2023-12-09 –, Clappy Monkey Track
Locks, at their core, are some of civilisation's oldest security devices; and, much like any other security product, not all of them are created equal. The current boom in IoT devices makes "smart locks" a tempting proposition, with many options promising affordable and robust security. But how good are they actually? How would you even find that out?
In this talk, Alex and Miłosz shine a light on a popular line of smart locks commonly recommended on major UK marketplaces. Although the build quality of the locks makes them relatively resistant to picking and common physical attacks, multiple issues with their "smart" functionality means that a small amount of reverse engineering of the associated smartphone app allows anyone to construct valid unlock requests without any knowledge of authorisation material, and without alerting the owner.
This talk is beginner-friendly and no prior knowledge will be assumed. We will discuss the process of discovering the vulnerabilities, explain how the manufacturer got things wrong (and how they could have done it better), and finally tempt the Demo Gods with a live demonstration of unauthorised unlocking of the devices.
Topics covered will include: Bluetooth Low Energy communications, reverse-engineering of Android applications, basic API/Web security
Miłosz is a mobile security specialist at WithSecure, having previously spent entirely too much time working in academia.
His current work revolves around Mobile Device Management solutions, Android device security audits, advisory consultancy, and complaining about password managers. Outside of technical work, his primary interests are in education and the culture of education.
Cyber security enthusiast, finally free from academia, interned as a cybersecurity consultant at WithSecure, and currently filling my time picking locks and job-hunting.
Favourite security areas: Mobsec, Access Control/Physical Security
Favourite Padlock: Abus 72/40