Tech Made Simple

Hot Topics: How to Fix Bluetooth Pairing Problems | Complete Guide to Facebook Privacy | How to Block Spam Calls | Snapchat Symbol Meaning

We may earn commissions when you buy from links on our site. Why you can trust us.

author photo

Hackers Can Remotely Unlock Smart Locks

by Elmer Montejo on May 03, 2016

Smart lock with phone

Internet-connected smart home fixtures and appliances that you can control on your mobile device have a lot of appeal — until a stranger from another country or next door unlocks your smart lock or sets off the fire alarm.

Security researchers from the University of Michigan found that they could do exactly those and more when they tested the Samsung SmartThings platform. SmartThings is a  platform for networking smart locks, thermostats, appliances and security systems for the home. Their research uncovered some of the Samsung smart home platform’s weakest spots that can be used by malicious hackers to remotely attack and take over your system. Once that happens, malicious hackers can do pretty much everything that you can do — including unlocking your door from anywhere.

Other attacks that the researchers carried out include texting a smart lock’s PIN code after it was retrieved by a malicious app, disabling preset modes and triggering false fire alarms. The worst of them all, however, was the attack that enabled the hackers to remotely open a connected smart lock by forcibly injecting a PIN via a system backdoor, giving the hackers prolonged and undetected access to the attack subject’s home. For this, the researchers took advantage of vulnerabilities in an undisclosed app in the SmartThings app repository.

Two flaws in SmartThings’ design enabled the researchers to succeed in hacking into the system. They said that the SmartThings’ framework allowed for over-privileging of apps. That is, even an app whose sole function is to lock and unlock doors gets more privileges than it actually needs. Further, the SmartThings app was developed using the Groovy programming language, which made code injection easy for the researchers. The researchers found that, at the time the research was conducted, more than half of the 499 available SmartApps were over-privileged and that 42 percent of the apps were given unnecessary privileges.

What’s worse is that the holes cannot be easily plugged because they have been baked into the SmartThings framework itself. So, the researchers advised consumers to be prudent when using SmartThings for connecting smart locks and other smart home devices crucial to security and privacy. They feel the system’s vulnerabilities can expose a home to harmful attacks, including theft, break-ins, vandalism and misinformation.

So what should you do to ensure the safety of your smart lock? For now, if you have a smart lock connected to the SmartThings platform, unlink it until the security holes have been plugged. Used in a stand-alone mode with its own smartphone app, it won't be vulnerable to the type of attack like the researchers were able to perform. 

For smart lock owners in general? We'd recommend keeping your lock functionality separate from your smart home system. Only use it within the security system and apps that have been designed to keep your home safe. 

For more in-depth information about the study, see the paper that the security researchers will be presenting at the upcoming IEEE Symposium on Security and Privacy.

[Image credit: smart house, home automation, device with app icons via Shutterstock]


Home Safety & Security, News, Automation Systems, Blog

Discussion loading


From David K on May 06, 2016 :: 10:20 am

This is a terrible thing in our life. I agree that smart-home and the accessories would be good to turn our life into easier and comfortable. But if it’s unsafe and hackers are easy to break door lock, we may consider to use or not.


Home | About | Meet the Team | Contact Us
Media Kit | Newsletter Sponsorships | Licensing & Permissions
Accessibility Statement
Terms of Use | Privacy & Cookie Policy

Techlicious participates in affiliate programs, including the Amazon Services LLC Associates Program, which provide a small commission from some, but not all, of the "click-thru to buy" links contained in our articles. These click-thru links are determined after the article has been written, based on price and product availability — the commissions do not impact our choice of recommended product, nor the price you pay. When you use these links, you help support our ongoing editorial mission to provide you with the best product recommendations.

© Techlicious LLC.