Skip to main content

Indiegogo-backed Tapplock proves breakable and hackable; fixes incoming

For a product that’s been backed to over $300,000 on Indiegogo — over 500 percent of its original goal — Tapplock is having a bad week in the security department. Specifically, some friendly hackers at Pen Test Partners were able to crack the Bluetooth-enabled smart lock in seconds using only a cell phone.

Unlocked

Digital Trends wrote about the lock and its “cutting edge encrypted fingerprint sensor” back in 2016, but the $100 smart lock turns out to be pretty vulnerable to security penetration, both in terms of its physical makeup and its security platform.

First, its physical makeup is somewhat compromised. Sure, a pair of bolt cutters can go through the lock like a hot knife through butter but that’s true of most consumer market locks. Never mind that the lock isn’t even waterproof but merely “water resistant.” It turns out the lock is made up of an industrial alloy called Zamak 3, comprised of zinc aluminum more commonly found in die-cast toys and door handles, an element that isn’t strong, is brittle, and melts at temperatures below 800 degrees Fahrenheit. By comparison, an air-only blowtorch burns at more than 3,600 degrees F while an oxygen-fed torch fires up at more than 5,000 degrees.

Prime Day Focus
Roborock Prime Day shopping guide: Lots of options, which is right for you?
Is the Bluetti AC200L the best power station for camper vans?
These Razer Blade Prime Day deals really pack a punch [in gaming power]
Tiny projector, epic 4K cinema: Watch movies anywhere with LG CineBeam Q

But that’s not all on the physical security front. Several YouTubers have already put up videos demonstrating the fragility of the lock. On June 1, a user called JerryRigEverything was able to employ a sticky GoPro mount to remove the back of the lock, dismantle it with a screwdriver, and open the shackle. Subsequently, CNET tried the same trick and couldn’t break the lock, so whether the lock is physically secure is still up in the air.

In the meantime, Tapplock has issued a statement that all future lock batches will use proprietary screws in the inside chambers as a secondary protective mechanism. The company is also offering free replacements to any customer who is able to crack the back cover without damaging the lock.

TappLock Series: Your Fingerprint, Your TappLock

Meanwhile, the company is dealing with the bigger headache of Pen Test Partners being able to break the Tapplock’s internal software in less than two seconds. The process took the penetration testers less than an hour. Not only was the software broadcasting over unencrypted HTTP lines, but the locks are using the same data every time. Any bad actor on the same network can sniff the traffic, grab the unlocking data, and use it to unlock the device into perpetuity. There is no factory reset for the lock.

“This level of security is completely unacceptable,” wrote Pen Test Partners researcher Andrew Tierny. “Consumers deserve better, and treating your customers like this is hugely disrespectful. To be honest, I am lost for words.”

When informed of the back, Tapplock’s backer Pishon Lab told Tierny, “We are well aware of these notes.”

Subsequently, the company says that it is upgrading its QA process and pushing out a security patch to address its software vulnerability. Its QA procedures now include a 2-step inspection to ensure the lock’s spring-pen mechanism is effective, while a software patch upgrades the security protocol that includes additional authentication steps. The patch involves an app update as well as a firmware update, administered via the company’s proprietary app.

Pishon Labs also offered thanks to Pen Test Partners for “the timely prompt and ethical disclosure.”

Clayton Moore
Clayton Moore’s interest in technology is deeply rooted in the work of writers like Warren Ellis, Cory Doctorow and Neal…
Best Prime Day Robot Vacuum deals still available: Roomba, Eufy and more
The Samsung Jet Bot AI+ Robot Vacuum cleaning the floor.

Prime Day deals are mostly over for 2024. The official shopping holiday is over, but some deals are still around. If you're looking for something cheap, check out Prime Day cordless vacuum deals, but if you're feeling a little lazy about getting dust and crumbs off the floor, one of the best ways to solve your problem is with these Prime Day robot vacuum deals, including Roomba Prime Day deals. We've found a wide variety of your favorite robot vacuums, including Eufy, iRobot, Shark and more. And, if you want to get extra lazy, be sure to check out EcoVacs Prime Day deals, too, as the company makes everything from robot vacuums to robot window cleaners. Also, don't forget to check out the Best Buy Prime Day deals and Walmart Prime Day deals since Amazon isn't the only one dropping prices.

 

Read more
Best Walmart Prime Day deals still available: TVs cheaper than Amazon
Walmart store logo at night.

Sure, Amazon is where Prime Day deals started, but all of the retailers joined the online shopping frenzy. Deals at outlets such as Best Buy, Target, and Walmart often turn out even better Prime Day deals. Many other retailers keep their deals around longer too. Walmart has some of the best Prime Day laptop deals, Prime Day TV deals, Prime Day headphone deals, and more going on right now. And with so many options for saving at Walmart available we thought we'd track down all of the best Walmart Prime Day deals. You'll find them all below, and if you see something you like, be sure to grab it while you can, as Prime Day deals are known to come and go without notice.
Walmart Prime Day laptop deals

If you're thinking about getting a new laptop, you should take a look at these Walmart Prime Day laptop deals that we've selected, which include Prime Day gaming laptop deals and Prime Day MacBook deals. Whether you need a budget-friendly device for simple functions or a high-powered machine for professional tasks, we've got you covered with our recommendations. You're going to have to be quick in deciding which laptop to buy though, as these offers aren't expected to last until the end of the shopping event.

Read more
Prime Day smart plug deals still available: As low as $16 today
The Wyze Smart Plug connected to an outlet.

Prime Day may be over but there are still some great post Prime Day deals, mostly thanks to the likes of the Prime Day Best Buy deals, Target deals, and Walmart deals which are all still happening. If you've been waiting to buy a smart plug to make your devices, well, smarter, you're in luck. There's still time to snag some of the internet-connected devices for less so you can make your home run more efficiently. We've picked out all the best smart plug deals that are still around, so you can save big on these little gadgets. Here's what's out there but bear in mind that all these deals could end very soon.
Prime Day smart plug deals we love

A smart plug will give your non-smart electronic devices internet-connected features, allowing them to join your smart home setup. It's highly recommended that you use as many of them as possible in your home to maximize the benefits that you can get from them. While they're not overly expensive devices, their costs will add up if you're planning to buy several of them, which is why you wouldn't want to miss the discounts of Prime Day smart plug deals.

Read more