'Smart' Lock Vendor Locks Hundreds Out Of Their Home With Bungled Firmware Update

from the sorry-I-can't-do-that,-Dave dept

So we’ve talked repeatedly about how the real “smart” choice in the era of “smart” internet of things devices is often — dumber technology. Whether it’s your smart refrigerator or TV leaking your gmail details or viewing data over unencrypted connections, your smart car opening the door to potentially fatal attack, or your smart doorbell creating new attack vectors into your WiFi network, more often than not you’re quite frankly better off with the older, less sophisticated versions of these technologies if you want the smart path toward a more secure life.

The latest case in point: smart door lock vendor Lockstate managed to completely disable the smart door locks of an estimated 500 customers after a botched firmware update left customers unable to access their own properties:

A subset of smart locks made by Lockstate have been bricked after an update. The smart lock vendor is part of Airbnb?s Host Assist program, and integrates with the accommodation rental platform so, for instance, hosts can automatically generate and email one-time codes for their guests to use during check-in….Two models of Lockstate smart lock are apparently affected, one of which currently retails for $469.

Airbnb offers property owners a $50 discount code if they use Lockstate products as part of the Host Assist program ? where said products are heralded as ?revolutionary? and capable of withstanding ?high usage?. Because the botched update made it impossible for these locks to subsequently connect to the internet for a new fix, the vendor is informing owners that their only recourse is to wait anywhere from a week to eighteen days for a physical replacement, inundating them with neither smart nor revolutionary added costs:

In the mass mailer email, which begins ?Dear Lockstate customer? and summarizes its contents as an ?update? pertaining to LockState 6i/6000i, affected customers are asked to wait as long as 18 days for a full replacement. Or up to a week if they choose to remove and send the back portion of the lock to the company for repair.

Feel smarter yet? Of course this isn’t the first problem of this type. Internet of things brand darling Nest has, at several different points, botched their own firmware updates for supposedly smart thermostats, resulting in users either being cooked or chilled until they were able to remedy the problem. This is the kind of stuff internet of things evangelists still don’t spend much time talking about when they’re busy hyping and pitching the latest and greatest internet-connected widgets, built by a rotating crop of companies with a fleeting interest in actual security, functionality and privacy.

Granted bungled firmware updates are only one risk. A recent report took a look at sixteen different brands of Bluetooth-enabled smart locks, and found that at least twelve of the brands were notably susceptible to remote attacks. The flaws are fairly standard at this point, ranging from user data and passwords being transmitted in plain text, or a bungled use of encryption to transmit user data when encryption was used at all. Short version of the lesson: if you’re trying to build a smart home either do your homework and consult a hacker to find the best quality devices available, or save both time and money and revert to the best available dumb alternative.

Filed Under: , ,
Companies: airbnb, lockstate

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “'Smart' Lock Vendor Locks Hundreds Out Of Their Home With Bungled Firmware Update”

Subscribe: RSS Leave a comment
Anonymous Coward says:

Re: Re: Re:

The government would never try to weaken smart locks so they can get into your home. They will however promote and push for smart locks having a code for emergency responders to unlock your door in the event you need to call 911 to your home for something.

Naturally access to such a code would be carefully controlled. It would never be stolen or misused. However just in case of the unlikely event that happened, all uses of the code would of course be logged by the locks. Plus since they’re building in some logging ability anyways, the locks would log all usage of the door so the homeowner had the option of knowing people’s comings and goings. For the homeowner’s convenience, those logs would of course be stored "in the cloud".

Anonymous Coward says:

Re: Re:

Traps are actually prohibited by most fire codes due to the hazards they pose to first responders (IFC 316.3, NFPA 1 and in immediate egress situations (NFPA 101

The better bet is to get a solid wood or metal door and actually put a decent lock on it (say a Mul-T-Lock or an Abloy disc detainer, not your typical home cheapo garbage). There is 0 need to introduce the Internet of Trash into your home security system.

Anonymous Coward says:

Re: Re: Re:

The better bet is to get a solid wood or metal door and actually put a decent lock on it[…] There is 0 need to introduce the Internet of Trash into your home security system.

People running short-term rentals (like Airbnb) from out of town really do need something other than a key they carry. They could use a lock-box with combination instead, but anyone who’s stayed there would know the combination (until the owner could go physically go there and change it), and there’s always a risk someone would copy the key or not return it.

The proper solution, of course, is to stop being cheap and hire a local person to manage it and give out and replace keys, or change combinations, as needed (and clean and inspect before guests arrive).

People not renting out to strangers can simply buy some non-internet-connected combination lock or lockbox, if they or their family don’t want to carry keys. (Except that pushbutton door locks, whether "smart" or not, have pretty terrible security records.)

MrTroy (profile) says:

Re: Re: Re:

While I generally agree with this sentiment, it does butt up against another problem.

Devices that are connected to the internet but don’t update automatically… typically won’t be updated, and so security flaws that are discovered over time don’t get fixed over time, leading to IoT devices that are happy to participate in distributed attacks of some nature.

The ability to create limited-time codes to access the property seems like a perfect fit for the AirBNB or similar model, so I’d say that this is far less of a pink elephant than most internet-connected devices. If it provides access audits per code, then homeowners could determine that the cleaners did or didn’t access the property at times when they were supposed to, amongst other simple conveniences. This sounds to me like a genuinely useful device.

Internet-facing security would of course have to be bullet-proof and upgradeable. Maybe the simple fix would have been for firmware upgrades to be pushed by the device owner rather than the device manufacturer, with escalating warnings over time from the manufacturer if devices are left without upgrade perhaps resulting in a loss of warranty (support? Warranty is probably a legal thing) if a device hasn’t received an update flagged as security for more than (say) 3 months.

At least if the owner is doing the upgrade, and it fails, they are aware of the failure at that moment and so can respond to it at the time. I fail to have much sympathy for owners for whom this approach would be too hard because they own too many properties.

DannyB (profile) says:

Can Smart Locks ever be a good idea?

Smart Locks (just like most IoT or “smart” devices) are a bad idea unless you can fully control them just as you control their non-smart counterparts.

My smart lock, for example, should be under MY control as equally as a dumb lock is under my control. It does not and cannot obey some internet cloud connected mother ship.

Similarly for all other modern devices that get embedded microcontrollers. If the owner purchaser consumer cannot fully control them, then they are a bad idea.

Now what does this say about modern PCs which you cannot fully control? With back doors literally baked into the microprocessor.

Anonymous Coward says:

Terrible response

The company said it would take 5-7 days to ship the lock for repair and get it back, or 14-18 days to have a new lock shipped. Why is the second amount so much larger? Are they just trying to avoid paying for new locks, or do they really have no stock?

The proper response would be to send new locks right away with 24-hour shipping, and a prepaid box to return the old one. If they run out of locks, they should be sending their employees to hardware stores to buy more, or even paying for the broken locks so they can reflash and send them out.

This quote was bullshit too: "Owners were not stranded with a non-working lock. This keypad lock comes with an emergency set of keys that can be used in case of emergency." That’s great if the owner is the one trying to use the lock, and the owner has the keys on them at the time (i.e., not in a box inside the locked house). If it’s the owners kid who’s locked out, or their Airbnb guests, those people are still screwed.

McGyver (profile) says:

No matter how much manufacturers can improve “smart” products, anything that needs to be connected to the Internet, receive constant updates or has the potential to become “bricked” is a product that has just one more way to fail.
So previously you have ordinary wear and tear, the possibility of a manufacturer defect and now let’s add “smart fail”.
Some things are just better off dumb… no matter how cool it seems be able to turn on your electric toothbrush or check your coffeemaker’s emotional status from halfway across the planet, you are just adding more vectors for failure and frustration.

Anonymous Coward says:

Re: Re:

anything that needs to … receive constant updates or has the potential to become "bricked" is a product that has just one more way to fail.

But writing secure and robust software before releasing a product is hard!

I’d love to see firmware for stuff like this come with an algorithmic proof of correctness, but startup culture isn’t going to give us that.

Add Your Comment

Your email address will not be published.

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »