Kwikset spokesman Brent Flaharty said in an e-mail statement that the company couldn’t respond to the researcher’s claims without seeing a video of the hack. Ironically, Kwikset’s packaging for the lock includes a statement that says, “All you need is a screw driver.” The slogan refers to installing the lock, but “either way,” says Tobias, “it is essentially a very true statement.” “The entire security of this system rests on tiny little sliders that are being warped in this process,” says Tobias, noting that the crack doesn’t take any expertise to conduct. Major Manufacturers also makes a $90 locksmith tool that consists of a T-rod with a blank attached to the end to replace the screwdriver and blank. They would need to remove the blank using a wire to make the lock operational for other keys. They put the blank into the lock, inserted a screw driver to push the blank into the chamber, then used a small vice grip to turn the screw driver and open the lock.

The researchers, however, were able to crack the lock with only a key blank cut to a specific depth and a screw driver. The lock’s packaging touts it as certified at grade-one security level - the highest for residential locks. The smartkey technology allows someone to easily program the lock with a reset tool to accept specific keys, making it popular with apartment building owners who can re-program the lock when a tenant moves out. The researchers also tackled a smartkey deadbolt from Kwikset, which makes some of the most widely used locks in the U.S. “This is an absolute perfect example of insecurity engineering,” Tobias says.īiolock did not respond to a request for comment. In two seconds, the researchers were able to open the lock. The mechanical lock, which uses a bypass cylinder, can be easily thwarted with a paperclip inserted in the keyway to depress a pin that engages the latch. A paperclip inserted in the Biolock's key chamber (hidden behind a flip door) is used to push an internal pin and unlock the door, making the fingerprint reader superfluous.

Defcon authentication key