SoylentNews is people
SoylentNews
Submitted via IRC for Bytram
One of Amazon's top-selling electronic gun safes contains a critical vulnerability that allows it to be opened by virtually anyone, even when they don't know the password.
The Vaultek VT20i handgun safe, ranked fourth in Amazon's gun safes and cabinets category, allows owners to electronically open the door using a Bluetooth-enabled smartphone app. The remote unlock feature is supposed to work only when someone knows the four- to eight-digit personal identification number used to lock the device. But it turns out that this PIN safeguard can be bypassed using a standard computer and a small amount of programming know-how.
As the video demonstration below shows, researchers with security firm Two Six Labs were able to open a VT20i safe in a matter of seconds by using their MacBook Pro to send specially designed Bluetooth data while it was in range. The feat required no knowledge of the unlock PIN or any advanced scanning of the vulnerable safe. The hack works reliably even when the PIN is changed. All that's required to make it work is that the safe have Bluetooth connectivity turned on.
[...] The vulnerability means that anyone who relies on a VT20i safe to secure valuables should immediately turn off Bluetooth connectivity and leave it off indefinitely. Safes can still be locked and unlocked using a traditional physical key, as well as by owners' fingerprints. Some Amazon customers, however, have complained the fingerprint feature is flawed as well.
[It's not clear from the story if the issue can be patched. - Ed]
(Score: 5, Informative) by Wootery on Monday December 11 2017, @09:51AM (3 children)
I wouldn't blame the consumer here. Not everyone is clued-up about cyber-security. If someone sells a gun-safe, it should be fit-for-purpose. If it's not, it's a moral crime on the part of the designer.
To put it another way, satisfying the PHB becomes the overriding non-functional requirement.
Good idea. This already happens with bike locks. Unfortunately it probably discriminates against small companies in the lock business (Wootery's Innovative Lock Company won't be on the whitelist), but the customer gets additional peace-of-mind that their lock is effective, and the insurer knows the customer is taking proper precautions.
(Score: 3, Insightful) by CoolHand on Monday December 11 2017, @12:14PM
But the designer is likely part of a corporation. We all know that corporations have no morals...
Anyone who is capable of getting themselves made President should on no account be allowed to do the job-Douglas Adams
(Score: 2) by schad on Monday December 11 2017, @03:43PM (1 child)
You can just have the tester offer a limited number of free tests per year. Maybe 3 new-product tests plus 5 re-tests (of new products which failed the first time and were redesigned in response, or of upgraded products that were previously certified). That should be plenty for any small company, while not so much that the big players could drain the tester's resources by spamming them with products.
And you could pay the tester with royalties collected from sales of certified products. Any excess collected would be refunded at the end of the year, after taking out the cost of the "free" tests. If there's a deficit, the tester would increase its rates for the next year.
It's not perfect, but it's probably good enough.
(Score: 2) by drussell on Monday December 11 2017, @05:41PM
Something like that would make sense... Too much sense for a world where the rules are generally controlled by the biggest corporations with the most money. That kind of testing requirement and fee structure would never actually be implemented in the current environment. It will be designed to create as many barriers to entry as possible for non-established players.