Incident: Security Vulnerability in Kwikset Kevo SmartKey Deadbolt Lock

Published Date: 2013-11-01

Postmortem Analysis
Timeline 1. The software failure incident involving the security vulnerability of the Kwikset Kevo Bluetooth Deadbolt occurred in November 2013 as per the articles [22293, 22396].
System 1. Kwikset Kevo Bluetooth Deadbolt system 2. Kwikset SmartKey deadbolt system 3. Model 980 SmartKey deadbolt 4. Model 925 SmartKey deadbolt [22293, 22396]
Responsible Organization 1. Kwikset's SmartKey deadbolt technology was responsible for causing the software failure incident [22293, 22396].
Impacted Organization 1. Consumers who purchased the Kwikset Kevo Bluetooth Deadbolt were impacted by the software failure incident as the SmartKey deadbolt was found to have security vulnerabilities that could potentially allow unauthorized access to their homes [22293, 22396].
Software Causes 1. The software cause of the failure incident was a security vulnerability in the Kwikset Kevo Bluetooth Deadbolt's SmartKey deadbolt, which allowed for unauthorized access to the lock using a specific technique involving a blank key, screwdriver, and wrench [22293, 22396].
Non-software Causes 1. Lack of physical security in the design of the Kwikset Kevo Bluetooth Deadbolt, specifically the vulnerability of the SmartKey deadbolt to forced entry techniques using basic tools like a screwdriver and wrench [Article 22293, Article 22396]. 2. Potential design flaws in the SmartKey deadbolt mechanism, allowing unauthorized access through a specific method involving a blank key and a screwdriver [Article 22293, Article 22396]. 3. Insufficient testing or validation of the security features of the lock by the manufacturer, leading to a false sense of security for users [Article 22293, Article 22396].
Impacts 1. The software failure incident with the Kwikset Kevo Bluetooth Deadbolt revealed a security vulnerability in the SmartKey deadbolt, allowing for potential unauthorized access to homes [Article 22293, Article 22396]. 2. The incident led to concerns about the overall security of the lock, with experts demonstrating how the lock could be easily bypassed using specific tools and techniques [Article 22293, Article 22396]. 3. The security flaw in the SmartKey deadbolt raised doubts about the effectiveness of the lock in providing adequate protection against forced entry, potentially compromising the safety of users' homes [Article 22293, Article 22396]. 4. The incident highlighted the importance of understanding the security features and vulnerabilities of smart locks like the Kwikset Kevo, emphasizing the need for continuous improvement and testing to ensure robust security measures [Article 22293, Article 22396].
Preventions 1. Conducting thorough security testing: The software failure incident involving the vulnerability of the Kwikset Kevo Bluetooth Deadbolt could have been prevented by conducting more thorough security testing to identify and address potential flaws in the lock's design [Article 22293, Article 22396]. 2. Implementing enhanced security features: Enhancing the security features of the SmartKey deadbolt, such as adding additional layers of protection against forced entry methods like the one demonstrated in the incident, could have prevented the software failure incident [Article 22293, Article 22396]. 3. Continuous monitoring and updates: Regularly monitoring the security of the lock and providing timely updates or patches to address any identified vulnerabilities could have helped prevent the software failure incident from occurring [Article 22293, Article 22396].
Fixes 1. Enhancing the security features of the SmartKey deadbolt to prevent vulnerabilities like the one demonstrated in the YouTube videos [22293, 22396]. 2. Implementing additional security measures or mechanisms in the lock to make it more resistant to forced entry techniques [22293, 22396]. 3. Conducting thorough testing and validation of the lock's security features to ensure they meet the required standards and are robust against potential attacks [22293, 22396]. 4. Continuous monitoring and improvement of the lock's security based on feedback, testing, and real-world incidents to address any identified weaknesses [22293, 22396].
References 1. Investigative attorney Marc Weber Tobias of BrickHouse Security [Article 22293] 2. Engineers at Kwikset [Article 22293] 3. Underwriters Laboratories (UL) [Article 22293] 4. American National Standards Institute (ANSI) and the Builders Hardware Manufacturers Association (BHMA) [Article 22293] 5. Chris Lind from Bob Cook Locksmiths in Louisville, KY [Article 22293] 6. Kwikset [Article 22396]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident related to the Kwikset Kevo Bluetooth Deadbolt occurred within the same organization. The incident involved a security flaw in the SmartKey deadbolt component of the Kwikset Kevo lock, which allowed for potential unauthorized access through a specific technique involving a blank key and a screwdriver [22293, 22396]. (b) The software failure incident has also been reported to have happened at other organizations or with their products and services. The incident highlighted vulnerabilities in the security of the Kwikset SmartKey deadbolt, indicating a potential flaw in the design or implementation of similar locks across the industry [22293, 22396].
Phase (Design/Operation) design, operation (a) The software failure incident related to the design phase: The articles discuss a security flaw in the Kwikset Kevo Bluetooth Deadbolt's SmartKey deadbolt design. The flaw allows for a vulnerability where the lock can be broken into using a specific technique involving a piece of a blank key, a screwdriver, and a wrench. This flaw was highlighted in videos by investigative attorney Marc Weber Tobias of BrickHouse Security [22293, 22396]. (b) The software failure incident related to the operation phase: The software failure incident related to the operation phase involves the actual demonstration of the security flaw in the SmartKey deadbolt design. The articles describe how individuals were able to successfully break into the lock using the identified technique, showcasing the operational vulnerability of the lock when faced with a skilled attacker or locksmith [22293, 22396].
Boundary (Internal/External) within_system, outside_system The software failure incident related to the security vulnerability of the Kwikset Kevo Bluetooth Deadbolt can be categorized as both within_system and outside_system. (a) within_system: The software failure incident was within the system as it involved a flaw in the design and implementation of the SmartKey deadbolt technology used in the Kevo lock. The vulnerability allowed for a specific technique to be used to bypass the lock's security features, indicating an internal flaw in the lock's mechanism [Article 22293, Article 22396]. (b) outside_system: The software failure incident was also influenced by factors outside the system, such as the public disclosure of the vulnerability through YouTube videos and online articles. The exposure of the security flaw to the public domain led to increased awareness and exploitation of the vulnerability by individuals outside the system, potentially compromising the security of the lock [Article 22293, Article 22396].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident occurring due to non-human actions: - The software failure incident with the Kwikset Kevo Bluetooth Deadbolt was primarily due to a security vulnerability in the SmartKey deadbolt component of the lock. This vulnerability allowed for the lock to be opened without a key by exploiting a flaw in the lock's design [22293, 22396]. (b) The software failure incident occurring due to human actions: - Human actions played a role in the software failure incident as well. The vulnerability in the SmartKey deadbolt was discovered and demonstrated by investigative attorney Marc Weber Tobias of BrickHouse Security, who uploaded videos to YouTube showcasing the flaw in the lock's security [22293, 22396].
Dimension (Hardware/Software) hardware (a) The software failure incident occurring due to hardware: - The articles discuss a security flaw in the Kwikset Kevo Bluetooth Deadbolt, specifically related to the SmartKey deadbolt component [22293, 22396]. This flaw allows for the lock to be broken into using a specific technique involving a blank key, a screwdriver, and a wrench. - The vulnerability is attributed to the design of the SmartKey deadbolt, which allows for the sidebar to retract into the lock when pressure is applied, enabling unauthorized access [22293, 22396]. - The articles mention that the security flaw in the lock is related to the hardware component of the SmartKey deadbolt, which is part of the Kwikset Kevo Bluetooth Deadbolt system [22293, 22396]. (b) The software failure incident occurring due to software: - The articles do not mention any software-related failures contributing to the security flaw in the Kwikset Kevo Bluetooth Deadbolt. The focus is primarily on the hardware component, specifically the design vulnerability in the SmartKey deadbolt [22293, 22396]. - The security issue discussed in the articles is related to the physical manipulation of the lock using tools and techniques, rather than a software-related vulnerability or failure [22293, 22396].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident in the articles is related to a malicious objective. The failure was due to a security vulnerability in the Kwikset Kevo Bluetooth Deadbolt lock, specifically in the SmartKey deadbolt component. The vulnerability allowed for the lock to be easily broken into using a specific technique involving a blank key, a screwdriver, and a wrench. This vulnerability was highlighted by investigative attorney Marc Weber Tobias and demonstrated in videos on YouTube [22293, 22396]. (b) The software failure incident was non-malicious in the sense that it was not caused by accidental factors or errors in the software itself. Instead, the failure was due to a design flaw in the SmartKey deadbolt component of the lock, which allowed for unauthorized access through a specific method. The failure was not a result of unintentional mistakes but rather a security weakness in the lock's design [22293, 22396].
Intent (Poor/Accidental Decisions) poor_decisions The software failure incident related to the Kwikset Kevo Bluetooth Deadbolt was primarily due to poor decisions made in the design and security implementation of the SmartKey deadbolt component of the lock. The incident involved a vulnerability in the SmartKey deadbolt that allowed for easy forced entry using a specific technique involving a blank key, screwdriver, and wrench [22293, 22396]. This vulnerability was highlighted by investigative attorney Marc Weber Tobias and demonstrated through videos on YouTube, indicating a flaw in the lock's security design. The incident showcased poor decision-making in the security features of the SmartKey deadbolt, as it was shown to be susceptible to a relatively simple method of forced entry, undermining the lock's intended security function. The failure to address this vulnerability adequately despite claims of security upgrades for the newer model (925) compared to the older model (980) points to shortcomings in the decision-making process regarding security enhancements [22293, 22396].
Capability (Incompetence/Accidental) development_incompetence (a) The software failure incident occurring due to development incompetence: - The software failure incident with the Kwikset Kevo Bluetooth Deadbolt was related to a security flaw in the SmartKey deadbolt component of the lock. Investigative attorney Marc Weber Tobias highlighted vulnerabilities in the SmartKey deadbolt, indicating that it could be broken into with minimal time, force, or expertise [22293]. - Despite Kwikset's claims of security upgrades in the newer model 925 SmartKey deadbolt, testing conducted by CNET revealed that the lock could still be compromised using a specific technique involving a blank key, screwdriver, and wrench. This raised concerns about the effectiveness of the security enhancements and the overall security of the lock [22396]. (b) The software failure incident occurring accidentally: - The software failure incident was not attributed to accidental factors but rather to a specific security vulnerability in the design of the SmartKey deadbolt component of the Kwikset Kevo Bluetooth Deadbolt [22293, 22396].
Duration permanent (a) The software failure incident in the articles seems to be more of a permanent nature. The security flaw in the Kwikset Kevo Bluetooth Deadbolt's SmartKey deadbolt was identified as a significant vulnerability that allowed for forced entry into the lock using a specific technique involving a blank key and a screwdriver [22293, 22396]. Despite claims by the manufacturer that security upgrades had been implemented in the newer model 925 to prevent such attacks, testing conducted by individuals including a locksmith demonstrated that the vulnerability still existed [22293, 22396]. This indicates that the flaw was inherent to the design of the SmartKey deadbolt and not easily mitigated, suggesting a permanent failure in the security mechanism of the lock.
Behaviour other (a) crash: The software failure incident in the articles does not involve a crash where the system loses state and does not perform any of its intended functions. The incident is related to a security vulnerability in the Kwikset Kevo Bluetooth Deadbolt lock, specifically the SmartKey deadbolt component, which can be exploited to bypass the lock's security measures [Article 22293, Article 22396]. (b) omission: The software failure incident does not involve the system omitting to perform its intended functions at an instance(s). Instead, the incident revolves around a security flaw in the lock that allows unauthorized access by exploiting a specific technique involving a blank key and a screwdriver [Article 22293, Article 22396]. (c) timing: The software failure incident is not related to the system performing its intended functions correctly but too late or too early. The focus is on the security vulnerability of the lock and how it can be bypassed using a specific method, rather than a timing issue [Article 22293, Article 22396]. (d) value: The software failure incident does not involve the system performing its intended functions incorrectly in terms of providing the expected value. Instead, the incident pertains to a security weakness in the lock that allows unauthorized access through a specific manipulation technique [Article 22293, Article 22396]. (e) byzantine: The software failure incident does not exhibit the system behaving erroneously with inconsistent responses and interactions, which would align with a byzantine failure. The incident is centered around a specific security vulnerability in the lock that can be exploited to gain unauthorized access [Article 22293, Article 22396]. (f) other: The behavior of the software failure incident can be categorized as a security vulnerability or flaw in the lock's design, specifically the SmartKey deadbolt component. This flaw allows unauthorized access through a specific technique involving a blank key and a screwdriver, highlighting a critical security issue rather than a traditional software failure as described in options (a) to (e) [Article 22293, Article 22396].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property, theoretical_consequence Property: The software failure incident related to the Kwikset Kevo Bluetooth Deadbolt involved a security flaw in the SmartKey deadbolt, which allowed individuals to break into the lock using a specific technique involving a screwdriver and a blank key. This flaw raised concerns about the security of the lock, indicating that people's property (in this case, their homes) could be compromised due to the vulnerability of the lock [22293, 22396].
Domain information (a) The failed system in the articles is related to the information industry as it involves testing the security of the Kwikset Kevo Bluetooth Door Lock, which is a smart lock system designed to provide secure access control using Bluetooth technology [Article 22293, Article 22396]. (m) The failed system is also related to the security industry, as it involves testing the security vulnerabilities of the Kwikset Kevo Bluetooth Door Lock and assessing its resistance to unauthorized access attempts [Article 22293, Article 22396].

Sources

Back to List