P****D
发帖数: 11146 | 1 无意中看到的，转过来大家晴天霹雳一下：
http://www.wired.com/threatlevel/2013/08/kwikset-smarkey-lock-v
Millions of Kwikset Smartkey Locks Vulnerable to Hacking, Say Researchers
By Kim Zetter
08.03.13
6:30 AM
LAS VEGAS – Locks that are used in millions of homes and residential
buildings worldwide and that are designed specifically to thwart hacking are
easily opened with both a screwdriver and wire, two researchers say.
Kwikset smartkey locks are certified Grade 1 security for residential use by
the Builders Hardware Manufacturers Association and are advertised by
Kwikset as being invulnerable to being hacked with wires, screwdrivers, or
anything else inserted in the keyway.
But that’s not the case, as two noted lock hackers, Marc Weber Tobias and
Toby Bluzmanis, demonstrated for WIRED and plan to show attendees today at
the Def Con hacker conference.
Tobias and Bluzmanis have been cracking locks at Def Con for years,
demonstrating the ability to defeat high-security electronic locks used at
the White House and other government offices, electro-mechanical locks,
deadbolts, and even electronic safes used by millions of consumers.
But the Kwikset smartkey locks, which Kwikset introduced in 2008, have the
widest distribution of any locks they’ve tested — Kwikset sells more than
20 million a year. The locks cost between $20-$40 and come with several
features that make them appealing — the main one being a reprogrammable
cylinder that gives owners the ability to reprogram the locks on the fly to
any key.
The latter feature can be used by apartment managers to change a door lock
after a resident vacates a unit or a building manager is terminated, without
having to swap out the actual lock or call a locksmith. It can also be used
by homeowners to provide temporary access to construction workers,
gardeners or someone else who needs to gain entry for a certain time period,
after which the locks can be changed back to fit the original key.
But the researchers say the lock design is inherently insecure. The locks
can’t be bumped, but they can be cracked in other ways.
“It’s very clever because the consumer can instantly reprogram the key,
but it’s also insecure,” Tobias says. “There’s a lot of positives for
Kwikset, but the problem is they can be opened in 15 seconds with a
screwdriver and a paper clip. It’s not a pin-tumbler lock so that it doesn
’t have the inherent physical strength to block the plug from turning when
you do certain things.”
He and Bluzmanis developed a number of techniques to compromise the locks,
including one that lets them thwart it with a four-inch screwdriver and
torque wrench, and another that lets them crack the lock just as easily with
a wire.
Tobias says the BHMA rating is misleading to consumers, fooling them into
believing the locks are secure when they aren’t. He filed a formal
complaint with the BHMA two years ago, but says the standards body has
ignored it. The standard requires that a lock like this can withstand 300
pound inches of torque, but the researchers say they used much less than
this to open the locks.
Kwikset did not respond to requests for comment from WIRED, but Tobias, in
phone calls to technical support for Kwikset, was told repeatedly that the
locks were impervious to screwdrivers or wires, and that a screwdriver
wouldn’t even fit in the keyway.
“With these ones you cannot even put a flat screwdriver in there,” a
technician named Satima on the company’s support line told him during a
recent phone call, which Tobias recorded. “There’s racks from up and down
direction, not just up” that make it impossible to align the springs in the
lock, she said. “There’s no tool that you can just put in the cylinder
and pop it open. You can’t put any type of wire or anything like that.”
Another technician told him, “If it was that easy to pick a Kwikset lock,
they would be having us doing recalls, [but] there’s nothing like that. It
’s business as usual.” Without the key, there’s no way to open the locks,
the technician asserted, and “sticking anything foreign inside of the
keyway is just going to make it that much harder to open up.”
The smartkey is a five-pin lock and has 6 depth increments (the height and
depth of the mountains and valleys on a key). It can be reprogrammed by
placing the original key in the lock and inserting a tool into a slot in the
lock face, which moves the assembly back about an eight of an inch and
separates the pins and slider and holds them apart while a new key is
inserted. The lock then registers the impressions on the new key and resets
the relationship between the pins and slider to correspond to the new key.
They demonstrated six different ways of defeating the locks, including
inserting a piece of blank with a sharp end into the keyway then, using a
hammer, punch out the cap on the back of the plug — a thin piece of metal.
Then they inserted a wire with a looped end into the keyway to turn the
tailpiece, which rotates independently of the plug, making a key irrelevant.
The method works in just 30 seconds and leaves no damage and no trace,
since the original key still works in the locks.
In a second attack, Bluzmanis inserted a 4-inch screwdriver into the keyway,
grasped it with a wrench and turned it to open the lock in just 15 seconds.
According to the standard, the lock should be able to withstand 300 pounds-
force-inch of torque, but they used only a little more than 100 pounds-force
-inch to open the lock.
Another attack involved decoding the lock by using a series of keys that are
a single depth to determine the depth of each of the pins inside the lock. | T*******i
发帖数: 4442 | |
|
