What are the security implications of phone based keyless entry systems?

Question

I have just been reading about Lockitron which promises to provide phone based keyless entry for the home. As great an idea as this sounds it strikes me that it could come along with some very serious security implications.

Their security page and FAQ tackle some of these issues but not anywhere near as in depth as I would have hoped.

My initial concerns would be:

• Ultimately I would be putting the key to my house in Lockitron's hands - with the added risk that these keys can be used remotely. If they were ever breached my house, and every other customer, could be too.
• It would appear that Lockitron runs over Wi-Fi so there is a possibility that anyone on my Wi-Fi could gain access to the device. What if I share it with my neighbour?
• If you took my phone (as, I imagine with many people's) it would be relatively simple to find out where I live.
• My smart phone can have vulnerabilities that can allow it to be hacked

So, what other dangers are there and will a smartphone based keyless entry system ever be secure enough for the average person? I can see this working well in an apartment block with a concierge but can this ever be safe enough to put on an unguarded front door?

Answer 1

The biggest issue I find there is that your insurance company will not like Lockitron at all. So expect a price rise; or, quite plausibly, if your house is broken into and there is a Lockitron in place, then it will be used as an excuse to not cover your losses. Even if the burglar used the very old-fashioned entry method known as big-stone-through-window.

For availability, you should not rely on a Lockitron to allow entry, because:

• Your Internet access might be down for some reason (including power outage).
• Your phone might be inoperative (crashed, stolen, or even an empty battery...).
• The Lockitron itself could be out of batteries (it is supposed to warn you in advance, but how reliable is this ? There is little available data).
• The Lockitron company might go bankrupt at some point (not that I wish them so, but it happens).
• The Lockitron servers could have some downtime.

So you should still have a physical, old style metal key in your pocket, if you want reasonable guarantees that you will be able to enter your home every night. Especially stormy nights, the kind of time when power or network outages are rather common, and you really do not want to spend the night without a roof over your head. The added value of Lockitron is not there (especially since a key is quite small compared to a smartphone); the potentially interesting part is in making it possible to remotely unlock the door. This is not a scenario which happens every day... which is a problem: if the device is not that useful, how will the company maintain financial buoyancy ?

Of course, Lockitron inherently obtains the power to open all locks. They promise that:

1. they are not evil;
2. they will not be hacked.

Both promises are somewhat empty, when you come down to it. Claiming "I am not evil" is what most evil people do; merely stating it does not inherently make it true (if you believe otherwise, and you are a US citizen, then rejoice! You will soon have an electorate choice between two non-evil candidates). For the non-hacking, well, it all depends on how competent the Lockitron people are, and also on a fair amount of luck.

And then there is the whole customization part. Lockitron says that the device can be extended in a whole lot of ways, with a rich API. When I read that, I think "exploitable security holes". The more complex a system is, the more probable security holes are. The device already does WiFi and Bluetooth, so it must contain a substantial amount of software. It might be not as hackable as your phone, but still...

On the positive side, Lockitron-like systems would be convenient for emergency services like firemen and medics (well, at least medics: a fireman's ax is remarkably effective at gaining entry almost everywhere). Assuming that they obtain a generic entry authorization, of course (which would itself be a security risk).

Answer 2

Any security solution in which user assets are controlled by a central server is flawed. User assets should be controlled only by the user.

A better way to do this would be for the phone to hold a secret key encrypted with a password. The home security system would issue a random challenge to the phone over NFC which the phone would need both the password and the secret key to respond to. This would give two-factor authentication (password = what you know, secret key = what you have) and, if done correctly, should be secure.

Answer 3

If Lockitron requires all access requires a connection to their servers and there is a significant widespread natural disaster in your area (hurricane, earthquake) then all of the cell towers around you may be down for a while - and that's a terrible time to be locked out of your house or forced to break in

On the other hand if Lockitron allows access from a cached set of credentials and there's a working JTAG port on your phone (most likely is), there isn't much of a challenge for someone to use it to get in - passwords, etc aren't going to do you any good at all