Smart lock can be hacked 'in seconds'

ronjor · Jun 13, 2018

BBC

A hi-tech padlock secured with a fingerprint can be opened by anyone with a smartphone, security researchers have found.
Click to expand...

ronjor · Jun 15, 2018

Another flaw hits Tapplock smart locks, thanks to leaky server

By Zack Whittaker for Zero Day June 15, 2018
Anyone could pull a lock's location and unlock code details directly from the company's servers.
Click to expand...

stapp · Jun 18, 2018

Unbreakable smart lock devastated to discover screwdrivers exist

It's never easy to crack into a market with an innovative new product but makers of the "world's first smart fingerprint padlock" have made one critical error: they forgot about the existence of screwdrivers
Click to expand...

https://www.theregister.co.uk/2018/06/15/taplock_broken_screwdriver/

Minimalist · Jun 19, 2018

“Unbreakable” Smart Lock Tapplock Issues Critical Security Patch

Tapplock, a smart padlock that received positive reviews and media hype when it was released earlier this year, has issued a critical patch after researchers discovered several security issues enabling them to easily hack into and unlock the device.
Click to expand...

https://threatpost.com/unbreakable-smart-lock-tapplock-issues-critical-security-patch

guest · Mar 6, 2019

Don't worry about being locked with Loccess
March 4, 2019
https://www.eyeohtee.cheap/dont-worry-about-being-locked-with-loccess/

Besides opening with a keypad on the bottom of the device, this smart lock is able to be opened with your smart phone using BLE.
I was able to get this smart lock at Amazon for around $20.

I installed the Android app and after reading the installation manual it seems that the factory code for opening the lock is 000000.
What happens if an user changes the default password? I changed it to a strong password (not) - 123456.

When the victim opens the lock, the following request is caught in plaintext: [...] You can even sniff the authentication from the admin
After getting this access, you can change the button 4 digit pincode, master password and reset to factory values.
Click to expand...

In a point of view of an attacker:

Press the wake-up button

Send an BLE request for the factory password

If not working, attacker should sniff the traffic between victims phone and Loccess

Use the new password (or change the existing one) and open the lock

Click to expand...

guest · Dec 11, 2019

Bad news: KeyWe Smart Lock is easily bypassed and can't be fixed
Good news? There is no good news
December 11, 2019
https://www.theregister.co.uk/2019/12/11/f_secure_keywe/

File this one under "not everything needs a computer in it". Finnish security house F-Secure today revealed a vulnerability in the KeyWe Smart Lock that could let a sticky-fingered miscreant easily bypass it.
To add insult to injury, the device's firmware cannot be upgraded either locally or remotely. This means the only way to conclusively remediate this problem is to rip the damned things from your door and replace them with a bog-standard lock.

Its Achilles' heel is what F-Secure describes as "improperly designed communications protocols". These allowed the firm to intercept the secret passphrase as it transmitted from the smartphone to the lock, using just a $10 BLE sniffer and Wireshark.

Speaking to The Register, F-Secure's Krzysztof Marciniak said: "The KeyWe Smart Lock uses BlueTooth Low Energy, which is based on the concept of advertisements. These contain information about device capabilities, the device name, and the device [MAC] address. It's from this address the common key is generated."
F-Secure also figured out how to yank the key-calculation process from the mobile application, rendering the second factor redundant.
Click to expand...

F-Secure: KeyWe Smart Lock unauthorized access and traffic interception

guest · Apr 7, 2020

Canadian Maker of Smart Locks Settles FTC Allegations That it Deceived Consumers about its Security Practices
April 6, 2020
https://www.ftc.gov/news-events/pre...art-locks-settles-ftc-allegations-it-deceived

A Canadian company has settled Federal Trade Commission allegations that it deceived consumers by falsely claiming that its Internet-connected smart locks were designed to be “unbreakable” and that it took reasonable steps to secure the data it collected from users.

The settlement requires Tapplock, Inc. to, among other things, implement a comprehensive security program and obtain independent biennial assessments of the program.

“We allege that Tapplock promised that its Internet-connected locks were secure, but in fact the company failed to even test if that claim was true,” said Andrew Smith, Director of the FTC’s Bureau of Consumer Protection. “Tech companies should remember the basics—when you promise security, you need to deliver security.”
Tapplock sells fingerprint-enabled, Internet-connected padlocks, and has touted in its advertisements that its smart locks were “Bold. Sturdy. Secure,” according to the FTC’s complaint.

The FTC, however, alleged that contrary to its representations to consumers, the company’s locks were not secure and that Tapplock failed to take reasonable precautions or follow industry best practices to protect the consumer data it collected.
Click to expand...

guest · May 26, 2020

FTC Gives Final Approval to Settlement with Smart Lock Maker
May 20, 2020
https://www.ftc.gov/news-events/pre...es-final-approval-settlement-smart-lock-maker

The Federal Trade Commission has given final approval to a settlement with a Canadian company related to allegations it falsely claimed that its Internet-connected smart locks were designed to be “unbreakable” and that it took reasonable steps to secure the data it collected from users.

Tapplock, Inc. sells fingerprint-enabled, Internet-connected padlocks that interact with a companion mobile app, allowing users to lock and unlock their padlocks when they are within Bluetooth range. The FTC alleged that, contrary to its representations to consumers, the company’s locks were not secure and Tapplock failed to take reasonable precautions or follow industry best practices to protect the consumer data it collected through its app.
Under the settlement, Tapplock is required to implement a comprehensive security program and obtain independent biennial assessments of the program by an assessor that the FTC has authority to approve. The company also is prohibited from misrepresenting its privacy and security practices.
Click to expand...

Securityweek: FTC Settles With Canadian Smart Lock Maker Over Security Practices

The Federal Trade Commission (FTC) has approved a settlement with Canadian smart lock maker Tapplock, which allegedly falsely claimed that its devices were designed to be “unbreakable.”
Click to expand...

Log in or Sign up

Smart lock can be hacked 'in seconds'

ronjor Global Moderator

ronjor Global Moderator

stapp Global Moderator

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Smart lock can be hacked 'in seconds'

ronjor Global Moderator

ronjor Global Moderator

stapp Global Moderator

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches