Cracking the Tapplock Smart Lock
pentestpartners.com
pentestpartners.com
Okay, fine, I'm just going to use it at the gym and not to secure my Aston Martin in the garden shed. Still, the key is generated from the openly-broadcasted BLE MAC? You know, there is a vast chasm between even the rookie security mistakes and "you should not be writing anything that requires even the smallest amount of security", a vast chasm between "oopsie" and "I didn't even know enough to know that I have to know that".
A hack will likely be practically impossible to detect afterwards and could even be made to look legitimate. Anyone in that gym locker room will believe I was the owner when I opened your lock and took your phone out.
However, a skilled lock picker will pick most locks very quickly anyway (but it will at least look suspicious).
Kivin_thibedeau presumed said bolt cutters do not fill a significant space in said garage with hardened superalloy jaws and hydraulic power system, and speculated on a common-enough material that could defeat any pair of manual bolt cutters that a typical person would be likely to keep in their garage.
Now we just need a security geek to point out that you don't need to cut the chain if you can defeat a weaker link in the security web. Example: lock bike to street sign post with uncuttable chain and uncrackable lock; bike thief unbolts sign, lifts bike and chain off post, and replaces sign.
The other kind are crackheads that just grab the bike and yank on it until the chain breaks or the bike does. There's a whole market for expensive bike locks that don't work against the first group and are overkill for the second.
The kind of bike thief that carries a wrench so they can unbolt the stop sign and then puts it back afterward doesn't exist. Plus they have to deal with a bike that still has an awkward bike lock hanging off of it.
Not picking on you, I just like telling this story :-)
In the mid 90's a couple I know went to a party on Manhattan's Upper West Side. When they came back to their car (a VW Golf) and opened the doors, wife said "what's all this stuff on the seat?" Then they noticed the stereo was gone.
The thief had broken the little quarter panel window and reached in to open the door. Then he carefully took the dashboard apart, neatly stacking the panel sections and screws on the front passenger seat, until he could remove the stereo and leave.
Besides the breaking of the tiny window, there was absolutely no damage to the car. This guy took his time and did a professional job. Talk about pride in your work :-)
This is given as an unhyperlinked throwaway comment, but my interest is piqued. Does anyone have a write up on this?
If you want high security, get a lock from a trusted brand (e.g. ABUS) with a thick hardened steel shackle.
If you want convenience (e.g. no key for a gym locker), get something like a WordLock: https://www.amazon.com/Wordlock-PL-056-SL-Combination-Sports...
No need to spend $100 on a lock to save yourself 2 seconds unlocking. Maybe I'm missing something, can anyone can think of a better use case?
Preferably not the one shown here[1]
I rent workshop space with several other people in a shared warehouse (think semi-private TechShop), and the previous two options are keys, which get lost and is one more thing to keep track of, or a combo lock, where the three numbers can be shared with friends, and in the end there's no way to know who has access unless the combo gets changed, plus it's something to forget. Having a Bluetooth enabled lock allows us to grant, but more importantly revoke access over the Internet.
The lock itself does not need Internet access via WiFi.