Vulnerabilities Discovered in Ultraloq

The penetration testing company Pen Test Partners (PTP) has found security vulnerabilities in the Ultraloq smart lock from U-tec. David Lodge, one of PTP’s consultants, was able to access personal data from the user’s account as well as the house location and lock location. The smart lock, which can be accessed through fingerprint, passcode or key, is easy to hack, with Lodge resetting the lock’s PIN remotely, allowing him complete control. The physical lock, Lodge continued in his report on the Ultraloq, is also easy to pick, only requiring a thin pick.

ultralog-security-vulnerabilities
Ultraloq UL1 BK with door finger 2. Photo provided by U-tec.

Related: Schlage Connect Smart Deadbolt Review

Lodge wrote,

“The Ultraloq has a back-up key lock in the base of the device – in case the electronic side fails. And that lock is not a good one – an amateur can reliably open them quickly and easily, both with single pin picking and raking. It’s certainly not up to the standards we would expect to see on an external door.”

Lodge has been working with U-tec since April of 2019, helping them fix an API flaw. However, the company has yet to fix the BLE encryption key, which is easily obtainable. The lock’s storage is unencrypted and can be accessed using only a Raspberry Pi and a SOIC-8 clip, according to Lodge. Guillermo Montalvo, a member of the Product Marketing team at U-tec, told Security Baron that a brute force attack would be nearly impossible for the following reasons:

  1. The lock processes pin tests itself 10 times a second.
  2. It would take 30 hours to guess a six digit pin.
  3. It would take 3,000 hours to guess an eight digit pin, and the battery of the Ultraloq would run out before this was possible.

One in Four U.S Households Will Purchase Smart Lock, Survey Says

A quarter of all broadband households in the U.S reported that they’re planning on purchasing a smart lock within the next year, according to a survey from marketing company Parks Associates. While the original owners of smart locks were of higher-income households, the new wave of owners will have moderate incomes and smaller houses. Currently, large companies like Schlage, Yale and Kwikset dominate the smart lock market, but Denise Ernst, Parks Associates’ Vice President, believes that newer companies can succeed by pointing out weaknesses in popular smart locks. However, given the Ultraloq’s alleged security issues, it’s unclear how it will fare in this competitive marketplace.

Aliza Vigderman

Aliza Vigderman

Aliza is a journalist living in Brooklyn, New York. Throughout her career, her work has spanned many intersections within the tech industry. At SquareFoot, a New York-based real estate technology company, she wrote about the ways in which technology has changed the real estate industry, as well as the challenges that business owners face when they want to invest in property. At Degreed.com, an education technology website, Aliza created digital content for lifelong learners, exploring the ways in which technology has democratized education. Additionally, she has written articles for The Huffington Post as well as her own content on Medium, the online publishing platform. Aliza’s love of journalism and research stems from the excellent Journalism program at Brandeis University. At Brandeis, Aliza interned as a research assistant at the Schuster Institute for Investigative Journalism, a non-profit “news room without walls”. There, Aliza was paired with an investigative journalist and used academic databases to obtain data on everything from the suicide rates in Bhutan to local Boston court cases. Her last position was as an account executive at Yelp, educating business owners on the power of technology to increase revenue. Throughout, however, her heart remained with tech journalism, and she’s thrilled to be writing for Security Baron. When she’s not keeping afloat of the latest tech trends, Aliza likes to cook, read, and write. A former high school “Class Clown,” Aliza has completed two feature-length screenplays, a pilot, and countless comedic sketches. On her days off you can find her relaxing in Prospect Park, trying the latest flavors at Ample Hills Ice Cream, and spending time with friends and family.

Leave a Comment

Trending News

Follow Us

Reviews