Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Tapplock IoT padlock has multiple security vulnerabilities

nakedsecurity.sophos.com

Post reply on HN
Print view View original

51–60 of 102 posts

Re: The Tapplock IoT padlock has multiple security vulnerabilities

#51

Post by majewsky »

jon-wood wrote: post #39
ptx wrote: post #24

I wonder why the "message" field in the response says "API调用成功" ("API call succeeded", I think?) if this is a Canadian company. Did they just buy the locking solution from some Chinese OEM?

Yes, almost certainly. One of the IoT industry's dirty little secrets is that just about everyone is just rebadging OEM hardware from China, and often doing a minimum of due diligence on that hardware. (Disclaimer: I work for an IoT startup. We have an in-house security engineer, and contract pen testers who we call in to do physical and software tests against any new hardware we ship)

That's not a "Disclaimer", that's a "Source".

Re: The Tapplock IoT padlock has multiple security vulnerabilities

#53

Post by emblaegh »

nikanj wrote: post #33
hatsunearu wrote: post #2

Genuinely curious how people still manage to fuck up this kind of super basic secure coding practices

Silicon Valley prefers teams to have epic backstories, not experience. A first-year dropout from MIT and a Thiel fellow are much more likely to get funded than an engineer with a state uni BSc+25 years industry experience plus a former sales manager in the same industry.

If they had inexperienced developers, that's most likely because they're cheaper, not because they have an amazing narrative behind their backs.

Re: The Tapplock IoT padlock has multiple security vulnerabilities

#54

Post by maaark »

sschueller wrote: post #50

As mentioned in the article. Jerry Rig Everything did a review on this and found that you can just twist off the back...[1] [1] https://youtu.be/RxM55DNS9CE?t=3m39s

Taplock claim that was an exceptional unit and a spring loaded pin normally prevents this. Another researcher couldn't make it work.

Still fucked tho

Re: The Tapplock IoT padlock has multiple security vulnerabilities

#55

Post by function_seven »

thomasfedb wrote: post #21

Utterly horrifying, but ultimately irrelevant. No lock of this size is meant to be anything other than inconvenient to open. Angle grinders are cheap, and more easily wielded than HTTP request crafting.

Compare this to a decent padlock (with key).

If someone wants to get past my low-tech padlock, it will be inconvenient. They will have to spend some amount of time with either an angle grinder, bolt cutters, or lock picking tools. What they’re doing will be suspicious and will likely draw attention. If they’re caught during the trip to or away from my lock, the possession of any of these tools will be suspicious.

With this lock, all those weaknesses are the same. Expect now the lock-pick tools are replaced with an app, and there's nothing wonky at all about someone walking up to the lock, tapping on their phone, and removing it. If they're caught en route to or away from the location, they have nothing on them to incriminate.

This lock is strictly worse than a standard padlock, when it comes to security. All the flaws plus new ones.

Re: The Tapplock IoT padlock has multiple security vulnerabilities

#56

Post by air7 »

> You could easily sniff out account IDs because Tapplock was too lazy to use HTTPS.

SSL benefits are generally over-hyped IMO and might give a false sense of being 'Secure' as in this article where such an obviously flawed system receives "use SSL" as one of two recommendations.

The idea that unencrypted traffic allows any hacker to easily sniff it is wrong and misleading. The eavesdropper needs to be "close": In the same LAN as the target, or upstream of it, i.e on the same wifi (needs to be physically there, know/hack the wifi password and performing an ARP spoofing attack), or being/hacking the ISP itself.

Of course I'm not saying SSL shouldn't be used, only that it's a secondary security measure, like using a seat-belts vs having good breaks.

Re: The Tapplock IoT padlock has multiple security vulnerabilities

#57

Post by m4tthumphrey »

pedroaraujo wrote: post #11

I thought this was a blog post about the guy who simply unlocked the padlock using a GoPro mount ( https://www.youtube.com/watch?v=RxM55DNS9CE - the video is worth watching from the beginning) but this was more amusing than I was expecting. Nothing went right in the design of this padlock.

This is a lot more interesting; the lock itself is useless before we even get to the software issues.

Re: The Tapplock IoT padlock has multiple security vulnerabilities

#60

Post by est »

lnsru wrote: post #47
rapsey wrote: post #19

Earlier quoted context omitted.

IoT devices are generally built and programmed by electronic engineers. They have no knowledge about software security and neither do they care.

That’s wrong. An engineer has a couple managers above. Product, project, platform manager. You name it. Engineer is just another blue collar worker nowadays. No decision making power. I was not allowed to save company $40k, they told that numbers shouldn’t interest me. If management says, we need no encryption and authentifition, it’s totally ok. I just print their emails with this statement for later.

> Product, project, platform manager

you'd be surprised to learn how many pieces of code were designed, written and shipped by one man army.

Post reply on HN