Open Sesame! The full story behind opening a smart lock
summary
A chain of attacks targets locks from the same Chinese OEM: unprotected debug ports let firmware be dumped with OpenOCD, firmware reveals a hardcoded controller ID and an exposed super‑admin password, and internal UART traces show a simple, unencrypted controller‑motor protocol. The BLE SDK uses a short six‑hex login key derived via MD5 that is brute‑forceable in under 20 minutes using a Nordic USB dongle, NFC authorizes by UID only, and a custom attack board and ashcat module automate battery‑cycle and replay openings that reliably work.
AI-written summary · about
chapters (12)
- 0:00Smart lock security research
- 3:02Accessing lock electronics
- 7:00Firmware extraction and analysis
- 10:37Automated attack board
- 12:01Second lock model analysis
- 15:40BLE communication analysis
- 20:20Fake Bluetooth lock
- 25:12Vulnerability disclosure
- 26:40NFC lock testing
- 31:40Final attacks and response
- 33:56Manufacturer and consumer advice
- 35:21Q&A
related talks
36mOpen Sesame - Or How Secure Is Your Stuff In Electronic Lockers
01h 06mBackdoors in Back Doors
18mNo Key, No Problem: Vulnerabilities in Master Lock Smart Locks
41mUnlocking Any Door In 21st Century. Immersion In Bio-Security
35mHow I Can Unlock Your Smart Door: Security Pitfalls in Cross-Vendor IoT Access Control
14mWarmup - Lockpicking
41mGrand Theft House: RF Lock Pick Tool to Unlock Smart Door Lock
41mOpening Doors with JSON Web Tokens