Smart lock design flaw opens the door for attackers

An exploitable design flaw with a smart lock means attackers can easily overcome it and the lock's inability to receive updates means it can't easily be fixed.

Researchers at F-Secure found they were able to exploit poorly designed protocols in the KeyWe Smart Lock to intercept the secret passphrase that controls the lock as it's exchanged between the physical device and the mobile app.

"The lock has several protection mechanisms. Unfortunately, the lock's design makes bypassing these mechanisms to eavesdrop on messages exchanged by the lock and app fairly easy for attackers -- leaving it open to a relatively simple attack. There's no way to mitigate this, so accessing homes protected by the lock is a safe bet for burglars able to replicate the hack," says F-Secure Consulting's Krzysztof Marciniak, a cyber security consultant who helped develop the hack. "All attackers need is a little know-how, a device to help them capture traffic – which can be purchased from many consumer electronic stores for as little as 10 dollars -- and a bit of time to find the lock owners."

The attack is another demonstration of the security challenges facing manufacturers and consumers as IoT devices continue to flood the market.

The KeyWe lock has several security features, including data encryption intended to prevent unauthorized parties from accessing system-critical information, such as the secret passphrase. However, F-Secure has found relatively easy ways to circumvent the system’s security measures. And since the device cannot receive firmware updates, the flaw exploited by the attack cannot be fixed, meaning lock owners will need to replace the lock or live with the risk.

Marciniak recommends individuals consider the security implications of internet-connectivity before replacing their offline devices with online versions, and recommends device vendors perform security assessments on their products as part of their design.

You can find out more on the F-Secure blog.

Image credit: aa-ww/Depositphotos.com