In our 2023 BSides London talk, we revealed a number of vulnerabilities in a popular line of smart padlocks which allowed unauthorised users to obtain unlock credentials for any affected lock and open it without the owner’s knowledge.

Building on this research, we've developed a training lab to help introduce newcomers to IoT and mobile hacking. Our lab setup replicates the app responsible for controlling the smart locks, and serves as a practical introduction to mobile application reverse-engineering, Bluetooth Low Energy communications, with a garnish of simple API testing. We'll bring the locks and mobile phones to control them.

Bring your own laptop with a Linux VM (Kali works). We'll bring the phones, the locks, and the app. :)