Slashdot Mirror
The 'World's Worst' Smart Padlock Is Even Worse Than Previously Thought (sophos.com)
Last week, cybersecurity company PenTest Partners managed to unlock TappLock's smart padlock within two seconds. They "found that the actual code and digital authentication methods for the lock were basically nonexistent," reports The Verge. "All someone would need to unlock the lock is its Bluetooth Low Energy MAC address, which the lock itself broadcasts." The company also managed to snap the lock with a pair of 12-inch bolt cutters.
Today, Naked Security reports that it gets much worse: "Tapplock's cloud-based administration tools were as vulnerable as the lock, as Greek security researcher Vangelis Stykas found out very rapidly." From the report: Stykas found that once you'd logged into one Tapplock account, you were effectively authenticated to access anyone else's Tapplock account, as long as you knew their account ID. You could easily sniff out account IDs because Tapplock was too lazy to use HTTPS (secure web connections) for connections back to home base -- but you didn't really need to bother, because account IDs were apparently just incremental IDs anyway, like house numbers on most streets. As a result, Stykas could not only add himself as an authorized user to anyone else's lock, but also read out personal information from that person's account, including the last location (if known) where the Tapplock was opened.
Incredibly, Tapplock's back-end system would not only let him open other people's locks using the official app, but also tell him where to find the locks he could now open! Of course, this gave him an unlocking speed advantage over Pen Test Partners -- by using the official app Stykas needed just 0.8 seconds to open a lock, instead of the sluggish two seconds needed by the lock-cracking app.
Today, Naked Security reports that it gets much worse: "Tapplock's cloud-based administration tools were as vulnerable as the lock, as Greek security researcher Vangelis Stykas found out very rapidly." From the report: Stykas found that once you'd logged into one Tapplock account, you were effectively authenticated to access anyone else's Tapplock account, as long as you knew their account ID. You could easily sniff out account IDs because Tapplock was too lazy to use HTTPS (secure web connections) for connections back to home base -- but you didn't really need to bother, because account IDs were apparently just incremental IDs anyway, like house numbers on most streets. As a result, Stykas could not only add himself as an authorized user to anyone else's lock, but also read out personal information from that person's account, including the last location (if known) where the Tapplock was opened.
Incredibly, Tapplock's back-end system would not only let him open other people's locks using the official app, but also tell him where to find the locks he could now open! Of course, this gave him an unlocking speed advantage over Pen Test Partners -- by using the official app Stykas needed just 0.8 seconds to open a lock, instead of the sluggish two seconds needed by the lock-cracking app.
It's almost like hiring people straight out of college for pennies (or getting free interns) for your startup is a bad idea.
Just make it a social networking program. You log in, everybody sees your data. They're already half way to being FaceBook. Social is where it's at. Nobody wants real security. They want companionship. This company could be perfectly positioned to combine a new kind of security with a new kind of social network. They could call it Social Security.
For all intensive purposes, "whom" is no longer a word. That begs the question, "who cares"?
This is a very predictable result of crowdfunding. No need to demonstrate competence or experience in a market since your funders are even more ignorant.
Working to get venture capital serves are real purpose, now we see the result when that is bypassed.
Go search "Lockpicking lawyer" on Youtube. That guy shows how useless locks are, mechanical or digital.
Well, yes, but there are degrees of lawyer. Someone with the right resources can break probably most locks, but your usual criminal will go for the easiest option, which you just don't make be you. You don't have to run faster than the bear, you have to run faster than the man next to you also running away from the bear.
Most commercial locks are only good for keeping honest people out. If someone really wants to get into a place and has the know how, a lock is nothing more than a slight inconvenience.
Still I sleep better with a nice dead bolt and a chair against the door.
I read at +2. If your post doesn't reach that level I will not see or respond to it.
He isn't new. He has been picking locks for a long time. No, most locks are not good enough and he can defeat any lock. I don't know what else there is to "know".
When you live in a bubble, you think all your ideas are great. All the echoes tell you so.
Some locks are for that. Others are designed to force the bad guy to make noise or hang around looking suspicious long enough to get caught. No lock is absolutely PROOF against unauthorized access.
Another purpose of a lock is to remove plausible deniability. It's hard to say you didn't know you were trespassing if you had to pick or break a lock to get in.
Same for safes. The crappy ones talk about how they keep people out with absolute security. The good ones talk about how long it will take the bad guy to get in (as they inevitably will if they're determined).
But locks that can be opened through actions indistinguishable from legitimate access are totally worthless.
Still I sleep better with a nice dead bolt and a chair against the door.
A good sized dog in the hallway works even better.
Also, bosnianbill
Locks are not invincible. They can be bypassed, shimmed, bumped, picked, rapped, cut, pulled apart, melted, etc... However, all these attacks require a bit of skill and time, and can make noise, and make you appear suspicious.
Serious lock certifications usually grade the locks by how long it will take to defeat the lock, no one pretends a lock will never be defeated. In France for example, the highest security level for residential door locks is 15 minutes for a well equipped burglar. Level 1 (which is still considered good) is just 5 minutes with basic tools.
It's worse than that - the guy on this youtube video opens it with an adhesive gopro mount and a screwdriver.
Have gnu, will travel.
A good sized dog in the hallway works even better.
This is Truth. I read a study once that a home invader will most often be deterred by the sound of a dog of any size. With that being said I believe they would be more "deterred" to the sound of a Rottweiler and a Chiwawa.
I read at +2. If your post doesn't reach that level I will not see or respond to it.
If your dog isn't trained as an attack dog, a handful of treats will defeat him.
If he is trained as an attack dog, he's probably not safe to have around visitors, and a handgun will still easily defeat him.
Dogs are a terrible security investment. Compared to some good locks and an alarm system, they're expensive, time-consuming, easy to defeat, and your family is going to suffer a lot more emotional trauma if they get killed than they are if a camera gets smashed.
I've never seen a lock last more than a few seconds against a pick gun, without being immune to picking. And if you're willing to damage the door, just back a truck through it. Either way, nothing takes 15 minutes (unless we're talking about a safe or something).
I suspect that it would take quite a bit more than 15 minutes to get the truck up the stairs or into the 4-person elevator to get it in position for backing up through my front door.
I'm under no illusion about the safety of the lock. I know that someone who really wants in can get in. I have a concrete proof in that several years ago the guys from the fire department went into the neighboring apartment through the door and it took only a minute or two for them. I know it because they weren't interested in maintaining any secrecy, and trust me, you wake up when someone removes the whole frame of the door from the wall at 2 am.
Almost all of the locks that we use here for buildings have disc tumblers and not rods like the folks in the US tend to use. Those are more difficult to pick than rodded ones as you can't bump key or use pick gun on them. They - especially the old ones - are not immune for picking, but it isn't a simple 'jam a tool in, open the door' operation.
I'm pretty certain that no petty criminal searching for quick cash can pick my front door lock, and a professional lockpicker has no reason to break into my place. That leaves only breaking the door as an option, and doing that without causing enough noise to wake up the whole building will take more than 15 minutes.
Is there anything in the products documentation, marketing, or the founders communication, that makes these security flaws a lie rather than a failure? Did they claim to have any certification or accreditation on the device which the device didn't have. Are there legal standards for this type of product that this doesn't meet?
Failing the above then the justice system would be rubbish if it did anything to this company just because a bunch of people bought the product without understanding the risk of not requiring more information or proof it would be effective.
Only to an extent. They aren't likely to do a comprehensive survey of the neighborhood. More likely they will look at your property and decide if the difficulty and risk is higher than they care for or not. If it is too high, THEN they move on.
I sort of agree, but as someone who owns a 95 pound pit-dane mix I think it's more complicated than that.
When we have a new person who will be in our house a lot, we have them give the dog a treat (including issuing the 'wait' command and then the release command to take the food) so that the dog sees them as being 'OK' and a food supplier.
That being said, a few of these people have a background fear of the dog due to his size and dominant personality and the dog simply doesn't let them be, he continues to challenge them. I think its because he senses their fear and it makes him skeptical of them.
When we've had unexpected people over (door-door types, etc) the dog is NUTS. Quite often the shadier the visitor, the MORE the dog is nuts. Call me crazy, but I think dogs can SMELL motivation/aggression. I think it's part of why cops have such trouble with dogs -- they simply project aggression and hostility and dogs react to that.
I think if someone broke into my house, it would take more than a handful of treats. I think the dog would be in full-on dominance mode and 95 pounds of dog is fucking scary no matter how bad-ass you are and most humans are going to have a fear response to that. Unless you can somehow overcome this and project a submission to the dog, at least at our house you're gonna have a bad time.
Maybe some kind of dog expert would defuse the situation easily, but your random hood thief isn't that. Shooting a dog will kind of work, but there's plenty of evidence that dogs don't fall over and die from wounding shots, they keep going until they can't. My neighbor is a cop and he says he has seen guys empty 9 mm pistols into dogs with limited effect. Part of it is an agitated dog is a tough target and results in superficial wounds, but part of it is that cornered animals don't quit. Plus if you are looking to steal laptops/tablets/jewlry and get in-and-out, you're not blazing away with a handgun at a dog.
Go search "Lockpicking lawyer" on Youtube. That guy shows how useless locks are, mechanical or digital.
Well, yes, but there are degrees of lawyer. Someone with the right resources can break probably most locks, but your usual criminal will go for the easiest option, which you just don't make be you. You don't have to run faster than the bear, you have to run faster than the man next to you also running away from the bear.
I was walking past a bike rack today and the local council had put up a sign saying "This is a known bike theft hotspot, secure your bike". I noted that most bikes had a chain with a standard combination lock on them. I recall that most of these locks can be "picked" simply by giving them a good whack with a rubber mallet (IIRC, the pins just fall out). You're better off with a decent padlock and length of chain which probably costs half as much as the combination locks. Of course these can be picked, but it's a lot harder than the bike chains (as you said, locks don't have to be unpickable, just hard enough to make a crim say "I cant be arsed").
Calling someone a "hater" only means you can not rationally rebut their argument.
Dogs can add to a security mix (with locks and other measures) in that they can make a house undesirable to rob. If you're a thief and you are presented with two houses - one with a deadbolt, security cameras, and a large dog, and the other with no deadbolt, cameras, or dog - then everything else being equal you'll go for the easier house. No security measure is 100% guaranteed. You just need to make yourself a less desirable target than everyone else.
My sci-fi novel, Ghost Thief, is now available from Amazon.com.