No Key, No Problem: Vulnerabilities in Master Lock Smart Locks
summary
The paper reverse engineers the Master Lock Vault Enterprise Android app and BLE protocol and demonstrates five concrete flaws: session replay using fixed AES-CCM nonces allows replayed BLE ciphertexts to unlock; profiles valid nine months let revoked users keep access; static app secrets allow audit forgery so attackers upload fake or drop real events; malformed BLE messages cause DoS, memory leaks, and corruption. An Android PoC client implements the protocols and reproduces the attacks; vendor issues firmware and server-side mitigations (nonce randomization, shorter validity, audit MACs).
AI-written summary · about
chapters (11)
- 0:00Master Lock vulnerabilities intro
- 1:59Discovered attacks overview
- 3:02BLE architecture overview
- 5:08Reverse engineering challenges
- 8:41Authentication flow details
- 10:06Exceeding access attack flaws
- 11:31Session replay attack
- 12:37Audit log tampering
- 14:03Disclosure and response
- 16:30Lessons learned
- 17:35Conclusion & Q&A
related talks
46mBlueMaster: Bypassing and Fixing Bluetooth-based Proximity Authentication
39mDilemma in IoT Access Control: Revealing Novel Attacks and Design Challenges in Mobile-as-a-Gateway
22mA Mirage of Safety: Bug Finding & Exploit Techniques of Top Android Vendor's Privacy Protection Apps
37mOpen Sesame! The full story behind opening a smart lock
36mEnhancing Mobile App Security
51mBluetooth Hacking: Tools And Techniques
57mFaux Disk Encryption: Realities of Secure Storage On Mobile Devices
01h 06mBackdoors in Back Doors