Take your pick: 'Hack-proof' blockchain-powered padlock defeated by Bluetooth replay attack or 1kg lump hammer

You can do it the easy way or the easier way

A "hack-proof" smart padlock with security based on blockchain technology could be defeated by a simple Bluetooth replay attack – or a 1kg lump hammer.

The 360lock, a technologically enabled padlock (why?) was advertised by its creators as "completely hacking proof" and incorporating blockchain technology as used in the Ethereum cryptocurrency.

Its unique selling point is that the padlock can be locked and unlocked using an app that transmits over a Bluetooth Low Energy connection, rather than a physical key or combination lock. This apparently needed the inclusion of "advanced crypto codes" to drive "the level of security [to] maximum".

Such silly claims caught the eye of Pen Test Partners, who not only hacked the "hack-proof" lock but also discovered that its physical security was crap too.

All that researcher David Lodge did was record a successful Bluetooth unlock command and then replay it, as he detailed on the company blog, referring to code snippets: "After I did the below commands it popped open. The first packet is authorisation, the second the open command. So it is vulnerable to replay attacks."

Lodge also speculated that the lock was made from Zamak, a zinc-based alloy used in products ranging from zippers to rifle buttplates to cheap jewellery. While Zamak's hard-wearing properties make it good for die-casting, one thing it lacks is tensile strength.

"It took one hit to shear through the connector. Do not use this key box!" advised Lodge, who also made a nine-second video of what happens when you introduce 360lock's padlock and bike lock to a 1kg lump hammer:

Youtube Video

Undoing four exposed screws on the key box led to a blanking plate that Lodge was able to prise off ("it was only held in by silicon sealant") and gain access to the internal electronics and the motor that drove the lock itself.

"A simple security review would have picked up the BLE replay issue, plus other potential issues. How was this missed?" he asked, concluding: "Lock bodies shouldn't be made of Zamak and similar alloys. It's easier and cheaper to cast/machine, compared to steel, but there's a reason conventional locks use case-hardened metals."

Security, both physical and digital, is important. Especially so in a smart security product. ®

Other stories you might like

  • Alcatel-Lucent Enterprise adds Wi-Fi 6E to 'premium' access points
    Company claims standard will improve performance in dense environments

    Alcatel-Lucent Enterprise is the latest networking outfit to add Wi-Fi 6E capability to its hardware, opening up access to the less congested 6GHz spectrum for business users.

    The France-based company just revealed the OmniAccess Stellar 14xx series of wireless access points, which are set for availability from this September. Alcatel-Lucent Enterprise said its first Wi-Fi 6E device will be a high-end "premium" Access Point and will be followed by a mid-range product by the end of the year.

    Wi-Fi 6E is compatible with the Wi-Fi 6 standard, but adds the ability to use channels in the 6GHz portion of the spectrum, a feature that will be built into the upcoming Wi-Fi 7 standard from the start. This enables users to reduce network contention, or so the argument goes, as the 6GHz portion of the spectrum is less congested with other traffic than the existing 2.4GHz and 5GHz frequencies used for Wi-Fi access.

    Continue reading
  • Will Lenovo ever think beyond hardware?
    Then again, why develop your own software à la HPE GreenLake when you can use someone else's?

    Analysis Lenovo fancies its TruScale anything-as-a-service (XaaS) platform as a more flexible competitor to HPE GreenLake or Dell Apex. Unlike its rivals, Lenovo doesn't believe it needs to mimic all aspects of the cloud to be successful.

    While subscription services are nothing new for Lenovo, the company only recently consolidated its offerings into a unified XaaS service called TruScale.

    On the surface TruScale ticks most of the XaaS boxes — cloud-like consumption model, subscription pricing — and it works just like you'd expect. Sign up for a certain amount of compute capacity and a short time later a rack full of pre-plumbed compute, storage, and network boxes are delivered to your place of choosing, whether that's a private datacenter, colo, or edge location.

    Continue reading
  • Intel is running rings around AMD and Arm at the edge
    What will it take to loosen the x86 giant's edge stranglehold?

    Analysis Supermicro launched a wave of edge appliances using Intel's newly refreshed Xeon-D processors last week. The launch itself was nothing to write home about, but a thought occurred: with all the hype surrounding the outer reaches of computing that we call the edge, you'd think there would be more competition from chipmakers in this arena.

    So where are all the AMD and Arm-based edge appliances?

    A glance through the catalogs of the major OEMs – Dell, HPE, Lenovo, Inspur, Supermicro – returned plenty of results for AMD servers, but few, if any, validated for edge deployments. In fact, Supermicro was the only one of the five vendors that even offered an AMD-based edge appliance – which used an ageing Epyc processor. Hardly a great showing from AMD. Meanwhile, just one appliance from Inspur used an Arm-based chip from Nvidia.

    Continue reading

Biting the hand that feeds IT © 1998–2022