets. As a result, Stykas could not only add himself as an authorized user to anyone else's lock, but also read out personal information from that person's account, including the last location (if known) where the Tapplock was opened.
Incredibly, Tapplock's back-end system would not only let him open other people's locks using the official app, but also tell him where to find the locks he could now open! Of course, this gave him an unlocking speed advantage over Pen Test Partners -- by using the official app Stykas needed just 0.8 seconds to open a lock, instead of the sluggish two seconds needed by the lock-cracking app.
Today, Naked Security reports that it gets much worse: "Tapplock's cloud-based administration tools were as vulnerable as the lock, as Greek security researcher Vangelis Stykas found out very rapidly." From the report: Stykas found that once you'd logged into one Tapplock account, you were effectively authenticated to access anyone else's Tapplock account, as long as you knew their account ID. You could easily sniff out account IDs because Tapplock was too lazy to use HTTPS (secure web connections) for connections back to home base -- but you didn't really need to bother, because account IDs were apparently just incremental IDs anyway, like house numbers on most streets. As a result, Stykas could not only add himself as an authorized user to anyone else's lock, but also read out personal information from that person's account, including the last location (if known) where the Tapplock was opened.
Incredibly, Tapplock's back-end system would not only let him open other people's locks using the official app, but also tell him where to find the locks he could now open! Of course, this gave him an unlocking speed advantage over Pen Test Partners -- by using the official app Stykas needed just 0.8 seconds to open a lock, instead of the sluggish two seconds needed by the lock-cracking app.
This is a very predictable result of crowdfunding. No need to demonstrate competence or experience in a market since your funders are even more ignorant.
For what it's worth: one may regard that as a *feature* of crowdfunding. To tread new ground where no established company would have gone because established company 'knows' it wouldn't work (note the quotation marks). Or for whatever reason chose not to go there.
Sure that will produce lemons at times. Letting backers' money go to waste. But it can also produce surprises. Products that nobody thought possible. Or things that were possible, but deemed impractical or having no chance in the market.
Nobody said that backers shouldn't do their homework.
It's worse than that - the guy on this youtube video opens it with an adhesive gopro mount and a screwdriver.
Yeah, that is exactly how it works. An actual VC will have the money to hire an expert to review a company's product before investing.
Otherwise they would just be throwing money away at someone with a good marketing video... .which is exactly what kickstarter is.
I'm a good cook. I'm a fantastic eater. - Steven Brust
I sort of agree, but as someone who owns a 95 pound pit-dane mix I think it's more complicated than that.
When we have a new person who will be in our house a lot, we have them give the dog a treat (including issuing the 'wait' command and then the release command to take the food) so that the dog sees them as being 'OK' and a food supplier.
That being said, a few of these people have a background fear of the dog due to his size and dominant personality and the dog simply doesn't let them be, he continues to challenge them. I think its because he senses their fear and it makes him skeptical of them.
When we've had unexpected people over (door-door types, etc) the dog is NUTS. Quite often the shadier the visitor, the MORE the dog is nuts. Call me crazy, but I think dogs can SMELL motivation/aggression. I think it's part of why cops have such trouble with dogs -- they simply project aggression and hostility and dogs react to that.
I think if someone broke into my house, it would take more than a handful of treats. I think the dog would be in full-on dominance mode and 95 pounds of dog is fucking scary no matter how bad-ass you are and most humans are going to have a fear response to that. Unless you can somehow overcome this and project a submission to the dog, at least at our house you're gonna have a bad time.
Maybe some kind of dog expert would defuse the situation easily, but your random hood thief isn't that. Shooting a dog will kind of work, but there's plenty of evidence that dogs don't fall over and die from wounding shots, they keep going until they can't. My neighbor is a cop and he says he has seen guys empty 9 mm pistols into dogs with limited effect. Part of it is an agitated dog is a tough target and results in superficial wounds, but part of it is that cornered animals don't quit. Plus if you are looking to steal laptops/tablets/jewlry and get in-and-out, you're not blazing away with a handgun at a dog.