{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,20]],"date-time":"2026-08-20T16:12:18Z","timestamp":1787242338269,"version":"build-2736575974"},"reference-count":31,"publisher":"Springer Science and Business Media LLC","issue":"6","license":[{"start":{"date-parts":[[2023,5,27]],"date-time":"2023-05-27T00:00:00Z","timestamp":1685145600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2023,5,27]],"date-time":"2023-05-27T00:00:00Z","timestamp":1685145600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"funder":[{"name":"C\u00e1tedra en Ciberseguridad Binter, ULL"},{"name":"C\u00e1tedra Edosoft en Computaci\u00f3n en la Nube e Inteligencia Artificial, ULL"},{"DOI":"10.13039\/100015528","name":"Universidad de la Laguna","doi-asserted-by":"crossref","id":[{"id":"10.13039\/100015528","id-type":"DOI","asserted-by":"crossref"}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Wireless Netw"],"published-print":{"date-parts":[[2024,8]]},"abstract":"<jats:title>Abstract<\/jats:title>\n                  <jats:p>Smart-locks have become increasingly popular for access to homes and businesses in many countries, because of their ease of use and adaptability. These locks offer a simple and secure alternative to traditional key-based entry, making them an attractive choice for both residential and commercial properties. Nevertheless, it is essential to acknowledge the potential security threats that come with any new technology. The security of smart-locks is particularly critical, as a breach could result in unauthorized entry. Since the smart-locks can connect, there are different ways to check if vulnerabilities can be found easily or on the contrary, if the security level is high. Two of the main ways of checking the security level of this kind of IoT device are the information that can be obtained from the Android application and the security level of the Bluetooth connection. Many vulnerabilities can be found in the Android smart lock management application. This application is very useful to perform all the configurations with such a lock, but if it is not properly implemented and secured, it can provide clues for malicious users to perform unauthorized access to the system. Another security factor is the Bluetooth connection. This ensures that only authorized users have access to the property. In this work, we have analyzed the security level of different parts of smart-locks. In particular, we have analyzed the security of the applications for the most important smart-locks on the market. This study reveals relevant information such as whether the application is obfuscated or not, the encryption algorithm for the Bluetooth connection, or relevant URLs that applications use to connect to the cloud. The security of the Bluetooth connection between the smartphone application and two selected smart-locks was also analyzed. It was demonstrated that if no encryption is used for the Bluetooth connection, the smart-lock is not secure, but if AES encryption is used, the security level is high.<\/jats:p>","DOI":"10.1007\/s11276-023-03376-8","type":"journal-article","created":{"date-parts":[[2023,5,27]],"date-time":"2023-05-27T06:01:47Z","timestamp":1685167307000},"page":"5905-5917","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":16,"title":["Research on smart-locks cybersecurity and vulnerabilities"],"prefix":"10.1007","volume":"30","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-6910-6538","authenticated-orcid":false,"given":"C\u00e1ndido","family":"Caballero-Gil","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Rafael","family":"\u00c1lvarez","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Candelaria","family":"Hern\u00e1ndez-Goya","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jezabel","family":"Molina-Gil","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2023,5,27]]},"reference":[{"key":"3376_CR1","unstructured":"Palle, S. (2017). Smart locks: Exploring security breaches and access extensions. PhD thesis, Oklahoma State University."},{"issue":"6","key":"3376_CR2","first-page":"1","volume":"4","author":"U Lamping","year":"2004","unstructured":"Lamping, U., & Warnicke, E. (2004). Wireshark user\u2019s guide. Interface, 4(6), 1.","journal-title":"Interface"},{"key":"3376_CR3","unstructured":"Solutions, N.H. (2013). Nuki smart lock. https:\/\/nuki.io\/es\/smart-lock\/."},{"key":"3376_CR4","unstructured":"Xiaomi. Sherlock smart lock. https:\/\/cerradurasinteligentes.net\/xiaomi\/xiaomi-sherlock-s2\/."},{"key":"3376_CR5","doi-asserted-by":"crossref","unstructured":"Bichsel, B., Raychev, V., Tsankov, P., & Vechev, M. (2016). Statistical deobfuscation of android applications. In Proceedings of the 2016 ACM SIGSAC conference on computer and communications security, pp. 343\u2013355.","DOI":"10.1145\/2976749.2978422"},{"key":"3376_CR6","doi-asserted-by":"crossref","unstructured":"Ye, M., Jiang, N., Yang, H., & Yan, Q. (2017). Security analysis of internet-of-things: A case study of august smart lock. In 2017 IEEE conference on computer communications workshops (INFOCOM WKSHPS), pp. 499\u2013504. IEEE.","DOI":"10.1109\/INFCOMW.2017.8116427"},{"key":"3376_CR7","doi-asserted-by":"crossref","unstructured":"Ho, G., Leung, D., Mishra, P., Hosseini, A., Song, D., & Wagner, D. (2016). Smart locks: Lessons for securing commodity internet of things devices. In Proceedings of the 11th ACM on Asia conference on computer and communications security, pp. 461\u2013472.","DOI":"10.1145\/2897845.2897886"},{"key":"3376_CR8","doi-asserted-by":"crossref","unstructured":"Ahmad, T., Morelli, U., Ranise, S., & Zannone, N. (2018). A lazy approach to access control as a service (ACaaS) for IoT: an AWS case study. In Proceedings of the 23nd ACM on symposium on access control models and technologies, pp. 235\u2013246.","DOI":"10.1145\/3205977.3205989"},{"key":"3376_CR9","unstructured":"Hassani, R. (2020) Security evaluation of a smart lock system."},{"key":"3376_CR10","unstructured":"Borg, A., & Francke, C.A. (2020). IoT Pentesting: Obtaining the firmware of a smart lock."},{"key":"3376_CR11","doi-asserted-by":"crossref","unstructured":"Han, Z., Liu, L., & Liu, Z. (2019). An efficient access control scheme for smart lock based on asynchronous communication. In Proceedings of the ACM Turing celebration conference-China, pp. 1\u20135.","DOI":"10.1145\/3321408.3321567"},{"key":"3376_CR12","doi-asserted-by":"crossref","unstructured":"Pinjala, S.R., & Gupta, S. (2019). Remotely accessible smart lock security system with essential features. In: 2019 international conference on wireless communications signal processing and networking (WiSPNET), pp. 44\u201347. IEEE","DOI":"10.1109\/WiSPNET45539.2019.9032715"},{"issue":"37","key":"3376_CR13","doi-asserted-by":"publisher","first-page":"40","DOI":"10.5120\/ijca2020919882","volume":"177","author":"DC Aluri","year":"2020","unstructured":"Aluri, D. C. (2020). Smart lock systems: An overview. International Journal of Computer Applications, 177(37), 40\u201343.","journal-title":"International Journal of Computer Applications"},{"key":"3376_CR14","doi-asserted-by":"crossref","unstructured":"Lin, P.-J., Ho, C.-T. (2020). Smart lock security system based on artificial internet of things. In 2020 IEEE Eurasia conference on IOT, communication and engineering (ECICE), pp. 79\u201381. IEEE","DOI":"10.1109\/ECICE50847.2020.9302010"},{"key":"3376_CR15","doi-asserted-by":"crossref","unstructured":"Lounis, K., & Zulkernine, M. (2019). Bluetooth low energy makes \u201cjust works\u201d not work. In 2019 3rd cyber security in networking conference (CSNet), pp. 99\u2013106. IEEE","DOI":"10.1109\/CSNet47905.2019.9108931"},{"key":"3376_CR16","unstructured":"Wu, J., Nan, Y., Kumar, V., Tian, D.J., Bianchi, A., Payer, M., & Xu, D. (2020). Blesa: Spoofing attacks against reconnections in Bluetooth low energy. In WOOT@ USENIX Security Symposium."},{"key":"3376_CR17","unstructured":"Persman, P., & \u00d6jebrant, S. (2021). Security analysis of a smartlock."},{"key":"3376_CR18","doi-asserted-by":"crossref","unstructured":"Mohammed, A.Z., Singh, A., Dayan\u0131kl\u0131, G.Y., Gerdes, R., Mina, M., & Li, M. (2022). Towards wireless spiking of smart locks. In 2022 IEEE security and privacy workshops (SPW), pp. 251\u2013257. IEEE.","DOI":"10.1109\/SPW54247.2022.9833877"},{"key":"3376_CR19","unstructured":"Price, D. The 7 Best Sites for Safe Android APK Downloads. https:\/\/www.makeuseof.com\/tag\/safe-android-apk-downloads\/."},{"key":"3376_CR20","unstructured":"Connor\u00a0Tumbleson, R.W. ApkTool: A tool for reverse engineering Android apk files. https:\/\/ibotpeaches.github.io\/Apktool\/."},{"key":"3376_CR21","unstructured":"Github. jadx - Dex to Java decompiler. https:\/\/github.com\/skylot\/jadx."},{"key":"3376_CR22","unstructured":"Adafruit. Bluefruit LE Sniffer - Bluetooth Low Energy (BLE 4.0) - nRF51822. https:\/\/www.adafruit.com\/product\/2269."},{"key":"3376_CR23","unstructured":"Gatttool: Gatttool. http:\/\/manpages.ubuntu.com\/manpages\/cosmic\/man1\/gatttool.1.html."},{"key":"3376_CR24","unstructured":"snoop log, H. HCI snoop log. https:\/\/www.mybluetoothreviews.com\/what-is-bluetooth-hci-snoop-log\/."},{"key":"3376_CR25","unstructured":"Google. Android Debug Bridge (adb). https:\/\/developer.android.com\/studio\/command-line\/adb?hl=es-419."},{"key":"3376_CR26","unstructured":"Wireshark. btatt Filter. https:\/\/www.wireshark.org\/docs\/dfref\/b\/btatt.html."},{"key":"3376_CR27","unstructured":"Programmerclick.com. ATT (Attribute Protocol). https:\/\/programmerclick.com\/article\/68241335665\/."},{"key":"3376_CR28","unstructured":"Wikipedia. Handle. https:\/\/es.wikipedia.org\/wiki\/Handle."},{"key":"3376_CR29","unstructured":"Wikipedia. Opcode. https:\/\/es.wikipedia.org\/wiki\/Cdigo_de_operacin."},{"key":"3376_CR30","unstructured":"Nuki. Nuki Encryption. https:\/\/nuki.io\/es\/blog\/sientete-seguro\/seguridad-en-primer-plano-concepto-de-cifrado-de-nuki-explicado-de-forma-sencilla\/."},{"key":"3376_CR31","unstructured":"Wikipedia. NaCl. https:\/\/en.wikipedia.org\/wiki\/NaCl_(software)."}],"container-title":["Wireless Networks"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s11276-023-03376-8.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s11276-023-03376-8\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s11276-023-03376-8.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,8,2]],"date-time":"2024-08-02T12:40:32Z","timestamp":1722602432000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s11276-023-03376-8"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,5,27]]},"references-count":31,"journal-issue":{"issue":"6","published-print":{"date-parts":[[2024,8]]}},"alternative-id":["3376"],"URL":"https:\/\/doi.org\/10.1007\/s11276-023-03376-8","relation":{},"ISSN":["1022-0038","1572-8196"],"issn-type":[{"value":"1022-0038","type":"print"},{"value":"1572-8196","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,5,27]]},"assertion":[{"value":"2 May 2023","order":1,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"27 May 2023","order":2,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}}]}}