Security evaluation of smart door locks

Smart locks are a part of the up and rising Internet of Things (IoT). They’re used as a complement to traditional locks in order to make it easier to share keys electronically, rather than physically. Smart door locks are mounted on a existing door and enables users to control the state of the lock with their smartphone. In this report we want to investigate if previous acknowledged attacks on smart locks still exists in today’s available locks for the Swedish market. By studying previous work and conduct a threat model, we create attacks to apply on the locks in order to answer what deficiencies exist in smart door locks today. The results conclude that there are several deficiencies in today’s smart locks, where the most severe has been reported under responsible disclosure to the manufacturer. The locks investigated shows vulnerabilities in state con- sistency, password policies and password reset mechanism. Background......Page 8 Delimitations......Page 9 Ethics and laws......Page 10 Physical design of smart locks......Page 12 Architecture of smart locks......Page 13 User levels......Page 14 State consistency attack......Page 15 Overprivilege attacks......Page 16 Storage attacks......Page 17 Command fuzzing......Page 18 Brute forcing......Page 19 Man-In-The-Middle attacks......Page 20 Other attacks......Page 21 Threat modeling smart locks......Page 22 Assets......Page 23 Potential adversaries......Page 25 Attack surfaces......Page 26 Threat model and STRIDE......Page 28 Attacks......Page 35 Brute force attack......Page 36 Selection of smart locks......Page 38 Lab environment......Page 41 Adding an already registered lock to a second account......Page 42 Evade the revocation from a time limited account......Page 46 Evade the revocation from a non-time limited account......Page 48 Log evading......Page 49 Account creation......Page 50 Password reset......Page 54 Elevation of privilege......Page 61 Adding an already registered lock to a second account......Page 63 Threat Model......Page 66 State consistency attack......Page 67 Brute force attack......Page 68 Man-in-the-middle-attack......Page 69 Conclusion......Page 70 Bibliography......Page 71