'Smart' Lock Vendor Locks Hundreds Out Of Their Home With Bungled Firmware Update
from the sorry-I-can't-do-that,-Dave dept
So we've talked repeatedly about how the real "smart" choice in the era of "smart" internet of things devices is often -- dumber technology. Whether it's your smart refrigerator or TV leaking your gmail details or viewing data over unencrypted connections, your smart car opening the door to potentially fatal attack, or your smart doorbell creating new attack vectors into your WiFi network, more often than not you're quite frankly better off with the older, less sophisticated versions of these technologies if you want the smart path toward a more secure life.
The latest case in point: smart door lock vendor Lockstate managed to completely disable the smart door locks of an estimated 500 customers after a botched firmware update left customers unable to access their own properties:
A subset of smart locks made by Lockstate have been bricked after an update. The smart lock vendor is part of Airbnb’s Host Assist program, and integrates with the accommodation rental platform so, for instance, hosts can automatically generate and email one-time codes for their guests to use during check-in....Two models of Lockstate smart lock are apparently affected, one of which currently retails for $469.
Airbnb offers property owners a $50 discount code if they use Lockstate products as part of the Host Assist program — where said products are heralded as “revolutionary” and capable of withstanding “high usage”. Because the botched update made it impossible for these locks to subsequently connect to the internet for a new fix, the vendor is informing owners that their only recourse is to wait anywhere from a week to eighteen days for a physical replacement, inundating them with neither smart nor revolutionary added costs:
In the mass mailer email, which begins “Dear Lockstate customer” and summarizes its contents as an “update” pertaining to LockState 6i/6000i, affected customers are asked to wait as long as 18 days for a full replacement. Or up to a week if they choose to remove and send the back portion of the lock to the company for repair.
Feel smarter yet? Of course this isn't the first problem of this type. Internet of things brand darling Nest has, at several different points, botched their own firmware updates for supposedly smart thermostats, resulting in users either being cooked or chilled until they were able to remedy the problem. This is the kind of stuff internet of things evangelists still don't spend much time talking about when they're busy hyping and pitching the latest and greatest internet-connected widgets, built by a rotating crop of companies with a fleeting interest in actual security, functionality and privacy.
Granted bungled firmware updates are only one risk. A recent report took a look at sixteen different brands of Bluetooth-enabled smart locks, and found that at least twelve of the brands were notably susceptible to remote attacks. The flaws are fairly standard at this point, ranging from user data and passwords being transmitted in plain text, or a bungled use of encryption to transmit user data when encryption was used at all. Short version of the lesson: if you're trying to build a smart home either do your homework and consult a hacker to find the best quality devices available, or save both time and money and revert to the best available dumb alternative.
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Filed Under: internet of things, iot, smart lock
Companies: airbnb, lockstate
Reader Comments
Subscribe: RSS
View by: Time | Thread
[ link to this | view in thread ]
Re:
[ link to this | view in thread ]
At some point, we are all going to end up with Jigsaw-style traps for home security. That said: I would rather take on the Reverse Bear Trap instead of the Internet of Things.
[ link to this | view in thread ]
[ link to this | view in thread ]
New Advertising Campaign from LockSmiths Union
[ link to this | view in thread ]
Re: Re:
[ link to this | view in thread ]
Re:
The better bet is to get a solid wood or metal door and actually put a decent lock on it (say a Mul-T-Lock or an Abloy disc detainer, not your typical home cheapo garbage). There is 0 need to introduce the Internet of Trash into your home security system.
[ link to this | view in thread ]
20 Minutes into the Future...
[ link to this | view in thread ]
I'm very wary with over the air firmware updates. I'm not sure if it's just paranoia or if I'm rightly worried.
[ link to this | view in thread ]
[ link to this | view in thread ]
Re:
The government is not trying to weaken encryption so it can read your messages.
The government would never try to weaken smart locks so it can get into your home.
[ link to this | view in thread ]
Can Smart Locks ever be a good idea?
My smart lock, for example, should be under MY control as equally as a dumb lock is under my control. It does not and cannot obey some internet cloud connected mother ship.
Similarly for all other modern devices that get embedded microcontrollers. If the owner purchaser consumer cannot fully control them, then they are a bad idea.
Now what does this say about modern PCs which you cannot fully control? With back doors literally baked into the microprocessor.
[ link to this | view in thread ]
Smart devices?
[ link to this | view in thread ]
Re:
[ link to this | view in thread ]
Re: Re: Re:
I know, they should just give up because ... wait, why should they do that?
[ link to this | view in thread ]
Re: Re:
[ link to this | view in thread ]
Re: Re:
I like it
[ link to this | view in thread ]
Re: Re:
[ link to this | view in thread ]
Re:
[ link to this | view in thread ]
Terrible response
The company said it would take 5-7 days to ship the lock for repair and get it back, or 14-18 days to have a new lock shipped. Why is the second amount so much larger? Are they just trying to avoid paying for new locks, or do they really have no stock?
The proper response would be to send new locks right away with 24-hour shipping, and a prepaid box to return the old one. If they run out of locks, they should be sending their employees to hardware stores to buy more, or even paying for the broken locks so they can reflash and send them out.
This quote was bullshit too: "Owners were not stranded with a non-working lock. This keypad lock comes with an emergency set of keys that can be used in case of emergency." That's great if the owner is the one trying to use the lock, and the owner has the keys on them at the time (i.e., not in a box inside the locked house). If it's the owners kid who's locked out, or their Airbnb guests, those people are still screwed.
[ link to this | view in thread ]
Re: Re:
People running short-term rentals (like Airbnb) from out of town really do need something other than a key they carry. They could use a lock-box with combination instead, but anyone who's stayed there would know the combination (until the owner could go physically go there and change it), and there's always a risk someone would copy the key or not return it.
The proper solution, of course, is to stop being cheap and hire a local person to manage it and give out and replace keys, or change combinations, as needed (and clean and inspect before guests arrive).
People not renting out to strangers can simply buy some non-internet-connected combination lock or lockbox, if they or their family don't want to carry keys. (Except that pushbutton door locks, whether "smart" or not, have pretty terrible security records.)
[ link to this | view in thread ]
[ link to this | view in thread ]
[ link to this | view in thread ]
Re: Re:
The government would never try to weaken smart locks so they can get into your home. They will however promote and push for smart locks having a code for emergency responders to unlock your door in the event you need to call 911 to your home for something.
Naturally access to such a code would be carefully controlled. It would never be stolen or misused. However just in case of the unlikely event that happened, all uses of the code would of course be logged by the locks. Plus since they're building in some logging ability anyways, the locks would log all usage of the door so the homeowner had the option of knowing people's comings and goings. For the homeowner's convenience, those logs would of course be stored "in the cloud".
[ link to this | view in thread ]
[ link to this | view in thread ]
Re:
[ link to this | view in thread ]
Re: Re: Re:
[ link to this | view in thread ]
So previously you have ordinary wear and tear, the possibility of a manufacturer defect and now let's add "smart fail".
Some things are just better off dumb... no matter how cool it seems be able to turn on your electric toothbrush or check your coffeemaker's emotional status from halfway across the planet, you are just adding more vectors for failure and frustration.
[ link to this | view in thread ]
Re: Smart devices?
A really oversensitive version that's prone to violent breaks with reality.
[ link to this | view in thread ]
Re:
But writing secure and robust software before releasing a product is hard!
I'd love to see firmware for stuff like this come with an algorithmic proof of correctness, but startup culture isn't going to give us that.
[ link to this | view in thread ]
Re: Re: Re:
[ link to this | view in thread ]
Re: Re:
[ link to this | view in thread ]
Re: Terrible response
Or... perhaps they also bricked their entire factory stock at the same time?
Also, the bricked locks were the previous generation of lock, so since they've moved on to a new model, that would mean less of the old one.
[ link to this | view in thread ]
Re: Re: Re:
I'm guessing it's why they are a thorn in several prominent sides.
[ link to this | view in thread ]
Re: Re:
I"m struggling to think why a door lock should ever need downtime because that seems to me highly dangerous and a recipe for disaster. It's sod's law that you'll need your lock to open (FIRE!) just when it's having some me time.
[ link to this | view in thread ]
Testing, Testing, One, Two, Three
Looks like the old school way of doing things came about due to that annoying thing called experience.
[ link to this | view in thread ]
Re: Re:
Devices that are connected to the internet but don't update automatically... typically won't be updated, and so security flaws that are discovered over time don't get fixed over time, leading to IoT devices that are happy to participate in distributed attacks of some nature.
The ability to create limited-time codes to access the property seems like a perfect fit for the AirBNB or similar model, so I'd say that this is far less of a pink elephant than most internet-connected devices. If it provides access audits per code, then homeowners could determine that the cleaners did or didn't access the property at times when they were supposed to, amongst other simple conveniences. This sounds to me like a genuinely useful device.
Internet-facing security would of course have to be bullet-proof and upgradeable. Maybe the simple fix would have been for firmware upgrades to be pushed by the device owner rather than the device manufacturer, with escalating warnings over time from the manufacturer if devices are left without upgrade perhaps resulting in a loss of warranty (support? Warranty is probably a legal thing) if a device hasn't received an update flagged as security for more than (say) 3 months.
At least if the owner is doing the upgrade, and it fails, they are aware of the failure *at that moment* and so can respond to it at the time. I fail to have much sympathy for owners for whom this approach would be too hard because they own too many properties.
[ link to this | view in thread ]
FipiLock Smart Fingerprint Padlock
FipiLock Smart Fingerprint Padlock: https://idiotbuy.com/fipilock-smart-fingerprint-padlock/
[ link to this | view in thread ]