DEF CON 2016 – Bluetooth-based smart locks easy to hack

Source: The Grommet

Security Researchers demonstrated at the Def Con hacker conference how it is easy to open some Bluetooth-based smart locks.

Last week security researchers Ben Ramsey and Anthony Rose of Merculite Security demonstrated at the Def Con conference how it is easy to open some Bluetooth-based smart locks.

The duo analyzed 16 smart locks from companies such as Ceomate, Elecycle, iBlulock, Mesh Motion, Okidokey, Plantraco, Quicklock, and Vians, and discovered that 12 of them could be easily hacked.

Image source: TheGrommet

The most worrisome problems with the Bluetooth-based smart locks were the transmission in plain text of the passwords, bad implementation of encryption mechanisms, and the vulnerability to man-in-the-middle attacks.

It was really easy for an attacker to steal the passwords sent by the mobile apps to the smart locks by using an open source Bluetooth sniffer.

In one case, the smart lock was using a proprietary encryption, a choice that is known to make implementations weak. In this specific case, the experts exploited the change of a byte in order to put the smart lock in an error state, which led to the lock opening.

The security experts analyzed also other Bluetooth smart objects, like a Bluetooth bicycle lock. In this case, they successfully launched a man-in-the-middle attack to open it.

The researchers reported the 12 vendors that designed the vulnerable smart locks, but only one of them replied admitting the issue and confirming that it is working to fix the problem.

In order to oblige the company to fix the issues, the researchers would publicly release the tools they used for the tests, this means that everyone without specific skills can hack the smart looks.

If you are interested in the experts’ presentation slides you can find them here:

https://media.defcon.org/DEF%20CON%2024/DEF%20CON%2024%20presentations/DEFCON-24-Rose-Ramsey-Picking-Bluetooth-Low-Energy-Locks.pdf

[adrotate banner=”9″]

Pierluigi Paganini

(Security Affairs – smart locks, IoT)

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.