UPDATED 3:45 p.m. Eastern time Tuesday, Feb. 6, with comment and clarification from Amazon; 11:30 Wednesday, Fab. 6, with comment from the researcher; 10 a.m. Monday, Feb. 12, with news that Amazon had patched the Amazon Key mobile apps. Original story published Monday, Feb. 5.
Amazon provided us with a statement, here in full:
"This is not a real-life delivery scenario as the security features built into the delivery application technology used for in-home delivery are not being used in the demonstration. Safeguards are in place when the driver technology is used: our system monitors 1) that the door is only open for a brief period of time, 2) communication to the camera and lock is not interrupted, and 3) that the door is securely relocked. The driver does not leave without physically checking that the door is locked. Safety and security is built into every aspect of the service."
The original story follows. Additional information and clarification is after the original story.
Amazon's Key door-unlocking system has been hacked again.
A Bay Area security researcher posted a proof-of-concept video on Twitter yesterday (Feb. 4) showing how an unknown device placed near a Key-compatible smart lock can interfere with the lock's locking mechanism, letting anyone into a Key-enabled home.
"I'm withholding details until Amazon has a chance to fix this," the researcher, identified only as "MG," said on Twitter, explaining why he hasn't said exactly how his attack works. "Don't want this being abused in the wild."
Until this flaw is fixed, you might want to hold off on buying or installing an Amazon Key system.
MORE: Best Smart Locks
If you're not familiar with Amazon Key, it's a service for Amazon Prime customers that lets Amazon remotely unlock your home's front door when a delivery from Amazon arrives. Amazon gives you a window of delivery, but its operators unlock the door remotely when the delivery person gets there. The delivery person places the package inside the front door, then uses his or her own smartphone app to lock the door.
The entire procedure is overseen by Amazon's Cloud Cam security camera, which shows both Amazon's remote operators and the home owner a live feed of the delivery person arriving, unlocking the door, placing the package inside and then locking the door and leaving. Compatible smart locks are made by Kwikset and Yale, and the entire package of camera and smart lock, with free installation, costs $250.
Last November, Rhino Security Labs found that a laptop or minicomputer could send a "deauthorization" command to the Cloud Cam while the door was open, temporarily knocking the camera off the Wi-Fi network and causing the delivery person's smartphone app to hang after the lock command was sent up to Amazon's cloud.
Amazon fixed that flaw with a software patch, but MG wasn't satisfied.
"Amazon downplayed the last attack on this product because it needed an evil delivery driver to execute. This doesn't," he said on Twitter. "It's all current software."
MG's video begins with an "attacker" — you can tell he's a bad guy because he's wearing a knit cap embroidered with the words "CYBER CRIME" — walking up to a house's front door and placing a homemade device, which MG refers to as a "break & enter dropbox," into an outdoor light fixture. The device looks to be a Raspberry Pi or similar minicomputer with a radio antenna attached.
"No configuration or access to the network is needed," on-screen text states as the attacker leaves.
A "deliveryman" then shows up and follows what appears to be the standard procedure. He clicks the Amazon Key app on his smartphone, opens the door, leaves the package, hits the lock command on his smartphone and leaves.
"Attacker returns after receiving a notification of the delivery event," the next on-screen text reads. "Can now enter house and reclaim dropbox." (One unexplained mystery is how the attacker learns of the "delivery event" without a connection to the home wireless network.)
The video shows the same attacker from before first taking the "dropbox" out of the light fixture, then calmly opening the front door without any tool.
That's followed by a quick demonstration showing an iPhone with the Amazon Key app being fooled by the "dropbox," which is lying next to it on the welcome mat. The app unlocks the door, but somehow fails to lock it after the lock command is pressed.
MG said he used Kwikset's Amazon Key-compatible lock used in the video. But because all the compatible locks (there are only a few) operate the same way, it's likely that the attack would work against all models.
We sent a request to Amazon seeking comment on this attack, and haven't yet received a reply. However, Amazon did tell TechRadar that "the delivery driver must complete all steps of the in-home delivery on her/his handheld system to move to the next delivery, including physically checking to ensure that the door is locked."
"During a delivery, the customer can see time stamps regarding how long the door is open and Amazon receives an alert if the door is unlocked for more than several minutes," the statement continued. "In the extremely rare case Amazon is unable to lock the door after a delivery, we immediately call the customer."
Again, because we don't know exactly how this attack works, we can't really suggest how to avoid it. But as stated above, we'd not use an Amazon Key setup for the time being.
UPDATE 1:
An Amazon representative explained to us that real Amazon Key-trained delivery persons carry special devices with which they communicate with Amazon regarding Amazon Key, and that delivery persons do not use personal smartphones to operate Amazon Key. Because of safeguards built into the delivery persons' devices, the representative said, the attack as depicted is not possible during an Amazon Key-enabled delivery.
However, the Amazon representative said that the attack in the video might be possible, if the attacker could precisely time his or her signals, in use cases involving other persons who had been granted access to a home using Amazon Key, such as dog walkers, house cleaners or house guests. Because of that possibility, the representative said, Amazon would be updating the Amazon Key smartphone apps this week.
UPDATE 2:
In a blog posting Feb. 6, MG explained that the attack involved monitoring the frame rate of the Cloud Cam and sending a deauthorization command to the camera as the frames spike, indicating that someone is using Amazon Key. Disconnecting the camera also disconnects the lock, which is connected to the camera through the low-power Zigbee wireless protocol, MG said.
MG also admitted that his attack might not work in an Amazon delivery situation, but said that that was not really the issue.
"My [proof of concept] showed off a delivery driver opening the lock, but this could easily be a homeowner or guest dropping something off in their house or even just quickly running back in to grab something before driving off," he wrote. "Amazon also doesn’t talk about the fact that they require your house’s alarm to be turned off for a driver to use the Amazon Key without issue."
UPDATE 3:
Amazon patched the Amazon Key apps for iOS and Android over the weekend of Feb. 10-11 to "notify you if the app cannot verify the lock status for any reason," and researcher MG told ZDNet that his attack no longer worked.
