SAVANNAH, GEORGIA – Connected safe manufacturer Vaultek released a VT20i safe security update after an investigating website discovered a flaw on the Bluetooth system in one of the company’s flagship products.
Cybersecurity professionals Two Six Labs recently conducted a test on Vaultek’s VT20i safe and found out that the device can “easily be cracked open,” according to The Verge. The security firm dubbed its testing as “BlueSteal,” and discovered three glitches in the Bluetooth system.
The VT20i, which is a part of Vaultek’s VT20 series line, features a security scheme that is connected to a mobile device via Bluetooth using an Android app. The app must be paired with the safe before the Bluetooth system can work.
However, the app utilizes a pairing code that is the same as the safe’s PIN. While the app can accommodate one or more safes, having the same PIN and pairing code makes it vulnerable for hackers to decode.
Two Six Labs then discovered that there are no limitations in terms of the number of times a user can guess or input the PIN. It meant that a hacker can “brute-force” his way to obtain the PIN by using the right computer program.
Moreover, Two Six Labs determined that the link between the safe and the mobile device is not encrypted, which is different from what Vaultek actually claimed. This means that any data traveling between the two devices can be intercepted by hackers.
Vaultek had stated that the VT20i is supported by the AES-128 encryption, but Two Six Labs said that there is no such encryption when they tested the device.
The investigators also confirmed that the paired smartphone does not validate an inputted PIN. This entails to the safe getting opened even after a wrong PIN is entered, as long as the command comes from the paired mobile device.
The investigators tried to change the PIN, and the safe continues to get unlocked using the paired phone.
Aside from the Bluetooth security system, the VT20i can also be unlocked with a biometric fingerprint scanner, a typical numeric keyboard where one can input the passcode, and an ordinary key lock.
Bleeping Computer reported that it has been known for quite some time that any device utilizing the Bluetooth Low Energy protocol as a locking mechanism is susceptible to hacks. The website said that it is a wonder why hardware sellers are still using the said system in their products.
As a result, Vaultek was forced to issue an update to fix the glitches found by the investigators.
In an official statement, the company said that they enhanced the safe’s security by adding the option to completely disable Bluetooth and just use the manual locking systems. They also added a “time out” feature to include extra encryption between the safe and the app should the owner decides to still use Bluetooth.
The VT20i was named by Ezvid Inc. as the year’s top new biometric safe in February. Two Six Labs completed the tests in October, and they contacted Vaultek on the same month.
