hey Google unlock the front door can I
have your security code to unlock the
front door okay
unlocking the front door unlocking your
door with a voice command is convenient
but as you just heard most smart lock
makers require a pin for added security
and that extra step can be kind of a
hassle if you want to work around it
there is a way to do that hey Google
unlock the front door okay unlocking the
front door I created an IFFT recipe to
get around the pin code it only works if
you have a z-wave lock connected to a
z-wave hub and you create a custom
command for Google or Alexa like unlock
the front door once you set that up and
you ask it to do that action it'll go
through the hub and unlock the door
without asking for a pin code so setting
up this recipe obviously makes unlocking
your door more convenient but it also
sets your home up for vulnerabilities
like this okay
unlocking the front door
security researcher Brad render man
Haynes brought this exploit to our
attention and it works using an audio
transducer like this one unlike a
conventional speaker that vibrates a
cone of material to produce sound and
audio transducer vibrates the surface
it's attached to turning the entire
thing into a speaker so that's how my
video producer Tyler was able to unlock
our lock from the outside well the voice
command recorded on a phone and the
phone connected via bluetooth to the
vibration transducer he held the
transducer up to a window turning the
entire window into a speaker and that's
how Google was able to hear the command
now obviously if someone we're going to
exploit your home this way they would
need to know a few key facts about your
setup and if you were at home or you had
if notifications enabled you would
definitely notice still it's one reason
why you should always use a pin code
unlocking your door even if it is a
little bit more of a hassle just to be
clear in this video we use a Google home
but the exploit would work with any
voice assistant that allows a custom
command like the exploit requires we
asked August quick set and Yale about
this vulnerability and all three
companies confirmed that the
customization option is possible but
they discourage smart lock owners from
unlocking without a pin and prioritizing
convenience over security
[Music]