Smart locks are a popular and convenient way to secure homes and businesses. With the ability to control and monitor access remotely, these locks have quickly become a must-have for anyone looking to upgrade their security system.
However, with any technology that connects to the internet, there is always a risk of being hacked.
In this article, we explore the question can smart locks be hacked, and what steps you can take to ensure the security of your home or business. We examine the potential vulnerabilities of smart locks, the methods hackers could use to gain access, and the steps you can take to protect yourself from these threats.
Can Smart Locks Be Hacked?
Smart locks that are connected to a Wi-Fi network can potentially be hacked. But as long as you have some basic precautions in place (more about that below) it would be easier to pick the lock on a traditional door-lock.
While some people do get worked up about security issues with smart locks, the simple fact is that if someone really wants to get into your house, the easiest way by far is to simply smash a window.
Having said that, let’s look at some of the ways smart locks can potentially be hacked.
Bluetooth sniffing
A Bluetooth sniffer is a device used by Bluetooth developers to debug problems with the connection and data transfer between the peripheral and central devices.
While Bluetooth sniffers have a perfectly legitimate use, they can also be used by hackers to discover passwords.
Digital security specialist Anthony Rose walked around his neighborhood with a Bluetooth sniffer. To his horror, he found plain text passwords freely transmitted via Bluetooth. Anyone with the same tool could see the passwords for these smart locks.
Device spoofing
Device spoofing is a technique where a hacker uses a tool that imitates a device on the network.
By impersonating a device on the network, the hacker is able to trick the network into sending them the password for the smart lock.
Replay attacks
Replay attacks take a slightly different approach. Instead of trying to get an unencrypted password, in a replay attack, the hacker simply captures the encrypted information as it was transmitted.
They then play it back to the smart lock, and voila, the lock is open.
Fuzzing
Fuzzing is a technique used in programming and software development. It uses automated software to send invalid, unexpected, or random data to a computer program.
When used on smart locks, this can eventually cause the lock to enter an error state. The vulnerability here is that some of the cheaper smart locks are designed to unlock themselves when they enter an error state.
Decompiling APK files
APK files are used to install and run application software on Android operating systems.
A hacker can use an APK decompiler, such as Apktool, to obtain passwords and account information. This could potentially allow a hacker to access your smart lock password.
WiFi breaching
WiFi networks can potentially be hacked. Hackers can use a technique called DNS (Domain Name Server) hijacking to gain access to your WiFi network.
Five Ways To Prevent Your Smart Lock from Being Hacked
As we have seen, smart locks are potentially hackable, and there are various techniques hackers can use to compromise your smart lock.
But there are also things you can do that make it very difficult for your smart lock to be hacked.
#1. Use two-factor authentication
One way to make it virtually impossible to be hacked is to use a smart lock with two-factor authentication.
Two-factor authentication uses two factors to authenticate: something you have and something you know. Examples would be your smartphone + password or a fob + password.
Smart locks that use two-factor authentication include:
#2. Use 128-bit encryption
128-bit AES encryption conceals plaintext data using an AES (Advanced Encryption Standard) key length of 128 bits.
It uses 10 transformation rounds to convert plaintext into ciphertext and is approved by the National Security Agency (NSA) to protect secret (but not top-secret) government information.
With 128-bit encryption, even if someone hacked your Bluetooth signal, they still wouldn’t get access to your password.
Here are some smart locks that use 128-bit encryption:
#3. Secure your WiFi network
Make sure your Wi-Fi network is secure and encrypted, and limit access to it by using a strong password and enabling network segmentation.
#4. Keep firmware up to date
Smart lock manufacturers constantly release updates to their firmware, to make their smart locks ever more secure. Make sure that your smart lock is automatically downloading the maker’s latest software.
You should be able to check on the status of this in the smart lock’s app.
#5. Only buy well-known and trusted brands
Finally, only buy smart locks from well-known and well-reviewed brands. These are some of the best-known smart lock brands:
- Ultraloq
- Eufy
- August
- Kwikset
- Level
- Wyze
- Yale
- Schlage
- Lockly
Conclusion
Can smart locks be hacked? Yes, they can. But as long as you follow some basic precautions, your house will be just as secure with a smart lock as it was with an old-school keyed lock.
And it might even be more secure, given that you will never again leave the key under the doormat!