Csw2016 song li-smart_wars
-
Upload
cansecwest -
Category
Internet
-
view
1.295 -
download
0
Transcript of Csw2016 song li-smart_wars
![Page 2: Csw2016 song li-smart_wars](https://reader037.fdocuments.in/reader037/viewer/2022093018/5881159a1a28abb9388b4a59/html5/thumbnails/2.jpg)
KevoSmartLock�
• BluetoothLowEnergy(BLE)interface.• Whensomeonetouchesthedeadbolt,KevosmartlockwilltrytotalktoBLEdevices.
• TalkstoBLE-enabledsmartphones,iPhone4Sandlatermodels,manyAndroidphoneswithBLEenabled.
• TalkstokeyfobwhichisBLE-enabled.• Ifdeviceisaround,unlock. �
![Page 3: Csw2016 song li-smart_wars](https://reader037.fdocuments.in/reader037/viewer/2022093018/5881159a1a28abb9388b4a59/html5/thumbnails/3.jpg)
DEMO �
• AbriefdemoofhowKevosmartlockworks �
![Page 4: Csw2016 song li-smart_wars](https://reader037.fdocuments.in/reader037/viewer/2022093018/5881159a1a28abb9388b4a59/html5/thumbnails/4.jpg)
DOSAPack�
• BLEprotocolhasbroadcasQngmodeandothermodesthatarepoint-to-point– Theconceptofbind– Similartopair,lessauthenQcaQon,requiresnopasswordtobind
• Unfortunately,Kevosmartlockworksonp2pmode
• UseaBLE-enabledsmartphonetobindwithfobbeforeittalkstothelock�
![Page 5: Csw2016 song li-smart_wars](https://reader037.fdocuments.in/reader037/viewer/2022093018/5881159a1a28abb9388b4a59/html5/thumbnails/5.jpg)
ConvincingtheLocktoWorkforYou(1) �
• Kevofobsmartfeatures– Itsgyrosensordetectsifitisbeingcarriedaround.– IfnomoQondetected,thefobshutsdownradiowithinaminute
– ThebaPerywilllastlonger– Fobisoffwhenownerishomeasleep,aPackerswon’tbeabletounlockthesmartlock�
![Page 6: Csw2016 song li-smart_wars](https://reader037.fdocuments.in/reader037/viewer/2022093018/5881159a1a28abb9388b4a59/html5/thumbnails/6.jpg)
ConvincingtheLocktoWorkforYou(2) �
• Whenfobisboundwithadevice,itwillNOTshutdownradio
• EvenifthegyrosensordetectsnomoQon• Whenfobisunbound,ittakesaboutoneminutebeforeshutsdownradio
• Duringthiswindow,aPackercantouchthedeadboltandunlock,whileownerisasleep �
![Page 7: Csw2016 song li-smart_wars](https://reader037.fdocuments.in/reader037/viewer/2022093018/5881159a1a28abb9388b4a59/html5/thumbnails/7.jpg)
DEMO �
• YoutubevideoofaPacks• Finditonourblog:blog.newskysecurity.com�
![Page 8: Csw2016 song li-smart_wars](https://reader037.fdocuments.in/reader037/viewer/2022093018/5881159a1a28abb9388b4a59/html5/thumbnails/8.jpg)
Timeline �• OrderedKevoSmartLockinSept.2015• DOSaPacksuccessful15minutesa]erfirstpoweron
• Keep-awakeaPacksuccessfulthenextday–mostoftheQmespentonreadinguser’smanual
• ContactedKevowithaPackdetails• KevorespondedwithdetailsandcorrecQons,focusingontherequirementofexternaldoors
• RepeatedexperimentonadoorthatmetKevo’srequirement
![Page 9: Csw2016 song li-smart_wars](https://reader037.fdocuments.in/reader037/viewer/2022093018/5881159a1a28abb9388b4a59/html5/thumbnails/9.jpg)
PossibleFixes�
• AddaphysicalbuPontothefob.• UsebroadcasQngmodeinsteadofp2pmode• Donotusefob,alwaysusephone+app,soastoachievemoresophisQcatedcommunicaQon– Augustsmartlockusesthisapproach,anaPackingsmartphonewillbeignored.
![Page 10: Csw2016 song li-smart_wars](https://reader037.fdocuments.in/reader037/viewer/2022093018/5881159a1a28abb9388b4a59/html5/thumbnails/10.jpg)
Breakinglocks,thephysicalway
• DemoVideo