Locks, at their core, are some of civilisation's oldest security devices; and, much like any other security product, not all of them are created equal. The current boom in IoT devices makes "smart locks" a tempting proposition, with many options promising affordable and robust security. But how good are they actually? How would you even find that out?

In this talk, Alex and Miłosz shine a light on a popular line of smart locks commonly recommended on major UK marketplaces. Although the build quality of the locks makes them relatively resistant to picking and common physical attacks, multiple issues with their "smart" functionality means that a small amount of reverse engineering of the associated smartphone app allows anyone to construct valid unlock requests without any knowledge of authorisation material, and without alerting the owner.

This talk is beginner-friendly and no prior knowledge will be assumed. We will discuss the process of discovering the vulnerabilities, explain how the manufacturer got things wrong (and how they could have done it better), and finally tempt the Demo Gods with a live demonstration of unauthorised unlocking of the devices.

Topics covered will include: Bluetooth Low Energy communications, reverse-engineering of Android applications, basic API/Web security