Eletronic Protocol Realized?

[PickAxe187]

I saw there was thread quite a while back, that discussed the possibility of bluetooth enabled locks. Well, fast-forward about three years and its almost here. Unikey off-shoot Kevo has developed "Uni-Key-powered door lock allows you to open the lock simply by touching it when you're carrying a UniKey-enabled smartphone or an included key fob. The technology also lets you assign access to others who have a UniKey-compatible smartphone." Currently the lock will only work with the latest incarnations of iOs, though they would like to expand to Android in the future. What do you think a security convenience or liability? I think this is feigned security, this lock is a standard tumbler lock, nothing very special about it. Perhaps if the lock itself wasn't capable of using a key it would be more secure, but if you can you use a key doesn't that mean it can be picked?

[PickAxe187]

Here's a link to the article.
http://reviews.cnet.com/8301-17889_7-57 ... s-as-kevo/

[mh]

It's nice and convenient, but not about security.

[mh]

This is UniKey's idea about the required security (from UniKey.com):

--------
We do not only rely on the built-in encryption available in Bluetooth. All the encryption / decryption algorithms that we implement are well known and conform to known standards. These multiple military grade encryptions each remain uncompromised. Attempts have been made to break into these well-known algorithms over the years by the cryptographic community without any success. Most importantly please remember that your security is only as good as its weakest point and the UniKey system is not that point. Anyone wanting to gain unauthorized access to your home will have better luck with another attempted method of entry.
--------

[bobhdus]

Its a neat concept but too bad it's not available with a standard plug/lock pinning (with pick or bump resistant pins) or different keyways. The Kwikset smartkey design is not really known as being a hard lock to get open and in some cases the home owner may never know their lock was defeated...

[bjornnrojb]

It is probable that one can replace the lock cylinder as long as the cylinder has a standard tailpiece. It would only cost about $8 for an SC4 cylinder from GMS to put in there (assuming it wouldn't be too long...)

[nothumbs]

This lock looks remarkably insecure.

http://reviews.cnet.com/8301-9788_7-57610253/can-you-really-crack-the-kwikset-kevo/

[C locked]

That lock is designed for convenience. And generally. Convenience means fail-safe. And fail-safe is insecure.
...eg $35 digital code safe with key override. Built for convenience. Opened by 3yo's.
...back to lock. it combines the worst elements of the pin tumbler lock cylinder. And the worst elements of the bluetooth protocal..

[MBI]

This lock looks remarkably insecure.

http://reviews.cnet.com/8301-9788_7-57610253/can-you-really-crack-the-kwikset-kevo/

Physically yes, it suffers from all the physical weaknesses that the regular SmartKey locks have.
I'm just curious how long it takes for someone to fully PWN the bluetooth side of it, given how many vulnerabilities there seem to be in bluetooth.

I don't know enough about the subject to know if this is even theoretically possible, but wouldn't it be tragic on so many levels if someone made a downloadable android app that allowed anyone with an android tablet or smartphone to walk up to any KEVO lock with no advanced info or packet sniffing, and just walk right in.

[Achyfellow]

This lock looks remarkably insecure.

http://reviews.cnet.com/8301-9788_7-57610253/can-you-really-crack-the-kwikset-kevo/

Physically yes, it suffers from all the physical weaknesses that the regular SmartKey locks have.
I'm just curious how long it takes for someone to fully PWN the bluetooth side of it, given how many vulnerabilities there seem to be in bluetooth.

I don't know enough about the subject to know if this is even theoretically possible, but wouldn't it be tragic on so many levels if someone made a downloadable android app that allowed anyone with an android tablet or smartphone to walk up to any KEVO lock with no advanced info or packet sniffing, and just walk right in.

Just wait, something like that is bound to happen

[mechanical_nightmare]

The price tag is outrageous:

http://www.homedepot.com/p/t/204379769?cm_sp=D25T-_-plp_banner-_-TH-_-kwikset_kevo#customer_reviews

$219 for a deadbolt which can be picked without much trouble? Plus I don't see how this cylinder would be resistant to a variety of destructive attacks, which are the most common methods for illegal entry...

Security Snobs has Abloy Protec's for similar (if not lower) prices, and they provide much higher security. I would rather spend $260 on a EVVA MCS than $219 on a Kwikset Kevo any day.

[mechanical_nightmare]

To correct my earlier post, it appears the Kwikset Smartkey has a sidebar, and hence has increased pick resistance. Still, from what I can see, resistance against destructive attacks seems quite low, in addition to the possible electronic deficincies identified earlier.

it combines the worst elements of the pin tumbler lock cylinder. And the worst elements of the bluetooth protocal..

I couldn't agree more...

[GWiens2001]

The price tag is outrageous:

Security Snobs has Abloy Protec's for similar (if not lower) prices, and they provide much higher security. I would rather spend $260 on a EVVA MCS than $219 on a Kwikset Kevo any day.

I can not believe that you actually used EVVA MCS and Kwikset in the same sentence. Isn't that reason for banishment?

Yes, there is no excuse for that kind of pricetag for a garbage lock.

Gordon

[ckc123]

I don't know enough about the subject to know if this is even theoretically possible, but wouldn't it be tragic on so many levels if someone made a downloadable android app that allowed anyone with an android tablet or smartphone to walk up to any KEVO lock with no advanced info or packet sniffing, and just walk right in.

Physical security issues with the smartset locks aside..

just because a device has bluetooth does not mean it will open the lock.. bluetooth is just the protocol it is using to transfer encrypted data between the lock and the phone..

same with the packet sniffing.. you can't just reply an encrypted transmission and hope to get the same results as before.

There are several common ways the encryption is handled, and you have to separate how you encrypt the data, from what is encrypted.. you have to know BOTH. to fake a message. quite often the "what" is not a repeating value, so you can't just replay the same data from before.. something even as simple as an incremental number being encrypted each time it's sent prevents this.. this is common for system passing encrypted data.. they use the time/data or a sequence in the data so they can detect "replayed" data. plus when you have an ack/nack protocol, once the lock responsed that it have acted on the received data, it knows the device acknowledged that the previous data was received and acted on so it can't be replayed at a future date.

[teamstarlet]

You make some good points there ckc123

It's a pity that these companies have great ideas yet fail to take care of the basics...

I wonder if you could disassemble the unit and place a different cylinder in it?