Csw2016 song li-smart_wars
-
Upload
cansecwest -
Category
Internet
-
view
1.295 -
download
0
Transcript of Csw2016 song li-smart_wars
SmartWars:A+ackingSmartLockswithaSmartPhone �
SongLiNewSkySecurity/[email protected]�
KevoSmartLock�
• BluetoothLowEnergy(BLE)interface.• Whensomeonetouchesthedeadbolt,KevosmartlockwilltrytotalktoBLEdevices.
• TalkstoBLE-enabledsmartphones,iPhone4Sandlatermodels,manyAndroidphoneswithBLEenabled.
• TalkstokeyfobwhichisBLE-enabled.• Ifdeviceisaround,unlock. �
DEMO �
• AbriefdemoofhowKevosmartlockworks �
DOSAPack�
• BLEprotocolhasbroadcasQngmodeandothermodesthatarepoint-to-point– Theconceptofbind– Similartopair,lessauthenQcaQon,requiresnopasswordtobind
• Unfortunately,Kevosmartlockworksonp2pmode
• UseaBLE-enabledsmartphonetobindwithfobbeforeittalkstothelock�
ConvincingtheLocktoWorkforYou(1) �
• Kevofobsmartfeatures– Itsgyrosensordetectsifitisbeingcarriedaround.– IfnomoQondetected,thefobshutsdownradiowithinaminute
– ThebaPerywilllastlonger– Fobisoffwhenownerishomeasleep,aPackerswon’tbeabletounlockthesmartlock�
ConvincingtheLocktoWorkforYou(2) �
• Whenfobisboundwithadevice,itwillNOTshutdownradio
• EvenifthegyrosensordetectsnomoQon• Whenfobisunbound,ittakesaboutoneminutebeforeshutsdownradio
• Duringthiswindow,aPackercantouchthedeadboltandunlock,whileownerisasleep �
DEMO �
• YoutubevideoofaPacks• Finditonourblog:blog.newskysecurity.com�
Timeline �• OrderedKevoSmartLockinSept.2015• DOSaPacksuccessful15minutesa]erfirstpoweron
• Keep-awakeaPacksuccessfulthenextday–mostoftheQmespentonreadinguser’smanual
• ContactedKevowithaPackdetails• KevorespondedwithdetailsandcorrecQons,focusingontherequirementofexternaldoors
• RepeatedexperimentonadoorthatmetKevo’srequirement
PossibleFixes�
• AddaphysicalbuPontothefob.• UsebroadcasQngmodeinsteadofp2pmode• Donotusefob,alwaysusephone+app,soastoachievemoresophisQcatedcommunicaQon– Augustsmartlockusesthisapproach,anaPackingsmartphonewillbeignored.
Breakinglocks,thephysicalway
• DemoVideo