Tobias Madl
Tobias Madl is one of the two board members of Neodyme AG,
headquartered in Garching near Munich. He holds a Master’s degree in
Applied Research in Engineering Sciences, specializing in Automotive
Security. Alongside his PhD studies at the Technical University of
Munich, he worked at Fraunhofer AISEC, contributing to cutting-edge
research in product and industrial security. As a founding member of
the nonprofit organization NFITS (Nachwuchsförderung IT-Sicherheit
e.V.), Tobias is dedicated to promoting young talent in cybersecurity.
Session
Smart locks are rapidly replacing physical keys, but trusting your front door to an IoT device still comes with significant risks. In this talk, we will dissect the highly rated SwitchBot Lock Pro and demonstrate how a classic cryptographic implementation flaw allowed anyone to silently unlock the door without an physical tampering. By reverse-engineering the firmware and analyzing the custom Bluetooth Low Energy (BLE) protocol between the outdoor keypad and the indoor actuator, we discovered the system relies on AES in Counter (CTR) mode with zero integrity checks. We will demonstrate how we exploited this to create a universal, software-only UNLOCK payload. Join us as we showcase the live exploit, break down the vendor's flawed patch, explain how backward compatibility significantly delayed the patch, and celebrate our massive 100€ bug bounty.