Home This smart lock fiasco proves the Internet of Stupid is alive and well

This smart lock fiasco proves the Internet of Stupid is alive and well

As anyone who’s traveled widely before the days of connected smart phones and GPS knows the pain when travel plans go awry and you end up at your place of accommodation only to find yourself locked out in the middle of the night.

It’s the stuff nightmares are made of and a thing of the past until this week when hundreds of Internet-connected locks became inoperable last week, a problem lock makers Lockstate attributes to a faulty software update that resulted in a fatal system error. Lockstate’s RemoteLock 6i is a worldwide partner of Airbnb, meaning that many hosts were unable to remotely control their locks.

The problem occurred when RemoteLock6i’s were sent a firmware update intended for RemoteLock7i’s and subsequently the former was unable to be locked or receive over-the-air updates.

See also: Can smart locks really help you feel safer at home?

A letter was sent to all affected  — over 500 customers — instructing that they can either return parts to be fixed by Lockstate, with a turnaround time of five to seven days, or they could request a replacement lock, taking 14 to 18 days. In the meantime, homeowners are instructed to use a physical key, but what if you were out without your key when the crash happened or lived some distance away from the rental property?

I spoke to Yann Leretaille, CTO at Berlin company 1aim who build develop and produce access control systems, which enable users to open doors with mobile phones. All of their hardware, software, and IT-Infrastructure is created in house and I’ve had the pleasure of using their product upon visiting their office. According to Leretaille the use of WiFi in such scenarios is ill advised:

“At its core, the debacle at Lockstate reflects one of our major issues with IoT products today – simply placing a WiFi chip inside of an existing product (in this case, a code lock) and referring to it as ‘smart’ doesn’t mean that it actually is. Generally, we feel that it is dangerous to expose a device like a lock over WiFi, as an attacker could brick all the locks in the system, or reset the codes to be the same. This is why our access management system does not use WiFi.”

Leretaille further questions the absence of backups in anticipation of product failure:

“We also see that there was no backup strategy or fail-safes in place for such an issue, which a hacker might also replicate successfully. We allow our users to store two versions of our firmware on the same device, so if one does not operate correctly, they can revert to the other. If companies in this segment continue to treat security as an afterthought, it is inevitable that a script-kiddie will one day unlock thousands of doors at once from afar for fun.
Too many companies do not care about long-term support, reliability, or security, and this creates distrust in society. It casts a long shadow on the market. Almost every ‘smart lock’ we have seen has had big security flaws, and is easily compromised.”


Not the first connected home products failure

The scenario reminds me of the woe’s for numerous pet owners last year when connected company PetNet experienced difficulties with their automated pet feeder. The Petnet is a smart pet feeder with features including “intelligent sensor technology, learning algorithms, and processing power that assesses the dietary requirements of a pet” and a custom feeding schedule via a corresponding app with alerts to pet owners when their pet has been fed and reminders when food supplies are running low.

Unfortunately last August, Petnet’s third-party server service that the company rented from Google, was down for around 10 hours and did not have redundancy backups. This situation resulted in outraged pet owners, especially those who were away from home at the time.

Inherent with connected hardware design are possible failure scenarios like problems with internet connectivity, WiFi, a residential blackout, remote updates or the system needing a reboot/restart. Surely the possibility of product failure should have been anticipated in the design phase? Or does it negate the point of the connected product in the first place?

Let’s face it, a lock box with a pin code that houses a physical key would be a lot less stressful for everyone concerned. Technology will never be infallible and these kinds of scenarios do little to compel products to the mainstream.

About ReadWrite’s Editorial Process

The ReadWrite Editorial policy involves closely monitoring the tech industry for major developments, new product launches, AI breakthroughs, video game releases and other newsworthy events. Editors assign relevant stories to staff writers or freelance contributors with expertise in each particular topic area. Before publication, articles go through a rigorous round of editing for accuracy, clarity, and to ensure adherence to ReadWrite's style guidelines.

Get the biggest tech headlines of the day delivered to your inbox

    By signing up, you agree to our Terms and Privacy Policy. Unsubscribe anytime.

    Tech News

    Explore the latest in tech with our Tech News. We cut through the noise for concise, relevant updates, keeping you informed about the rapidly evolving tech landscape with curated content that separates signal from noise.

    In-Depth Tech Stories

    Explore tech impact in In-Depth Stories. Narrative data journalism offers comprehensive analyses, revealing stories behind data. Understand industry trends for a deeper perspective on tech's intricate relationships with society.

    Expert Reviews

    Empower decisions with Expert Reviews, merging industry expertise and insightful analysis. Delve into tech intricacies, get the best deals, and stay ahead with our trustworthy guide to navigating the ever-changing tech market.