The BBC asked us to look into a range of IoT products.
One of them was a Pineworld lock, from Amazon.
We only had a day; I went for the quickest and most realistic attack.
One of them was a Pineworld lock, from Amazon.
We only had a day; I went for the quickest and most realistic attack.
The lock costs £139.99 - that& #39;s not cheap.
It looks quite nice. PIN, WiFi, RFID, and fingerprint? Wow.
That& #39;s a lot of electronic attack surface.
It looks quite nice. PIN, WiFi, RFID, and fingerprint? Wow.
That& #39;s a lot of electronic attack surface.
Now - it has some good features here.
The handle disconnects from the drive shaft using a clutch. That means that you can& #39;t simply force a lock, the handle just moves pointlessly.
The handle disconnects from the drive shaft using a clutch. That means that you can& #39;t simply force a lock, the handle just moves pointlessly.
It uses a motor and gearbox, as opposed to a solenoid. These are harder to attack with magnets.
It also uses non-magnetic components on critical parts.
It also uses non-magnetic components on critical parts.
But what& #39;s that silver bit at the bottom?
That& #39;s where the backup mechanical lock pushes up on to engage the clutch. It& #39;s inside the lock though, so what& #39;s the issue?
That& #39;s where the backup mechanical lock pushes up on to engage the clutch. It& #39;s inside the lock though, so what& #39;s the issue?
Well, this is the issue.
I can drill through the side of the die cast housing in 2 seconds.
It& #39;s not loud, and it doesn& #39;t need special tools.
I can drill through the side of the die cast housing in 2 seconds.
It& #39;s not loud, and it doesn& #39;t need special tools.
Realistically, that& #39;s 10s total. It& #39;s not at all hard.
Certainly below the level of security I would want on my front door.
Certainly below the level of security I would want on my front door.
Other thing... you need to know where to drill.
Which means you need to ID the lock, just from a keyhole. It& #39;s not trivial.
Which means you need to ID the lock, just from a keyhole. It& #39;s not trivial.
You need to watch out for these electronic locks. A lot of them have TERRIBLE physical security.
Nearly all of them can be drilled in a similar way. Most of them are physically weaker.
Just because it& #39;s electronic doesn& #39;t mean you get to ignore this.
Nearly all of them can be drilled in a similar way. Most of them are physically weaker.
Just because it& #39;s electronic doesn& #39;t mean you get to ignore this.
Most recent review on Amazon isn& #39;t exactly stellar.
It& #39;s also available as "ENER-J".