10 ms·
Drilling open a smart door lock in 4 seconds
- ktpsns 7y agoThis is so terrible. There is an enterprise market for mature electronic locking systems, as they are used in virtually any modern office building. And then there is the (affordable) consumer market, and most stuff even looks crappy. I really would invest 500€ for a small (3 outdoor locks) system, but there is virtually no product which I can trust in.
- mikestew 7y agoThis is probably the sole reason I went with an August (don't buy their doorbell, BTW), which effectively slips over the existing deadbolt knob. Now I just have to worry about August's BT/software/network stacks, but I don't have to wonder about how good the lock is. With something like the lock in the article, I have to worry about the tech side and how much effort they put into the lock. I almost wonder if, like so many tech "innovations" today, if they didn't just wrap some tech around an unvetted lock mechanism they found on Alibaba and called it day when the software worked.
- jpalomaki 7y agoSlightly related to this, the Lock Picking Lawyer on Youtube has number of videos where he tries a Ramset gun [1] against different padlocks. For example: https://youtu.be/Wimo09WV-rY https://youtu.be/Wimo09WV-rY This was interesting as it was an attack that certainly would not have crossed my mind. Would be interesting to see how other types of locks would do against this kind of tool. [1] https://www.homedepot.com/p/Ramset-MasterShot-0-22-Caliber-Powder-Actuated-Tool-40088/202046595 https://www.homedepot.com/p/Ramset-MasterShot-0-22-Caliber-P...
- mikeryan 7y agoInteresting - I do wonder how well that attack would work in a normal use setting where it could become much harder to brace the lock against something.
- nieve 7y agoI suspect you can find a way to brace them in many circumstances, some of the common bicycle theft techniques are pretty constrained. The down side of this method for a thief is that they look very much like a handgun for obvious reasons. That ups the chance that a quick theft escalates to gunfire if you're interrupted by the police, armed security, or an armed home owner or bystander. Cops are a lot more likely to shoot you if they think they saw a gun.
- ineedasername 7y agoHe's got a couple of videos using it in different ways and it doesn't look like it would be too difficult to brace a lock in some way to use it, like using the tension in the chain or hasp it hangs from. But you're right, in some circumstances it probably would work. Seems dangerous though, both in debris flying off and even more so since it looks like a gun.
- tyingq 7y ago"since it looks like a gun" There are models that don't. https://www.homedepot.com/p/Ramset-HammerShot-0-22-Caliber-Single-Shot-Tool-00022/100091715 https://www.homedepot.com/p/Ramset-HammerShot-0-22-Caliber-S...
- benj111 7y agoIt basically is a gun though "this technology relies on a controlled explosion created by a small chemical propellant charge, similar to the process that discharges a firearm" https://en.m.wikipedia.org/wiki/Powder-actuated_tool https://en.m.wikipedia.org/wiki/Powder-actuated_tool
- omgtehlion 7y agoThanks for an LPL reference! Speaking of "smartlocks": here’s one that doesn’t even need a drill: https://www.youtube.com/watch?v=WeCGTosv-_c https://www.youtube.com/watch?v=WeCGTosv-_c Edit: and another one https://www.youtube.com/watch?v=mGpMaShltbc https://www.youtube.com/watch?v=mGpMaShltbc
- jansan 7y agoHis most unusual attack may have been using Gallium to break the aluminum body of a lock: https://www.youtube.com/watch?v=jeghGhVdt9s https://www.youtube.com/watch?v=jeghGhVdt9s
- Zancarius 7y agoHis magnetic attack[1] on a common commercial lock that's no longer in use was entertaining too. [1] https://www.youtube.com/watch?v=cCay5ek_cW0 https://www.youtube.com/watch?v=cCay5ek_cW0
- tanr54ok 7y agoWhat? No longer in use? Those things are still widely in use in many mid century and older education and healthcare buildings around NYC.
- Zancarius 7y agoI assume this specific model is no longer in use. Sorry, I should've been more clear. From his comments, I don't believe the vulnerable ones are still out there. But, maybe they are.
- tanr54ok 7y agoHe mentions the mech was changed in 2011, mentions there’s a probably little used retrofit and at the end of the video he comments that there are likely many compromised ones still out there. Which is pretty expected if you've seen how buildings are maintained in general. I haven’t encountered a lock that doesn’t have this vulnerability in any 20th century post-war nyc building.
- djmips 7y agoYes they are still around!
- mulmen 7y agoThe lock is still in use but the vulnerability has been fixed in newer models and older models can be fixed by a part kit.
- Zancarius 7y agoOh, interesting. I thought most of them had been replaced with the newer versions. I didn't know about the replacement kit. Now that you mention it, I guess LPL might've said something about it in his video (which I didn't re-watch, oops!). Thanks! Very informative!
- ownagefool 7y agoThat looked like a pretty heavy duty lock, but as a kid I learned that a hammer or smashing a lock against the ground works most of the time. In something like a shipping container the actual lock is shielded away from these types of attacks by the container itself.
- srbby 7y ago403
- auiya 7y agoI don't see the point though. Isn't this precisely what bolt cutters are to be used for?
- calculuscrayon 7y agoWhy even put the lock on the outside? All smart locks I've encountered just communicate wirelessly with a smart lock inside. Physical keys are used as a backup.
- Already__Taken 7y agoyeh regular key lock in the door, electronic cam release of the for latch in the frame seems like a much more robust set-up. seal the gadgets in the wall on the inside of the room, no batteries or moving cables.
- neogodless 7y agoI like keypads. On a rental you can change them when tenants change. At home you can go out with keys or phone. Though it stands to reason you could put a keypad outside and run a wire inside, or use wireless though personally I'm glad my keypad lock isn't smart or wireless.
- Chirael 7y agoKeypads are good, especially for higher end rentals. Another lower tech (and probably more secure TBH) option is small format interchangeable core (SFIC) locks where the core can easily and cheaply be swapped out between tenants. Landlordlocks.com built a business selling this concept to landlords. I’m only jealous I didn’t think of it first :)
- namibj 7y agoSo euro cylinders?
- kilo_bravo_3 7y agoThe video is a compelling demonstration of a design flaw, but I am always skeptical of lock opening displays that do not occur in a real-world application of the lock. Yeah, you ramsetted a lock. In a vise. Can you do that if it is dangling from a chain between two gate halves? Or would you bring out a bench and vise to your target? Ok, you picked a lock. In a vise. Is it easily pickable while hanging from a hasp, with a door behind it? Ok, you drilled open a smart lock. Is the drill able to be positioned in such a manner when the lock is installed on a door? It doesn't look like it. After drilling, you need to insert a screwdriver and manipulate a latch. Is drilling/manipulating faster/slower/easier/more difficult than picking, raking, ramsetting, grinding, kicking, or prying? I like clever, but clever isn't always practical.
- StavrosK 7y ago> Can you do that if it is dangling from a chain between two gate halves? Or would you bring out a bench and vise to your target? I would just mount a clamp to the front of the Ramset gun. > Is the drill able to be positioned in such a manner when the lock is installed on a door? It doesn't look like it. It really looks like it to me, you need to drill the front of the door.
- orpheline 7y ago> Ok, you drilled open a smart lock. Is the drill able to be positioned in such a manner when the lock is installed on a door? He drilled it from the front; the face is off in the picture where he's opening the latch with the screwdriver to better show where the mechanism is.
- cheschire 7y agoHe drilled it from the side. The preview picture from the video clearly shows the entire mechanism sideways on the table.
- rasz 7y agoExactly. This has an added bonus of making it a permanent backdoor. You drill once and put black sticker on it, nobody will notice. Is there even a sensor in the lock to log being manually opened?
- GreenJelloShot 7y agoIsn't the point of a lock just to keep honest people honest? I mean you can buy the world's sturdiest, more secure lock and attach it to the world's strongest door, someone with a hammer can easily break a window. If someone is determined and willing, there really is nothing you can do to stop them from breaking into your house.
- fuzz4lyfe 7y ago>Isn't the point of a lock just to keep honest people honest? I mean you can buy the world's sturdiest, more secure lock and attach it to the world's strongest door, someone with a hammer can easily break a window. In my home, the locks and windows (laminated glass[0]) are hard enough to break that when you attempt to do so I have time to ready my firearm. Something like this would potentially allow someone to sneak up more quickly and perhaps undetected. When my family isn't home I don't really care if you break into my house, insurance will cover the loss. [0]https://www.youtube.com/watch?v=Z2HxWn6eP74 https://www.youtube.com/watch?v=Z2HxWn6eP74
- RHSeeger 7y agoOut of curiosity, do you have a normal door lock on your door; one that uses the kind of key you can get a copy made of at home depot? If so, pretty much anyone can open it with a bump key and a couple seconds. You can see it in action here (https://www.youtube.com/watch?v=w0CIlwSxsvU https://www.youtube.com/watch?v=w0CIlwSxsvU). His first try takes a bit longer than it should because he's turning too hard (simple mistake). Every attempt after that takes just a couple seconds.
- fuzz4lyfe 7y agoI've got abloy protec 2's on all exterior doors in addition to door chains I use at night. https://securitysnobs.com/Abloy-Protec2-Single-Cylinder-w-Lockable-Thumbturn-Deadbolt.html https://securitysnobs.com/Abloy-Protec2-Single-Cylinder-w-Lo...
- 7y ago
- swiley 7y agoThe only way I've seen these used IRL is to replace hiding the keys under the mat. So IMO this is still an improvement.
- nullc 7y agoSecurity is usually a lemon market. The buyer can't really tell if its secure or not, depressing what people are willing to pay, which makes it bad business to invest in making a secure product. It's rather difficult to find electronic locks, even for safes, that aren't obviously less secure than traditional options. Which is pretty sad considering that an electronic lock could be substantially more secure if it was designed well. The stuff that is reasonably secure, like kaba-mas products, are quite expensive because its catering to a market that simply isn't buying on price.
- Chirael 7y agoWith the Internet and YouTube I don’t think it’s as much of a lemon market as it once was. The information is out there, pretty accessible actually. For example it’s not hard to find that Master and Kwikset might not be the highest security compared to other options. The problem isn’t that the information is hard to find, it’s just that most people aren’t willing to spend more for higher security (could be a few hundred dollars more once you multiply it by a few doors) and it’s easy to convince yourself cheap locks are “good enough” - after all, someone could break a window, kick in the door, etc.
- tanr54ok 7y agoJust because information is out there and accessible doesn’t mean it has much mainstream penetration. Locks are a very niche hobby. Most of my friends and family don’t know shit about locks any more than 30 years ago even though the technology is clearly documented and explained on YouTube. YouTube has made pretty much everything widely accessible. Doesn’t necessarily change the market.
- nabla9 7y agohttps://iloq.com https://iloq.com has well designed self-powered digital and secure locks. You can just replace the lock, no electrical wiring or batteries needed.
- WalterBright 7y agoEh, I'd design an electronic lock that is operated with a phone app. There'd be nothing visible of it on the surface of the door. There'd be no way to tell what the make/model of the lock was. There'd a flange the full length of the door so you couldn't even tell where the bolt was.
- ineedasername 7y agoWhat if your phone ran out of power though?
- WalterBright 7y agoYou could have a magnetic switch somewhere that you could tap SOS on with a magnet or something. Or just knock on the door with a certain pattern. Or speak "Open the pod bay doors, Hal" into a pinhole mike. I'm sure you could think of many methods.
- isostatic 7y agoAnd when your house has no power?
- kelnos 7y agoBattery backups, of course. There will always be failure modes. I mean, the failure mode for a traditional lock is "I lost my keys". Unless you have someone else with a spare set who can get to your location in a time you deem reasonable, you're going to have to have the door forced.
- WalterBright 7y agoI once had a storage unit, and lost the key to the padlock. The manager said "no problem", and we went out to the unit. The manager pulled out a battery operated angle grinder, and cut the lock off in about 5 seconds. You're going to need a bank vault to beat an angle grinder. Those tools are the shiznit.
- zelon88 7y agoSecurity isn't about preventing someone from breaching the "lock". It's the level of difficulty (measured in time) that it takes to breach the "lock". That being said, given unlimited resources; no lock is unbreachable.
- segfaultbuserr 7y agoYes. But a difficulty of 4 seconds is a bit too low. I expect 30-60 seconds for an door with moderate security.
- shartshooter 7y agoEasier way to open a smart door lock in 3 seconds...use a hooligan tool[1]. For $150 USD a SWAT team(or someone who practices for a few hours) can be in your room in no time. [1]https://en.wikipedia.org/wiki/Halligan_bar https://en.wikipedia.org/wiki/Halligan_bar
- ryanmarsh 7y agoYes. The truth is most (and I mean nearly all) residential door frames snap like a match stick with a hooligan tool. In a previous life I kicked in doors for a living. I don’t give a fuck how cool your dead bolt is. I could be in your face before you were out of bed. If you want to keep out lazy thieves any lock will do. If you’re preventing against a dynamic entry you need trip wires, man traps, metal door frames, and a 12ga shotgun.
- sroussey 7y agoMetal door frames here. No comment on the others.
- nomel 7y agoI broke a window with a pebble when I was a kid. Most people have windows. Something like an extra sticky vinyl sticker takes care of the noise problem.
- onion2k 7y agoThat wouldn't work on a double glazed window.
- 2rsf 7y agoyou mean laminated glass ?
- tialaramex 7y ago
- phs 7y agoTurns out powers tools work well on non-Turing complete locks too. The interesting part of the threat model for smart locks are cases where a physical attacker is _not_ present.
- kelnos 7y agoThe article points out that the lock casing is made of aluminum rather than steel (presumably for aesthetic reasons), which is trivially easy to drill through. A steel casing would take a lot longer and make a lot more noise. The point is that people in the market for smart locks need to additionally vet the company that makes them for their proficiency in physical security, not just in software security. A competent company that has made non-smart locks for a while would not make this same mistake.
- praptak 7y agoIt does, and the physical lock makers know about this threat. My lock has a freely rotating piece of metal that covers the keyhole - you cannot drill through it without first preventing it from rotating. More advanced locks jam when drilled through. There are also materials that emit lots of smoke when drilled through, mostly used in safes.
- StreamBright 7y agoI avoid everything as branded as smart: locks, TV, watch, etc. I am not sure why people think it is a viable way forward with the technologies we currently use.
- djmips 7y agoThe 'better' lock that has rollers in the bolt to make it harder to cut off is pretty cool. But I found out there is a reciprocating saw with counter action available! Seems perfect to cut rollers. https://toolguyd.com/dualsaw-reciprocating-saw/ https://toolguyd.com/dualsaw-reciprocating-saw/
- alexvoda 7y ago"How do you know where to drill it? The lock has the manufacturers logo on the front face – drill the side of the lock in line with the top of the logo. How helpful!" In that case easy, move the logo elsewhere.
- tristanperry 7y agoSecurity by obfuscation, anyone? He's being flippant. If the logo wasn't there, it would just be a case of measuring N cm to know where to drill.
- freeflight 7y agoIf you look at the internals of the lock then the tolerance where to drill, and still be able to leverage it open, seems to be pretty big. As such, they could remove the whole logo and it would still rather easy to approximate where to drill, it's not like measuring dimensions is impossible without a manufacturer logo.
- alexvoda 7y agoAs pointed above, it was a joke about security through obscurity and a worried thought that some manager might actually think of that as a solution. I was hoping that was obvious enough to not require a "/s" at the end.
- dvcrn 7y agoWhere I live, the smart locks I saw are mounted in from the inside and go over the existing screw bolt thing that unlocks the door. From outside you would have no idea that it's a smart lock. But yeah, they don't have something outside you could touch an NFC tag on to unlock
- zaarn 7y agoTbh with smart locks I'd be more interested in the lock detecting a break-in or destruction of the door mechanism, so it could for example call the police if someone smashes in the door.
- aivisol 7y agoYou don't need a smart lock for that IMHO. Any house alarm usually can detect intrusion.