Smart lock picking - BLE, NFC, RFID security training, tutorials, hacking, resources

Orangecon 2025 Amsterdam training

Mon, 10 Mar 2025 00:00:00 +0000

Bluetooth Low Energy (BLE) and NFC/RFID are widely used wireless technologies that power a broad range of devices, from IoT gadgets and toys to high-stakes systems like access control systems, smart locks, medical equipment, and payment solutions. With the rapid growth in the number of such devices, securing them has become a critical priority, driving a surging demand for specialists in this field. This unique hands-on course meets this demand by providing a thorough overview of the security of BLE and NFC technologies, along with practical, real-world skills that are immediately applicable.

BlackHat USA 2025 training

Sat, 01 Feb 2025 00:00:00 +0000

This intensive two-day training provides a deep dive into Bluetooth Low Energy security, equipping cybersecurity professionals with advanced skills to identify, analyze, and exploit vulnerabilities in BLE devices. The session begins with the foundational exploration on how this technology works by interacting with your dedicated, included device: understanding BLE broadcasting (advertising device presence, trackers, beacons) and connections (services, characteristics, GATT reading/writing/notifications). You will quickly turn on your simulated “lightbulb” and surprisingly - you will already be able to take control over so many devices that do not implement any security mechanisms at all.

OutOfTheBox Jakarta 2025 training

Fri, 10 Jan 2025 00:00:00 +0000

Hardwear.io 2024 USA

Tue, 30 Jan 2024 00:00:00 +0000

Bluetooth Low Energy is one of the most common and rapidly growing IoT technologies. We are immersed in surrounding BLE signals: phones, beacons, wearables, TVs, home appliances, toothbrushes, sex toys, light bulbs, smart locks, electric scooters, cars, medical devices, crypto wallets, 2FA, banking tokens, payment terminals - to name just a few. Unfortunately the prevalence of technology does not come with security. Alarming vulnerabilities are revealed day by day – not only in individual devices’ implementations, but also generic: in the Bluetooth specification itself. And yet, the knowledge on how to comprehensively assess security of such devices still remains uncommon. This training aims to fill this gap, with the best possible - hands-on approach.

Hardwear.io 2023 Netherlands

Tue, 01 Aug 2023 00:00:00 +0000

HackInTheBox 2023: Hands on Hacking BLE and NFC/RFID trainings

Mon, 30 Jan 2023 00:00:00 +0000

This unique hands-on course combining BLE and NFC security trainings aims to provide solid understanding of security aspects for both technologies, along with practical skills and included hardware tools for hands-on exercises.

For 2023 there are two onsite editions: Amsterdam, Netherlands in April and Phuket, Thailand in August.

HITB SecTrain: Hands on Hacking BLE and NFC/RFID trainings

Wed, 30 Mar 2022 00:00:00 +0000

Several editions are scheduled for 2022 - both traditional (in-person) and online, suitable for various time zones around the world.

HackInParis 2021 training

Wed, 01 Sep 2021 00:00:00 +0000

Bluetooth Low Energy is one of the most exploding IoT technologies. BLE devices surround us more and more – not only as wearables, toothbrushes and sex toys, but also smart locks, medical devices and banking tokens. Alarming vulnerabilities of these devices have been exposed multiple times recently. And yet, the knowledge on how to comprehesively assess their security seems very uncommon. This is probably the most exhaustive and up to date training regarding BLE security – for both pentesters and developers.

HITB SecTrain online BLE training

Mon, 04 Jan 2021 00:00:00 +0000

The training has been prepared for remote hands-on participation. Each attendee will receive a hardware pack of 200 USD value, shipped in advance (please register as soon as possible!). The hardware includes among others a preconfigured Android smartphone, BLE sniffer, BLE dedicated training device and Raspberry Pi (details below). With the specially arranged setup, participants will be able to perform hands-on practical exercises not only during virtual session but also any time later.

Bluetooth Low Energy HackMe: the best way to learn BLE security basics while having fun!

Tue, 17 Nov 2020 00:00:00 +0000

Bluetooth Low Energy hardware-less HackMe is a free tool that aims to help getting familiar with the very basics of ubiquitous BLE technology and its (in)security - without the need of any dedicated hardware, nor sophisticated prior knowledge. It is based on a specially designed software (running on a typical Windows 10 laptop) - which simulates various BLE devices, on the radio layer working exactly the same as real ones. Hands-on challenges of increasing level - starting with simple introduction up to unlocking smart locks - allow for practical experience, the best possible way to learn.

BlackHat EU 2020 Arsenal

Tue, 10 Nov 2020 00:00:00 +0000

The new BLE hardware-less HackMe will be showcased during BlackHat EU 2020 Arsenal session.

HackInTheBox Cyberweek 2020 virtual lab

Mon, 09 Nov 2020 00:00:00 +0000

During upcoming HITB Cyberweek 2020’s 2 hour virtual hands-on lab “introduction to Bluetooth Low Energy security”, a new BLE HackMe will be introduced. It is an educational application which simulates various BLE devices to interact with, running on a standard Windows 10 computer (no special hardware required). In a series of tasks to solve you will get familiar with BLE advertisements, beacons, connections, take control over BLE smart bulb, reverse-engineer the communication protocol, brute force passwords, and hack real smart lock. An Android phone which will connect to the simulated device is recommended for solving the tasks.

HackInTheBox Singapore (online) training

Fri, 22 May 2020 00:00:00 +0000

The training has been updated for remote hands-on participation. Each attendee will receive a hardware pack worth over 300 USD shipped to you in advance (please register as soon as possible!). The hardware includes among others Proxmark 3, Chameleon Tiny, a rooted Android smartphone, BLE sniffer, BLE dedicated training device and Raspberry Pi (details below). With the specially arranged setup (simulated, working exactly like real NFC and BLE devices), participants will be able to perform hands-on practical exercises remotely – BLE analysis (sniffing, intercepting), cloning and cracking multiple kinds of proximity cards, analysing BLE or NFC mobile applications – not only during training but also any time later.

HackInTheBox Amsterdam 2020 training [cancelled]

Tue, 10 Dec 2019 00:00:00 +0000

Due to COVID-19 the event has been cancelled Organizer’s statement: Out of an abundance of caution for our speakers, crew, volunteers and of course attendees, we have decided that it is in everyone’s best interests to cancel HITBSecConf2020 – Amsterdam. More information: https://conference.hitb.org/hitbsecconf2020ams/ Training description Bluetooth Low Energy is one of the most exploding IoT technologies. BLE devices surround us more and more – not only as wearables, toothbrushes and sex toys, but also smart locks, medical devices and banking tokens.

Cyberweek Abu Dhabi 2019 training

Sun, 01 Sep 2019 00:00:00 +0000

Bluetooth Low Energy is one of the most exploding IoT technologies. BLE devices surround us more and more - not only as wearables, toothbrushes and sex toys, but also smart locks, medical devices and banking tokens. Alarming vulnerabilities of these devices have been exposed multiple times recently. And yet, the knowledge on how to comprehesively assess their security seems very uncommon. Not to mention best practices guidelines, which are practically absent.

HackInParis 2019 workshops

Mon, 10 Jun 2019 00:00:00 +0000

During upcoming HackInParis 2019 I will present a series of introductory workshops about security of NFC Mifare Classic and Bluetooth Low Energy. The workshops are short (45min each session), but packed with practical knowledge and hopefully entertaining - performed on a real access control installation, hotel lock and BLE smart locks. Most hands-on exercises will be possible to complete using just a phone, and easy to follow.

Magic NFC business card

Sat, 04 May 2019 00:00:00 +0000

Many access control systems still rely just on the UID of the card. It is a unique number, generated during manufacturing, read-only and impossible to change. There are however special, unofficial “Magic UID” cards (like my business card) that allow to set any UID - clone it from other cards. It takes just a few seconds with the new “one click” cloning feature that I have contributed to free Mifare Classic Tool Android application.

HackInParis 2019 training

Sun, 20 Jan 2019 00:00:00 +0000

During this training we will focus on two technologies implemented very commonly in various IoT devices, including among others smart locks and access control systems : BLE and NFC/RFID. Bluetooth Low Energy (Smart, 4) is one of the most popular and rapidly growing IoT technologies. Unfortunatelly the prevalence of technology does not come with security, and the knowledge on how to comprehensively assess such devices seems very uncommon. This training aims to address this need.

HackInTheBox Amsterdam 2019 training

Thu, 10 Jan 2019 00:00:00 +0000

Hardwear.io 2018

Sun, 12 Aug 2018 00:00:00 +0000

Bluetooth Low Energy (Smart, 4) is recently gaining more and more traction as one of the most common and rapidly growing IoT technologies. Unfortunatelly the prevalence of technology does not come with security. Alarming vulnerabilities in BLE smart locks, medical devices and banking tokens are revealed day by day. And yet, the knowledge on how to comprehensively assess them seems very uncommon. In this workshop you will get familiar with the basics of BLE security.

Alligator 2018

Fri, 10 Aug 2018 00:00:00 +0000

In this workshop you will get familiar with the basics of BLE security. We will work on a dedicated, readily available BLE hardware nRF devkit device. In a minutes you will turn into embedded developer and learn how to program your own BLE device yourself, using a free web interface and ready templates. Next, from attacker’s perspective, we will cover among others: sniffing, spoofing, MITM, replay and relay. Having enough time, we will play with a collection of vulneraBLE smart locks, sex toys and other devices.

Confidence 2018: NFC research toolkit

Wed, 30 May 2018 00:00:00 +0000

During upcoming Confidence conference in Krakow, we will celebrate 15 years of SecuRing. On this occasion the we will share with you several NFC “research toolkits” hardware sets - that among other things allow to clone card UID and crack Mifare Classic. Come meet us at our booth and solve the NFC challenges to win one!

Also be sure to attend my introductory talk on NFC security “A 2018 practical guide to hacking RFID/NFC” track 1 Jun 4th 11:50am.

Update: slides are available to download here.

HackInParis 2018 training

Tue, 12 Dec 2017 00:00:00 +0000

You can, quite reasonably, expect smart locks and access control systems to be free from alarming security vulnerabilities - such a common issue for an average IoT device. Well, this training will prove you wrong. After performing multiple hands-on exercises with a dozen of real devices and various technologies, you will never look at the devices the same way. During this course students will perform: wireless sniffing, spoofing, cloning, replay, DoS, authentication and command-injection attacks.

How to pick a BLE smart lock and cause "cancer" using just a mobile phone

Wed, 25 Oct 2017 00:00:00 +0000

Behold The Smart Lock! In case anyone would doubt its smartness, it is literally imprinted. Fitted with an enormously loud speaker - advertised as a feature to raise a solid anti-thief alarm. Using the same speaker for a normal unlock notification, thus enforcing you to cover your ears while opening, was not the smartest idea though. Security? Smart my shiny metal (…)!

Enough smart for the introduction. Give me the meat! TLDR exploit.

HackInTheBox Amsterdam 2018 training

Tue, 10 Oct 2017 00:00:00 +0000

My smart lock vendor disappeared and shut the servers. Long live my smart lock!

Wed, 27 Sep 2017 00:00:00 +0000

One of my smart locks, Okidokeys, unexpectedly just turned into a brick, and this time for a change I had nothing to do with it ;) The mobile application barked at me: “Login request has failed. Please try again”. And the more I tried again, the more the login request failed. I finally discovered the vendor’s application server was shut down. And suddenly recalled shutting down their official website, Twitter and Facebook accounts a while before, but did not consider it important back then. Now as it turns out, also the phone number and e-mail server is dead. Following a quick investigation I found out they have been acquired in the meantime. By translating French forum I also realized some locks are undergoing a migration procedure to a new system, and the users are supposedly being notified. I did not get any notification - maybe because based on the serial number my lock was apparently destined for ‘American market’. That market was not covered by the acquisition, and therefore my device is not eligible for migration, as many others also just found out. I guess we can’t count on support any more. I wonder how many of the > 5000 customers (approximation based only on Android mobile application installs) have the same problem. And as of today there is still plenty of offers on US Amazon and Ebay.

Deepsec training

Fri, 01 Sep 2017 00:00:00 +0000

There is no doubt electronic locks are among the most profitable smart devices to attack. And yet recent disclosures of multiple vulnerabilities clearly show there are not enough specialists able to help with software-related issues of so-far mostly hardware vendors. This course is intended to fill this skills gap. Based on hands-on exercises with real devices (a dozen various smart locks), attendees will learn how to analyze their security and design them properly.

Brucon workshop

Thu, 31 Aug 2017 00:00:00 +0000

Recently it seems our home/car/bicycle locks have started to follow a new trend: to include a BLE chip inside to make them “smart”. Unlike smart toothbrushes, socks or kettles, locks guard our safety, and their security should be much more of a concern. Vendors promise “military-grade level of security”, “128-bit encryption” and “cryptographic key exchange protocol” using “latest PKI technology”. However, recent disclosures of multiple vulnerabilities in smart locks clearly contradict the assurances on the actual security provided, and raise the question of whether these devices have passed any independent security assessments at all!

Bluetooth Smart Hackmelock

Wed, 12 Apr 2017 00:00:00 +0000

Bluetooth Smart locks did not have a good press recently regarding their security. One of the reasons may be lack of knowledge, as well as insufficient number of professionals to assess and secure such devices. This project helps to develop relevant skills and allows to practice BLE hacking without the need of having the physical vulnerable hardware.

HackInParis training

Wed, 12 Apr 2017 00:00:00 +0000

Learn how to assess and secure IoT devices by having fun with hacking a dozen of devices among most profitable to attack - smart locks. The agenda will include: wireless sniffing, spoofing, cloning, replay, DoS, authentication and command-injection attacks, analyzing proprietary network protocols, breaking “Latest PKI technology”, abusing excessive services… The software-focused activities will be mixed with short entertaining tricks like opening lock by a strong magnet, counterfeiting fingerprints in biometric sensor or opening voice-controlled lock by hacking nearby speaking toys.

Appsec EU Training

Tue, 11 Apr 2017 00:00:00 +0000

There is no doubt electronic locks are among the most profitable smart devices to attack. And yet recent disclosures of multiple vulnerabilities clearly show there are not enough specialists able to help with software-related issues to so-far mostly hardware vendors. This course is intended to fill this skills gap. Based on hands-on exercises with real devices (we will have fun hacking a dozen various smart locks), you will learn how to analyse their security and design them properly.

HackInTheBox Amsterdam

Mon, 10 Apr 2017 00:00:00 +0000

Bluetooth Low Energy security, NFC/RFID hacking hands-on practical trainings: public, private, onsite, virtual, online

Mon, 01 Jan 0001 00:00:00 +0000

-- A list of public (upcoming and past) trainings is available in Events->Training section. Can’t make it to public training? A tailor-made training will come to you! Tailor made Unlike standard courses, the flexible program adapts to your unique organizational context and learning objectives. Whether you’re a team of developers, managers or penetration testers, we’ll emphasize the skills and knowledge that directly impact your work. Setting the perfect pace and time Choose a duration that fits your goals, from one-day awareness to comprehensive five-day programs.

Contact information

Mon, 01 Jan 0001 00:00:00 +0000

Want to organize a workshop or private training? Would like to test security of a device? Have some questions or ideas to share? -- hello@smartlockpicking.com smartlockpick slawekja smartlockpicking

Presentations, videos: security, hacking Bluetooth Low Energy, NFC/RFID, smart locks...

Mon, 01 Jan 0001 00:00:00 +0000

BlackHat EU 2020 Arsenal More info: https://www.blackhat.com/eu-20/arsenal/schedule/index.html#ble-hardware-less-hackme-21785 Slides: BlackHat EU 2020 Arsenal BLE hardware-less HackMe (PDF, 8M) HackInTheBox Cyberweek 2020 Lab More info: HackInTheBox Cyberweek 2020 virtual lab Slides: A practical introduction to BLE security without any special hardware (PDF, 16M) Recording: HackInParis Workshops More info: HackInParis, 2019.06.19-20 Slides (PDF): Cracking Mifare Classic on the cheap (PDF, 4M) A 45min introduction to Bluetooth Low Energy (PDF, 6M)

Smart lock picking - BLE, RFID, NFC security training and resources

Mon, 01 Jan 0001 00:00:00 +0000

-- Let’s start with resolving the security pitfalls of IoT devices from the ground up, before they will even appear. One of the keys is knowledge. The ultimate, yet painful way to learn - is by making mistakes. But what if you could learn on the mistakes of others? Sounds fun? Based mostly on real smart locks and access control systems, learn how to assess security of devices, and how to help vendors make them better.