SmartWars:A+ackingSmartLockswithaSmartPhone �

SongLiNewSkySecurity/0XiDLabsls@newskysecurity.com�

KevoSmartLock�

•  BluetoothLowEnergy(BLE)interface.•  Whensomeonetouchesthedeadbolt,KevosmartlockwilltrytotalktoBLEdevices.

•  TalkstoBLE-enabledsmartphones,iPhone4Sandlatermodels,manyAndroidphoneswithBLEenabled.

•  TalkstokeyfobwhichisBLE-enabled.•  Ifdeviceisaround,unlock. �

DEMO �

•  AbriefdemoofhowKevosmartlockworks �

DOSAPack�

•  BLEprotocolhasbroadcasQngmodeandothermodesthatarepoint-to-point– Theconceptofbind– Similartopair,lessauthenQcaQon,requiresnopasswordtobind

•  Unfortunately,Kevosmartlockworksonp2pmode

•  UseaBLE-enabledsmartphonetobindwithfobbeforeittalkstothelock�

ConvincingtheLocktoWorkforYou(1) �

•  Kevofobsmartfeatures–  Itsgyrosensordetectsifitisbeingcarriedaround.–  IfnomoQondetected,thefobshutsdownradiowithinaminute

– ThebaPerywilllastlonger– Fobisoffwhenownerishomeasleep,aPackerswon’tbeabletounlockthesmartlock�

ConvincingtheLocktoWorkforYou(2) �

•  Whenfobisboundwithadevice,itwillNOTshutdownradio

•  EvenifthegyrosensordetectsnomoQon•  Whenfobisunbound,ittakesaboutoneminutebeforeshutsdownradio

•  Duringthiswindow,aPackercantouchthedeadboltandunlock,whileownerisasleep �

DEMO �

•  YoutubevideoofaPacks•  Finditonourblog:blog.newskysecurity.com�

Timeline �•  OrderedKevoSmartLockinSept.2015•  DOSaPacksuccessful15minutesa]erfirstpoweron

•  Keep-awakeaPacksuccessfulthenextday–mostoftheQmespentonreadinguser’smanual

•  ContactedKevowithaPackdetails•  KevorespondedwithdetailsandcorrecQons,focusingontherequirementofexternaldoors

•  RepeatedexperimentonadoorthatmetKevo’srequirement

PossibleFixes�

•  AddaphysicalbuPontothefob.•  UsebroadcasQngmodeinsteadofp2pmode•  Donotusefob,alwaysusephone+app,soastoachievemoresophisQcatedcommunicaQon– Augustsmartlockusesthisapproach,anaPackingsmartphonewillbeignored.

Breakinglocks,thephysicalway

•  DemoVideo