Backdooring the Frontdoor

More documents

Recommendations

Info

Source: august.com (August 17th, 2015)
"Unlike physical keys which can be duplicated and distributed without your knowledge, an August lock..."
Page 1 and 2: Backdooring the Frontdoor Hacking a
Page 3: August Smart Lock
Page 8 and 9: Source: august.com (September 14th,
Page 12 and 13: Security claims ● ● ● ● ●
Page 14 and 15: WiFi | HTTPS BLE
Page 17 and 18: Certificate pinning …crap...
Page 19: Disabling SSL/TLS system wide at De
Page 29 and 30: No Jailbreak
Page 31 and 32: Security claims ● ● ● ● ●
Page 34: Not anonymized
Page 37 and 38: Let's fix this
Page 39 and 40: Fix Don't forward log data to Augus
Page 41: Guest to admin?
Page 44 and 45: Replace "user" with "superuser"
Page 46: Guests can not use Auto-Unlock Gues
Page 49 and 50: Mapping out the BLE API
Page 51: Enumerate BLE services
Page 57 and 58:
Better solution
Page 59 and 60:
Replace
Page 61:
No Jailbreak
Page 64 and 65:
MCU write/indicate 1. Communicates
Page 66 and 67:
Key slot 0 is special
Page 68 and 69:
Requesting firmware as a guest
Page 71 and 72:
70F4F853E330BAEC27BF2724F39D1471 70
Page 73 and 74:
Key material in logs
Page 77 and 78:
Security claims ● ● ● ● ●
Page 79 and 80:
Code on github ● ● SDK for Augu
Page 81 and 82:
Mistakes made ● ● ● ● ●
Page 83:
Hackers needed Consumers are not ab
show all

Backdooring the Frontdoor

Create successful ePaper yourself

Delete template?

Save as template?