Take your pick: 'Hack-proof' blockchain-powered padlock defeated by Bluetooth replay attack or 1kg lump hammer
- Reference: 1600114326
- News link: https://www.theregister.co.uk/2020/09/14/smart_padlock_really_isnt/
- Source link:
The 360lock, a technologically enabled padlock (why?) was advertised by its creators as "completely hacking proof" and incorporating blockchain technology as used in the Ethereum cryptocurrency.
Its unique selling point is that the padlock can be locked and unlocked using an app that transmits over a Bluetooth Low Energy connection, rather than a physical key or combination lock. This apparently needed the inclusion of "advanced crypto codes" to drive "the level of security [to] maximum".
Such silly claims caught the eye of Pen Test Partners, who not only hacked the "hack-proof" lock but also discovered that its physical security was crap too.
All that researcher David Lodge did was record a successful Bluetooth unlock command and then replay it, as he [1]detailed on the company blog, referring to code snippets: "After I did the below commands it popped open. The first packet is authorisation, the second the open command. So it is vulnerable to replay attacks."
Lodge also speculated that the lock was made from Zamak, a zinc-based alloy used in products ranging from zippers to rifle buttplates to cheap jewellery. While Zamak's hard-wearing properties make it good for die-casting, one thing it lacks is tensile strength.
"It took one hit to shear through the connector. Do not use this key box!" advised Lodge, who also made a nine-second video of what happens when you introduce 360lock's padlock and bike lock to a 1kg lump hammer:
[2]Youtube Video
Undoing four exposed screws on the key box led to a blanking plate that Lodge was able to prise off ("it was only held in by silicon sealant") and gain access to the internal electronics and the motor that drove the lock itself.
"A simple security review would have picked up the BLE replay issue, plus other potential issues. How was this missed?" he asked, concluding: "Lock bodies shouldn't be made of Zamak and similar alloys. It's easier and cheaper to cast/machine, compared to steel, but there's a reason conventional locks use case-hardened metals."
Security, both physical and digital, is important. Especially so in a smart security product. ®
Get our [3]Tech Resources
[1] https://www.pentestpartners.com/security-blog/360lock-smart-lock-review/
[2] https://www.youtube.com/watch?v=WISzXzxfeVg
[3] https://whitepapers.theregister.com/
Sounds familiar
Wasn’t there a very similar product to this about a year or so ago? And that too was exposed as being utter crap.
Of course, why the hell you would want a Bluetooth (Or any other techie nonsense) connected padlock is beyond me. Oh - got to go - just received a video email (powered by blockchain, natch) telling me the kettle has boiled!
Re: Sounds familiar
I could see a point for a job site storage container etc, where you could give certain people access on a one off or time controlled basis and revoke their access remotely, or even a home product - friend needs to borrow something, rings you, "i'll give you access remotely, just snap the lock shut when you get what you need"
Re: Sounds familiar
It sounds as if you're thinking of something more than Bluetooth.
Re: Sounds familiar
Lockpicking Lawyer has loads of them, though usually they take a little more than 9 seconds to open.
"Nothing on 1, click on 2.... SMASH!"
in any case, that's all I have for you today :)
I counted two hits with the hammer. Who makes a security lock out of plastic, then has the arrogance to call it 'hack-proof'?
"I counted two hits with the hammer."
Yep, me too. Also what is the 'connector' of a padlock?
If anything I'd assume it meant the shackle, but on the video it looks like it is the hasp that breaks rather than the lock itself.
^ This. I have no doubt this padlock is sh*t beyond words, but all that video demonstrated was that the hasp the padlock was fitted to could be broken; not the padlock itself.
If you freeze fame as the padlock flies off you can see that the shackle is broken.
I've come to believe
that anything labeled smart [something] should have the word smart prominently in quotes.
"...so bad, it's not even wrong."--Wolfgang Pauli
I wonder at the correlation between crap like this ("technology", and otherwise) becoming--disturbingly--more and more prevalent, and the almost infinite (well, in the billions, anyway) number of 'borgs and 'hive-minds' who subscribe to Facebook; and who might as well have a phone grafted to the side of their head, to boot (I REFUSE to refer to those things as smartphones; most all who use them are dumber than a box of rocks. "Smart" only refers to the people who make and sell the things).
TTFN.
Confessions of a bolt cutter
Lock picking is difficult, it's easier and quicker to use a bolt cutter to, you know, cut through the bolt.
I've cut through a load of padlocks with ease using £10 bolt cutters, mostly at military sites, and so I learned which products to buy to deter my peers.
I just gave my last one away to Extinction Rebellion Scotland so I forget the padlock brand, but it has an octagonal shaft with a stainless steel alloy. I bought mine in B&Q for about £20, and I couldn't cut through them.
I am much amused that people pay more for bike locks that have in-built alarms. They are less than useless. If your bike costs more than your lock then consider bringing it indoors.
[ETA: [1]I don't think this is it, but it's similar ]
[1] https://www.diy.com/departments/master-lock-excell-stainless-steel-cylinder-open-shackle-padlock-w-45mm/191709_BQ.prd
Re: Confessions of a bolt cutter
Lock picking is not difficult, at least not for the sorts of standard locks on a padlock, office door or the sort of home deadbolt you'd buy at Lowes if you were only looking at the big name / low price area.
Took me a couple hours to learn and get the feel of it, then I was able to pick most locks in 15-30 seconds. I lost my lock pick set so I haven't done it in years, but I have no doubt I'd be able to relearn quickly if I could be bothered to. A bolt cutter may be quicker, but it also renders the padlock unusable. If I pick one even if I don't have the key I still have a padlock I can attach to something I want to keep secure from anyone who doesn't know how to pick locks or isn't worried if someone sees them carrying a 10 pound bolt cutter around.
Re: Confessions of a bolt cutter
I used to leave a new padlock and keys whenever I cut one. I've never successfully picked a lock so kudos to you for mastering that skill. Jackets hide bolt cutters.
All the skills I learned as a peace protester would make me a formidable burglar, but luckily I am lazy and not envious.
Re: Confessions of a bolt cutter
Hydraulic bolt cutters make short work of boron carbide hasps. Available for around $200 (manually operated), or a little more for a good quality used battery powered model that'll open a dozen or more of these locks on a charge.
How was this missed? Daft question.
It wasn't missed. The locks are intended to be sold to clueless idiots, not intelligent people. There is a vast market of clueless idiots, but not quite so many intelligent people. Who would the proverbial thinking man choose to market at? Especially if you can build a product down to a price, and then mark it up several thousand percent? It might be a short-term market, but the near-term profit should be magnificent! And the best thing is, that with a simple re-design and a slightly different buzzword filled marketing campaign you can sell it again and again! And it's perfectly legal. Cool, eh?
See IoT, iFads and various other scams marketing triumphs.