Home / Blockchain / Blockchain: Take your pick: ‘Hack-proof’ blockchain-powered padlock defeated by Bluetooth replay attack or 1kg lump hammer

Blockchain: Take your pick: ‘Hack-proof’ blockchain-powered padlock defeated by Bluetooth replay attack or 1kg lump hammer

Blockchain:

A “hack-proof” smart padlock with security based on blockchain technology could be defeated by a simple Bluetooth replay attack – or a 1kg lump hammer.

The 360lock, a technologically enabled padlock (why?) was advertised by its creators as “completely hacking proof” and incorporating blockchain technology as used in the Ethereum cryptocurrency.

Its unique selling point is that the padlock can be locked and unlocked using an app that transmits over a Bluetooth Low Energy connection, rather than a physical key or combination lock. This apparently needed the inclusion of “advanced crypto codes” to drive “the level of security [to] maximum”.

Such silly claims caught the eye of Pen Test Partners, who not only hacked the “hack-proof” lock but also discovered that its physical security was crap too.

All that researcher David Lodge did was record a successful Bluetooth unlock command and then replay it, as he detailed on the company blog, referring to code snippets: “After I did the below commands it popped open. The first packet is authorisation, the second the open command. So it is vulnerable to replay attacks.”

Lodge also speculated that the lock was made from Zamak, a zinc-based alloy used in products ranging from zippers to rifle buttplates to cheap jewellery. While Zamak’s hard-wearing properties make it good for die-casting, one thing it lacks is tensile strength.

“It took one hit to shear through the connector. Do not use this key box!” advised Lodge, who also made a nine-second video of what happens when you introduce 360lock’s padlock and bike lock to a 1kg lump hammer:

Youtube Video

Undoing four exposed screws on the key box led to a blanking plate that Lodge was able to prise off (“it was only held in by silicon sealant”) and gain access to the internal electronics and the motor that drove the lock itself.

“A simple security review would have picked up the BLE replay issue, plus other potential issues. How was this missed?

Read More

About admin

Check Also

Blockchain: Atari’s Vaporware Console Is Getting Blockchain-Based Games

Blockchain: Atari’s Vaporware Console Is Getting Blockchain-Based Games

Photo: UltraIn what is certain to be one of the least promising moves in console gaming in 2020, Atari has partnered with a company called Ultra Gaming to offer blockchain-based game streaming to its forthcoming VCS console.The fabled Atari VCS has long been a bit of fun vaporware that is currently suffering from shipping issues…

Leave a Reply

Your email address will not be published. Required fields are marked *