Drilling open a smart door lock in 4 seconds

https://www.pentestpartners.com/security-blog/drilling-open-a-smart-door-lock-in-4-seconds/

by RicCo386 • 7 years ago

263 136 7 years ago

ktpsns• 7 years ago

This is so terrible. There is an enterprise market for mature electronic locking systems, as they are used in virtually any modern office building. And then there is the (affordable) consumer market, and most stuff even looks crappy.

I really would invest 500€ for a small (3 outdoor locks) system, but there is virtually no product which I can trust in.

mikestew• 7 years ago

This is probably the sole reason I went with an August (don't buy their doorbell, BTW), which effectively slips over the existing deadbolt knob. Now I just have to worry about August's BT/software/network stacks, but I don't have to wonder about how good the lock is. With something like the lock in the article, I have to worry about the tech side and how much effort they put into the lock. I almost wonder if, like so many tech "innovations" today, if they didn't just wrap some tech around an unvetted lock mechanism they found on Alibaba and called it day when the software worked.

jpalomaki• 7 years ago

Slightly related to this, the Lock Picking Lawyer on Youtube has number of videos where he tries a Ramset gun [1] against different padlocks. For example:

https://youtu.be/Wimo09WV-rY

This was interesting as it was an attack that certainly would not have crossed my mind. Would be interesting to see how other types of locks would do against this kind of tool.

[1] https://www.homedepot.com/p/Ramset-MasterShot-0-22-Caliber-P...

mikeryan• 7 years ago

Interesting - I do wonder how well that attack would work in a normal use setting where it could become much harder to brace the lock against something.

nieve• 7 years ago

I suspect you can find a way to brace them in many circumstances, some of the common bicycle theft techniques are pretty constrained. The down side of this method for a thief is that they look very much like a handgun for obvious reasons. That ups the chance that a quick theft escalates to gunfire if you're interrupted by the police, armed security, or an armed home owner or bystander. Cops are a lot more likely to shoot you if they think they saw a gun.

ineedasername3• 7 years ago

He's got a couple of videos using it in different ways and it doesn't look like it would be too difficult to brace a lock in some way to use it, like using the tension in the chain or hasp it hangs from. But you're right, in some circumstances it probably would work. Seems dangerous though, both in debris flying off and even more so since it looks like a gun.

omgtehlion• 7 years ago

Thanks for an LPL reference!

Speaking of "smartlocks": here’s one that doesn’t even need a drill: https://www.youtube.com/watch?v=WeCGTosv-_c

Edit: and another one https://www.youtube.com/watch?v=mGpMaShltbc

jansan• 7 years ago

His most unusual attack may have been using Gallium to break the aluminum body of a lock:

https://www.youtube.com/watch?v=jeghGhVdt9s

Zancarius3• 7 years ago

His magnetic attack[1] on a common commercial lock that's no longer in use was entertaining too.

[1] https://www.youtube.com/watch?v=cCay5ek_cW0

tanr54ok5• 7 years ago

What? No longer in use? Those things are still widely in use in many mid century and older education and healthcare buildings around NYC.

djmips2• 7 years ago

Yes they are still around!

mulmen• 7 years ago

The lock is still in use but the vulnerability has been fixed in newer models and older models can be fixed by a part kit.

ownagefool• 7 years ago

That looked like a pretty heavy duty lock, but as a kid I learned that a hammer or smashing a lock against the ground works most of the time.

In something like a shipping container the actual lock is shielded away from these types of attacks by the container itself.

unixhero• 7 years ago

Yes, but according to LockpickingLawyer they are still vulnerable to prybar-leverage attacks.

srbby• 7 years ago

403

auiya• 7 years ago

I don't see the point though. Isn't this precisely what bolt cutters are to be used for?

calculuscrayon• 7 years ago

Why even put the lock on the outside? All smart locks I've encountered just communicate wirelessly with a smart lock inside. Physical keys are used as a backup.

Already__Taken• 7 years ago

yeh regular key lock in the door, electronic cam release of the for latch in the frame seems like a much more robust set-up. seal the gadgets in the wall on the inside of the room, no batteries or moving cables.

neogodless• 7 years ago

I like keypads. On a rental you can change them when tenants change. At home you can go out with keys or phone. Though it stands to reason you could put a keypad outside and run a wire inside, or use wireless though personally I'm glad my keypad lock isn't smart or wireless.

Chirael2• 7 years ago

Keypads are good, especially for higher end rentals. Another lower tech (and probably more secure TBH) option is small format interchangeable core (SFIC) locks where the core can easily and cheaply be swapped out between tenants. Landlordlocks.com built a business selling this concept to landlords. I’m only jealous I didn’t think of it first :)

kilo_bravo_3• 7 years ago

The video is a compelling demonstration of a design flaw, but I am always skeptical of lock opening displays that do not occur in a real-world application of the lock.

Yeah, you ramsetted a lock. In a vise. Can you do that if it is dangling from a chain between two gate halves? Or would you bring out a bench and vise to your target?

Ok, you picked a lock. In a vise. Is it easily pickable while hanging from a hasp, with a door behind it?

Ok, you drilled open a smart lock. Is the drill able to be positioned in such a manner when the lock is installed on a door?

It doesn't look like it.

After drilling, you need to insert a screwdriver and manipulate a latch.

Is drilling/manipulating faster/slower/easier/more difficult than picking, raking, ramsetting, grinding, kicking, or prying?

I like clever, but clever isn't always practical.

StavrosK• 7 years ago

Can you do that if it is dangling from a chain between two gate halves? Or would you bring out a bench and vise to your target?

I would just mount a clamp to the front of the Ramset gun.

Is the drill able to be positioned in such a manner when the lock is installed on a door? It doesn't look like it.

It really looks like it to me, you need to drill the front of the door.

orpheline• 7 years ago

Ok, you drilled open a smart lock. Is the drill able to be positioned in such a manner when the lock is installed on a door?

He drilled it from the front; the face is off in the picture where he's opening the latch with the screwdriver to better show where the mechanism is.

cheschire• 7 years ago

He drilled it from the side. The preview picture from the video clearly shows the entire mechanism sideways on the table.

bipson• 7 years ago

I was particularly looking for such (in fact these) questions while going backwards through the article again, and I must say:

I don't think you have a point here. All of these steps can be easily done while the lock is on the door. There are plenty of tools availabe to drill holes this way.

Nobody said it is "faster/slower/easier/more difficult" than existing attacks. It is a valid attack, it is quick and it makes almost no noise and worse: It isn't even obvious (you need to actively search for a tiny hole, otherwise you're just assuming all is OK)

GreenJelloShot• 7 years ago

Isn't the point of a lock just to keep honest people honest? I mean you can buy the world's sturdiest, more secure lock and attach it to the world's strongest door, someone with a hammer can easily break a window.

If someone is determined and willing, there really is nothing you can do to stop them from breaking into your house.

fuzz4lyfe2• 7 years ago

Isn't the point of a lock just to keep honest people honest? I mean you can buy the world's sturdiest, more secure lock and attach it to the world's strongest door, someone with a hammer can easily break a window.

In my home, the locks and windows (laminated glass[0]) are hard enough to break that when you attempt to do so I have time to ready my firearm. Something like this would potentially allow someone to sneak up more quickly and perhaps undetected. When my family isn't home I don't really care if you break into my house, insurance will cover the loss.

[0]https://www.youtube.com/watch?v=Z2HxWn6eP74

RHSeeger2• 7 years ago

Out of curiosity, do you have a normal door lock on your door; one that uses the kind of key you can get a copy made of at home depot? If so, pretty much anyone can open it with a bump key and a couple seconds.

You can see it in action here (https://www.youtube.com/watch?v=w0CIlwSxsvU). His first try takes a bit longer than it should because he's turning too hard (simple mistake). Every attempt after that takes just a couple seconds.

matz1• 7 years ago

it keep those who are in between. Some people would steal if it easy but not if it hard.

JohnFen• 7 years ago

Isn't the point of a lock just to keep honest people honest?

No. Honest people don't need to be "kept honest".

Locks have the same purpose as other security systems (including electronic ones like crypto, etc.).

They aren't intended to (and can't) keep a determined attacker out. What they do is increase the cost (in terms of time, effort, risk, etc.) of gaining access. The point is -- as far as possible -- to make the cost of gaining access exceed the benefit that would be gained by that access.

swiley2• 7 years ago

Maybe if you live in Baltimore or Detroit but in most of the US people really need a good reason to do that kind of thing.

In college I had a friend who didn't even bother locking his door and always left his keys in his car and it was never a problem.

nitwit0052• 7 years ago

Essentially everyone has stolen at some point in their lives, and almost everyone has gone into private property they theoretically shouldn't have gone into.

My door has a lock, but must adults could get in by kicking it a few times with determination. That's true of most locks in existence. They're there to stop people who don't actually want to cause any real damage.

beobab2• 7 years ago

Honest people do need to be kept honest. Even the most saintly can be tempted.

If you found a twenty on the floor in an abandoned alleyway, would you hand it in to police, or would you steal that money?

If your first thought was "It's not stealing for such a small amount", or "It's clearly been abandoned, so it's ok to take it", then you're the target audience for being kept honest.

Your other point is spot on: the aim is to increase the friction of entry and raise a mental barrier in the mind of the subject which results in an outcome you would prefer (no break-in).

doormannn• 7 years ago

There are doors... and there are doors

https://youtu.be/ET9SNXpeORY

floatingatoll3• 7 years ago

A primary point of a lock is to keep people from acting impulsively. Consider these scenarios, ordered by decreasing likelihood of "yes, you would peek your head in" — or "yes, you would slip in and steal something":

If your neighbor leaves their door open, do you peek your head in out of curiosity?

If your neighbor leaves their door unlocked, do you open the door and peek your head in out of curiosity?

If your neighbor locks their door with a combination of 1234, do you open the combination lock, open the door, and peek your head in out of curiosity?

If your neighbor locks their door with a radio-frequency lock, do you install an app to capture their lock signal and replay it later, open the door, and peek your head in out of curiosity?

None of these protect against a determined attacker, but they absolutely do protect against impulsive "low risk, high opportunity" actions.

dual_basis2• 7 years ago

If the door is open and that is an unusual occurance, sure, I would knock on the door frame and call out to make sure they are alright / didn't forget to close the door, etc. For every other situation, no, I wouldn't.

sliken• 7 years ago

My pet peeve is smart dead bolts. Presumably if you have a dead bolt you are worried enough about security to pay for a lock that's stronger and harder to subvert than a normal door knob lock. After all using 2 keys/locks is a hassle every time you open the door. Presumably because you don't want anyone with a shim/credit card to just pop your latch.

Most would expect a dead bolt to survive a 5 second attack from a 10 year old without specialized tools.

It's sadly common to see a $150 "smart" dead bolt with dramatically less physical security than a $25 dumb dead bolt. Some have plastic cases, easily popped off. Others have plastic gears, easily over torqued. If a kid with a screwdriver can just insert the screwdriver into the keyhole and rotate and open the door you might as well not have a dead bolt.

war1025• 7 years ago

I (and I assumed everyone with a dead bolt) only ever lock the dead bolt.

What's the point of locking the door handle if there is a dead bolt?

fyfy18• 7 years ago

Take a look at some of the European armoured doors, especially those in Italy. The door and frame come as a single piece, where the frame is made from hardened steel. I assume the door is too, but they are covered in some sort of veneer.

There is a basic cylinder lock which needs a 90 degree turn from the key outside, or the knob inside. Then there is the deadbolt mechanism which needs to be turned five or so times, and drives 1/2" steel bolts deep into the frame.

http://is.alicdn.com/img/pb/172/617/299/299617172_794.jpg

(Something like "normal", but this is a cheap Chinese knock off)

A few years ago a neighbour called the police because their son had locked himself in the apartment and they thought he was a suicide risk. They brought in the fire department to break in, but rather than cutting through the door, it was easier for them to cut through the masonry wall. Windows here are typically just as secure with triple glazing and multi-point locking as standard, and this was the third floor.

2rsf3• 7 years ago

cut through the masonry wall

some emergency services uses an hydraulic device [1] to open steel doors

[1] https://www.youtube.com/watch?v=NjluIosPWiA

peterwwillis• 7 years ago

Of the places I've lived, the back window has been kicked in, the rooftop door has been unlocked, windows pried, and previous roommates broke into others' rooms to steal stuff.

Iv• 7 years ago

You can always break in somewhere given time and tools. But like the old saying goes, you don't need to overrun the tiger, you need to overrun the other guy.

If a robber has to choose between a locked door and an unlocked door, they will chose the unlocked one. I used to live in an apartment with a door that was so bad that the previous tenant had to add a second lock just to keep it closed, but one day a burglar came and robbed my neighbor. Discussing about why they chose his rather than mine he noticed "from the outside, it looks like you have hardened your door with a second lock".

And yes, you can break windows (if you have easily accessible windows) but a broken window is a much clearer sign of something going wrong than an opened door.

jmnicolas• 7 years ago

After a break-in I had the most disheartening conversation with the Police :

- put an alarm : they're either too fast to care or they deactivate it

- get a dog : they poison it

- bullet proof door + security lock : they break the wall

etc

Cthulhu_• 7 years ago

Yup; I think an important aspect to look out for with locks is whether or not you have to damage / destroy them to get in, because if they do then you have evidence of a break-in meaning the insurance company will pay out. If you have a burglary (for example) done by shims or lockpicks they can claim fraud / no evidence of a break-in and not pay out.

I'd even go as far to say that for burglars it's important to leave traces of a break-in so that the victim can claim insurance.

Aozi• 7 years ago

If someone is determined and willing, there really is nothing you can do to stop them from breaking into your house.

Yes and no. If someone desperately wants to rob you, and precisely you, then yeah they will most likely be able to break in. However that doesn't mean we should make it easy for them. The longer it takes to bypass my lock and security, the more noise they make, the more destruction they leave behind the more likely it is that someone will notice them and call the cops. The more likely it is that they leave something behind that can be used to trace them, etc.

The bigger reason to get quality locks is that criminals often target places with weak security, because hitting those location is easy. A burglar for example will usually case out a location they're targeting to figure out what they need to bring for the actual burglarly. Now if I have SuperArmorMax extra secure lock that takes the burglar an hour to bypass with power tools, but my neighbor has an aluminum smartlock that can be bypassed in 5 seconds with a regular drill, which do you think the burglar will target?

Sure they could also break windows, or try other more destructive entry methods, but those are much louder and rouse more suspoicions from other people. You want to be quick and minimize the time you spend doing something shady.

And again, you shouldn't make things easy just because a determined attacker can get through it, at least make them work for it.

tinus_hn• 7 years ago

No, because then we would all be using wafer locks on our front doors. There’s a balance between strength and price here.

swiley2• 7 years ago

The only way I've seen these used IRL is to replace hiding the keys under the mat. So IMO this is still an improvement.

nullc• 7 years ago

Security is usually a lemon market. The buyer can't really tell if its secure or not, depressing what people are willing to pay, which makes it bad business to invest in making a secure product.

It's rather difficult to find electronic locks, even for safes, that aren't obviously less secure than traditional options.

Which is pretty sad considering that an electronic lock could be substantially more secure if it was designed well.

The stuff that is reasonably secure, like kaba-mas products, are quite expensive because its catering to a market that simply isn't buying on price.

Chirael2• 7 years ago

With the Internet and YouTube I don’t think it’s as much of a lemon market as it once was. The information is out there, pretty accessible actually. For example it’s not hard to find that Master and Kwikset might not be the highest security compared to other options. The problem isn’t that the information is hard to find, it’s just that most people aren’t willing to spend more for higher security (could be a few hundred dollars more once you multiply it by a few doors) and it’s easy to convince yourself cheap locks are “good enough” - after all, someone could break a window, kick in the door, etc.

tanr54ok5• 7 years ago

Just because information is out there and accessible doesn’t mean it has much mainstream penetration. Locks are a very niche hobby. Most of my friends and family don’t know shit about locks any more than 30 years ago even though the technology is clearly documented and explained on YouTube.

YouTube has made pretty much everything widely accessible. Doesn’t necessarily change the market.

nabla9• 7 years ago

https://iloq.com has well designed self-powered digital and secure locks. You can just replace the lock, no electrical wiring or batteries needed.

WalterBright3• 7 years ago

Eh, I'd design an electronic lock that is operated with a phone app. There'd be nothing visible of it on the surface of the door. There'd be no way to tell what the make/model of the lock was. There'd a flange the full length of the door so you couldn't even tell where the bolt was.

ineedasername3• 7 years ago

What if your phone ran out of power though?

WalterBright3• 7 years ago

You could have a magnetic switch somewhere that you could tap SOS on with a magnet or something. Or just knock on the door with a certain pattern. Or speak "Open the pod bay doors, Hal" into a pinhole mike. I'm sure you could think of many methods.

zelon88• 7 years ago

Security isn't about preventing someone from breaching the "lock".

It's the level of difficulty (measured in time) that it takes to breach the "lock".

That being said, given unlimited resources; no lock is unbreachable.

segfaultbuserr• 7 years ago

Yes. But a difficulty of 4 seconds is a bit too low. I expect 30-60 seconds for an door with moderate security.

shartshooter2• 7 years ago

Easier way to open a smart door lock in 3 seconds...use a hooligan tool[1]. For $150 USD a SWAT team(or someone who practices for a few hours) can be in your room in no time.

[1]https://en.wikipedia.org/wiki/Halligan_bar

ryanmarsh2• 7 years ago

Yes. The truth is most (and I mean nearly all) residential door frames snap like a match stick with a hooligan tool.

In a previous life I kicked in doors for a living. I don’t give a fuck how cool your dead bolt is. I could be in your face before you were out of bed.

If you want to keep out lazy thieves any lock will do. If you’re preventing against a dynamic entry you need trip wires, man traps, metal door frames, and a 12ga shotgun.

sroussey2• 7 years ago

Metal door frames here. No comment on the others.

chrisseaton• 7 years ago

This isn't true - modern standard domestic polycarbonate and metal composite doors and frames with locks that engage all the way up are a real problem for the police as they're extremely hard to get through even with repeated blows from a battering ram. There is absolutely no chance whatsoever that you can kick in a modern door. You will break your leg first.

ridaj3• 7 years ago

Sure but that entry is then really a lot more obvious. The kind of small hole they propose to drill here might not get noticed by a security guard doing the rounds, and would offer the ability for repeated near-covert entry.

ASalazarMX• 7 years ago

Why is everyone calling this "hooligan" instead of "Halligan" tool?

shartshooter2• 7 years ago

Looks like it was originally named for the creator(Halligan) but I'm guessing someone people made the mistake of calling it hooligan and there wasn't enough pressure to correct them.

phs• 7 years ago

Turns out powers tools work well on non-Turing complete locks too.

The interesting part of the threat model for smart locks are cases where a physical attacker is _not_ present.

kelnos3• 7 years ago

The article points out that the lock casing is made of aluminum rather than steel (presumably for aesthetic reasons), which is trivially easy to drill through. A steel casing would take a lot longer and make a lot more noise.

The point is that people in the market for smart locks need to additionally vet the company that makes them for their proficiency in physical security, not just in software security. A competent company that has made non-smart locks for a while would not make this same mistake.

praptak• 7 years ago

It does, and the physical lock makers know about this threat. My lock has a freely rotating piece of metal that covers the keyhole - you cannot drill through it without first preventing it from rotating.

More advanced locks jam when drilled through. There are also materials that emit lots of smoke when drilled through, mostly used in safes.

StreamBright• 7 years ago

I avoid everything as branded as smart: locks, TV, watch, etc. I am not sure why people think it is a viable way forward with the technologies we currently use.

djmips2• 7 years ago

The 'better' lock that has rollers in the bolt to make it harder to cut off is pretty cool. But I found out there is a reciprocating saw with counter action available! Seems perfect to cut rollers. https://toolguyd.com/dualsaw-reciprocating-saw/

alexvoda2• 7 years ago

"How do you know where to drill it? The lock has the manufacturers logo on the front face – drill the side of the lock in line with the top of the logo. How helpful!"

In that case easy, move the logo elsewhere.

tristanperry• 7 years ago

Security by obfuscation, anyone?

He's being flippant. If the logo wasn't there, it would just be a case of measuring N cm to know where to drill.

freeflight2• 7 years ago

If you look at the internals of the lock then the tolerance where to drill, and still be able to leverage it open, seems to be pretty big.

As such, they could remove the whole logo and it would still rather easy to approximate where to drill, it's not like measuring dimensions is impossible without a manufacturer logo.

alexvoda2• 7 years ago

As pointed above, it was a joke about security through obscurity and a worried thought that some manager might actually think of that as a solution. I was hoping that was obvious enough to not require a "/s" at the end.

dvcrn• 7 years ago

Where I live, the smart locks I saw are mounted in from the inside and go over the existing screw bolt thing that unlocks the door. From outside you would have no idea that it's a smart lock. But yeah, they don't have something outside you could touch an NFC tag on to unlock

zaarn• 7 years ago

Tbh with smart locks I'd be more interested in the lock detecting a break-in or destruction of the door mechanism, so it could for example call the police if someone smashes in the door.

aivisol• 7 years ago

You don't need a smart lock for that IMHO. Any house alarm usually can detect intrusion.

Drilling open a smart door lock in 4 seconds

Related Stories