Yahoo News Surprise: Amazon's smart lock system has a big flaw
Last month Amazon unveiled its Amazon Key service, a smartlock and security camera pairing designed to let delivery people into your house to drop off packages, but ONLY delivery people, and with full video footage for accountability.
If, despite the security measures, this system made you uncomfortable, you were right to be unnerved. Security researchers have now shown that the system can be exploited to let delivery people back into your house, unseen.
Ben Caudill of Rhino Security Labs discovered the vulnerability, which he demonstrates in a video. The trick, as reported by Wired, basically goes like this: a delivery person walks into your home, drops off a package, and leaves. Then, instead of locking the door with their app, they can issue commands to the camera via a laptop or other device, causing it to freeze footage on a single frame.
While the camera is frozen, they can reenter the home, move out of the camera's view, and restart it. While it will appear as though they have stepped outside and took a few seconds to initiate a lock, they are actually now in your home, free to do as they please and leave unseen through another exit.
Amazon said in a statement to Wired that it alerts users if their camera's feed is frozen for "an extended period" and that it will be issuing an update to help protect against the vulnerability. And, of course, a lock only serves to keep honest people honest - any thief who really wants to get in your home will not be stopped by a lock, smart or otherwise.
But this flaw, even though it will be fixed, illustrates the danger that smart lock systems like this can pose in that they can make breaking and entering effectively trivial for anyone who is aware of their vulnerabilities. It's always prudent to be sceptical.
You Might Also Like
