DEF CON 2016 – Bluetooth-based smart locks easy to hack

Security Researchers demonstrated at the Def Con hacker conference how it is easy to open some Bluetooth-based smart locks.

Last week security researchers Ben Ramsey and Anthony Rose of Merculite Security demonstrated at the Def Con conference how it is easy to open some Bluetooth-based smart locks.

The duo analyzed 16 smart locks from companies such as Ceomate, Elecycle, iBlulock, Mesh Motion, Okidokey, Plantraco, Quicklock, and Vians, and discovered that 12 of them could be easily hacked.

The most worrisome problems with the Bluetooth-based smart locks were the transmission in plain text of the passwords, bad implementation of encryption mechanisms, and the vulnerability to man-in-the-middle attacks.

It was really easy for an attacker to steal the passwords sent by the mobile apps to the smart locks by using an open source Bluetooth sniffer.

In one case, the smart lock was using a proprietary encryption, a choice that is known to make implementations weak.  In this specific case, the experts exploited the change of a byte in order to put the smart lock in an error state, which led to the lock opening.

The security experts analyzed also other Bluetooth smart objects, like a Bluetooth bicycle lock. In this case, they successfully launched a man-in-the-middle attack to open it.

The researchers reported the 12 vendors that designed the vulnerable smart locks, but only one of them replied admitting the issue and confirming that it is working to fix the problem.

In order to oblige the company to fix the issues, the researchers would publicly release the tools they used for the tests, this means that everyone without specific skills can hack the smart looks.

If you are interested in the experts’ presentation slides you can find them here:

https://media.defcon.org/DEF%20CON%2024/DEF%20CON%2024%20presentations/DEFCON-24-Rose-Ramsey-Picking-Bluetooth-Low-Energy-Locks.pdf

[adrotate banner=”9″]

Pierluigi Paganini

(Security Affairs – smart locks, IoT)