CPL Smart Lock & IoT Security 3 — Questions and Answers
Question 1: What type of cyberattack involves an adversary positioning themselves between a smart lock and its app to intercept and potentially alter communications?
- Brute force attack
- Man-in-the-middle (MitM) attack (Correct answer)
- Denial of service attack
- SQL injection
Correct answer: Man-in-the-middle (MitM) attack
A man-in-the-middle attack intercepts communications between two parties — in this case, the smart lock and its controlling app — without either party's knowledge.
Question 2: A locksmith discovers a smart lock is running firmware from 2019 with no updates applied. Why is this a significant security concern?
- Older firmware uses more battery power
- Known vulnerabilities discovered since 2019 remain unpatched and exploitable (Correct answer)
- Older firmware cannot support BLE connections
- The lock's warranty is void without updates
Correct answer: Known vulnerabilities discovered since 2019 remain unpatched and exploitable
Unpatched firmware contains known security vulnerabilities that attackers can exploit using publicly documented methods, making the device a weak point in the security system.
Question 3: Which of the following is considered a best practice for securing a smart lock's administrative credentials?
- Use the manufacturer's default admin password for easy remembering
- Share the master PIN with all family members for convenience
- Use a strong, unique password for the associated app account with MFA enabled (Correct answer)
- Store the master code written on a sticky note inside the door frame
Correct answer: Use a strong, unique password for the associated app account with MFA enabled
Using a strong unique password combined with multi-factor authentication (MFA) on the app account significantly reduces the risk of unauthorized remote access.
Question 4: What is a 'brute force' attack in the context of a smart lock's PIN keypad?
- Physically breaking the lock mechanism with tools
- Systematically trying every possible PIN combination until the correct one is found (Correct answer)
- Jamming the lock's wireless signal
- Cloning the owner's smartphone to gain app access
Correct answer: Systematically trying every possible PIN combination until the correct one is found
A brute force attack on a PIN keypad involves systematically attempting every possible code combination until the correct one unlocks the device.
Question 5: A smart lock advertises 'end-to-end encryption.' What does this mean for the security of the lock's communications?
- The lock physically encrypts the bolt mechanism
- Data is encrypted on the sender's device and only decrypted on the recipient's device, preventing intermediary access (Correct answer)
- The lock uses WPA2 encryption for Wi-Fi only
- Encryption only applies when the lock is in guest mode
Correct answer: Data is encrypted on the sender's device and only decrypted on the recipient's device, preventing intermediary access
End-to-end encryption ensures that data is encrypted at the source and can only be decrypted by the intended recipient, preventing third parties — including the manufacturer's servers — from reading the data.
Question 6: A locksmith client reports that their smart lock was 'jammed' and temporarily stopped responding to commands. Which attack type is most likely responsible?
- Phishing
- Denial of Service (DoS) / RF jamming (Correct answer)
- Social engineering
- Credential stuffing
Correct answer: Denial of Service (DoS) / RF jamming
RF jamming or a wireless denial-of-service attack can flood a lock's communication channel or disrupt its frequency, preventing it from receiving legitimate commands.
Question 7: When a smart lock vendor discontinues support for an older lock model, what is the primary security risk for the end user?
- The lock will stop functioning entirely
- No more security patches will be issued, leaving known vulnerabilities permanently unaddressed (Correct answer)
- The lock's warranty is extended automatically
- The lock reverts to a mechanical-only mode
Correct answer: No more security patches will be issued, leaving known vulnerabilities permanently unaddressed
End-of-life status means the vendor will no longer release security updates, so any newly discovered vulnerabilities in that firmware will never be patched.
CPL Smart Lock & IoT Security 3
What type of cyberattack involves an adversary positioning themselves between a smart lock and its app to intercept and potentially alter communications?