Hackers can now clone your
keys just by listening to them with a smartphone
Every time you unlock your
front door, your key whispers a small, but audible, secret. Hackers finally
learned how to listen.
Researchers at the National
University of Singapore published a paper earlier this year detailing how,
using only a smartphone microphone and a program they designed, a hacker can
clone your key. What's more, if a thief was able to install malware on your
smartphone, smartwatch, or smart doorbell to record the audio from afar, they
wouldn't even need to be physically nearby to pull off the attack.
The key (ahem) to the attack,
dubbed SpiKey, is the sound made by the lock pins as they move over a typical
key's ridges.
"When a victim inserts a
key into the door lock, an attacker walking by records the sound with a
smartphone microphone," describes the paper written by Soundarya Ramesh,
Harini Ramprasad, and Jun Han.
With that recording, the
thief is able to use the time between the audible clicks to determine distance
between the ridges along the key. Using this information, a bad actor could
then compute and then produce a series of likely keys.
"[On] average, SpiKey is
able to provide 5.10 candidate keys guaranteeing inclusion of the correct
victim key from a total of 330,424 keys, with 3 candidate keys being the most
frequent case," reads the study.
In other words, instead of
fooling around with lock-picking tools, a thief could simply try a few pre-made
keys and then stroll right through the victim's door.
Of course, there are some
limitations in the real world. For staters, the attacker would need to know
what type of lock the victim has. That information can be figured out by simply
looking at the exterior of the lock, though.
Second, the speed at which
the key is placed into the lock is assumed to be constant. But the researchers
have thought of that, too.
"This assumption may not
always hold in [the] real-world, hence, we plan to explore the possibility of
combining information across multiple insertions," they explain.
It's worth noting that at
present this is a relatively easy attack to defeat. Simply make sure no one is
around you, recording, when you put your key into a lock. However, that won't
always be the case.
"We may exploit other
approaches of collecting click sounds such as installing malware on a victim’s
smartphone or smartwatch, or from door sensors that contain microphones to
obtain a recording with higher signal-to-noise ratio," explain the study
authors. "We may also exploit long distance microphones to reduce
suspicion. Furthermore, we may increase the scalability of SpiKey by installing
one microphone in an office corridor and collect recordings for multiple
doors."
In other words, they're
already thinking about ways to make this attack easier to pull off. And,
sorry, so-called smart
locks just
present their own security issues.
Amazon's Ring security cameras, remember, are hacked
all the time. And as the researchers postulate, a hacker could, in theory,
use the microphone embedded in such a camera to capture the sounds your key
makes and then use the SpiKey technique to produce physical keys to your
home.
However, if a hacker got
access to your Ring, there are easier ways to clone your key than listening to it.
Even so, maybe make a little noise when unlocking your door going forward. Your
neighbors may think you're a tad weird, but at least they won't be able to use
SpiKey to break into your place.
Comments
Post a Comment