Slashdot Mirror
The 'World's Worst' Smart Padlock Is Even Worse Than Previously Thought (sophos.com)
Last week, cybersecurity company PenTest Partners managed to unlock TappLock's smart padlock within two seconds. They "found that the actual code and digital authentication methods for the lock were basically nonexistent," reports The Verge. "All someone would need to unlock the lock is its Bluetooth Low Energy MAC address, which the lock itself broadcasts." The company also managed to snap the lock with a pair of 12-inch bolt cutters.
Today, Naked Security reports that it gets much worse: "Tapplock's cloud-based administration tools were as vulnerable as the lock, as Greek security researcher Vangelis Stykas found out very rapidly." From the report: Stykas found that once you'd logged into one Tapplock account, you were effectively authenticated to access anyone else's Tapplock account, as long as you knew their account ID. You could easily sniff out account IDs because Tapplock was too lazy to use HTTPS (secure web connections) for connections back to home base -- but you didn't really need to bother, because account IDs were apparently just incremental IDs anyway, like house numbers on most streets. As a result, Stykas could not only add himself as an authorized user to anyone else's lock, but also read out personal information from that person's account, including the last location (if known) where the Tapplock was opened.
Incredibly, Tapplock's back-end system would not only let him open other people's locks using the official app, but also tell him where to find the locks he could now open! Of course, this gave him an unlocking speed advantage over Pen Test Partners -- by using the official app Stykas needed just 0.8 seconds to open a lock, instead of the sluggish two seconds needed by the lock-cracking app.
Today, Naked Security reports that it gets much worse: "Tapplock's cloud-based administration tools were as vulnerable as the lock, as Greek security researcher Vangelis Stykas found out very rapidly." From the report: Stykas found that once you'd logged into one Tapplock account, you were effectively authenticated to access anyone else's Tapplock account, as long as you knew their account ID. You could easily sniff out account IDs because Tapplock was too lazy to use HTTPS (secure web connections) for connections back to home base -- but you didn't really need to bother, because account IDs were apparently just incremental IDs anyway, like house numbers on most streets. As a result, Stykas could not only add himself as an authorized user to anyone else's lock, but also read out personal information from that person's account, including the last location (if known) where the Tapplock was opened.
Incredibly, Tapplock's back-end system would not only let him open other people's locks using the official app, but also tell him where to find the locks he could now open! Of course, this gave him an unlocking speed advantage over Pen Test Partners -- by using the official app Stykas needed just 0.8 seconds to open a lock, instead of the sluggish two seconds needed by the lock-cracking app.
wow - sign me up!
nothing to see here - move along
It's almost like hiring people straight out of college for pennies (or getting free interns) for your startup is a bad idea.
Just make it a social networking program. You log in, everybody sees your data. They're already half way to being FaceBook. Social is where it's at. Nobody wants real security. They want companionship. This company could be perfectly positioned to combine a new kind of security with a new kind of social network. They could call it Social Security.
For all intensive purposes, "whom" is no longer a word. That begs the question, "who cares"?
This is a very predictable result of crowdfunding. No need to demonstrate competence or experience in a market since your funders are even more ignorant.
Working to get venture capital serves are real purpose, now we see the result when that is bypassed.
Go search "Lockpicking lawyer" on Youtube. That guy shows how useless locks are, mechanical or digital.
Come on give 'em a break, this company is still learning. Their next product will be SO much more secure!
There is usually even a handy plug if you'd like to use a quieter electric chainsaw but bring your wire detector with you so you know where to cut.
Wires are usually ran a foot or so above the floor (less waste for connecting to outlets), just make sure you're not cutting near conjoining walls, or next to doors.
So your house is completely unlocked and has no doors or windows?
Yes, a determined criminal can break into virtually any house, but it’s well proven that most will avoid breaking into houses that even have something as simple as a home security sign in front (even if fake) since it’s not worth the chance of being caught versus a house that looks completely unguarded.
If there were ever a product that was defective and incapable of working in its intended capacity, this is it.
How rubbish is a justice system if it can't slap the everloving crap out of this company?
---
According to the latest ruleset, this post should be modded as Vorpal Flamebait +5.
I was confused by that as well. While some might be more vulnerable than others, all locks are vulnerable to bolt cutters. So is 12 inches supposed to indicate that it is on the more vulnerable end of the spectrum, or the less vulnerable end?
When you live in a bubble, you think all your ideas are great. All the echoes tell you so.
This is just pathetic. While I do not like the idea of requiring an engineering certification for work like this very much, it seems we need it to remove said certification from the utter and complete fuckups that create atrocities like this one.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
In my house, most of the wires run from the roof space down the studs to the outlets or switches. Very few wires run laterally.
The real "Libtards" are the Libertarians!
That's an unfair blow, Microsoft greatly improved their security so that it's up to "average" now. (Either that, everyone else got more sucky, can't tell.)
Table-ized A.I.
It's worse than that - the guy on this youtube video opens it with an adhesive gopro mount and a screwdriver.
Go search "Lockpicking lawyer" on Youtube. That guy shows how useless locks are, mechanical or digital.
if locks are useless then why is it that the vast majority of the world's storekeepers show up every morning to find that their goods have not been stolen in the night?
Clearly you are some sort of stupid automaton, incapable of registering actual reality in your brain
Have gnu, will travel.
No, it is not theft. You are violating their intellectual property.
Or is it just impossible to find someone ethical enough to be trusted to make smart locks?
They are for the amateur, to lock them out long enough that activities are suspicious or even downright impossible for them. I have two U lock on my (rather expansive) lying-bike. They are not there for any Pro wanting to steal my bike which would knack them in 1 to 3 second each. They are there for the kids or adult wanting to have a joy ride on it.
C. Sagan : A demon haunted world:
http://www.amazon.com/gp/product/0345409469/
visit randi.org
Check out how easy the lock is to open with simple force. https://www.youtube.com/watch?...
Hmm, expensive use of copper, but I suppose bad advice for breaking into a house isn't a bad thing.
To be fair microsoft are going in the the right direction when it comes to security. Moving towards a walled garden and with pro-active security tools which are missing in many other operating systems. Most Linux/Mac machines have little or no software to find infections.
Bollocks. Most thefts are opportunity based and a shitty tablet may not be worth much but hit 2-3 houses a day and that's your drug fix sorted.
The wire would be cheaper than paying someone to drill a hole in every stud, fish the wire through every hole, and then install a protective steel plate in front of every hole.
Aah, change is good. -- Rafiki
Yeah, but it ain't easy. -- Simba
A decent number of thefts are, in fact, essentially random, committed by drug addicts trying to get precisely those sorts of commodity items that won't look suspicious when they take them into a pawn shop to trade for cash to buy drugs.
Check out my sci-fi/humor trilogy at PatriotsBooks.
Nah, that's what the guy standing around with his hands down his pants is for, and around here you don't need the plate (depending on the dist of the hole to the stud).