Breaking Amazon lockers by any means necessary

The talk starts from a practical question: Bluetooth Low Energy lockers hold millions of parcels, and porch thefts make them look like a safer option. The speaker began by scanning a locker's advertising data and GATT characteristics, then recorded phone-to-locker traffic in Wireshark. Comparing repeated pickups while changing one variable at a time, he mapped a CBOR-style message format, found a timestamp that worked against replay, and identified the packet that opened a slot. Forging that command failed, because the locker and the app perform mutual public-key authentication.

He then shifted to the phone side. Intercepting the app's traffic and bypassing certificate pinning showed that the open command and session credentials come from Amazon's servers, but the locker still rejected anything it could not verify. Next came the hardware. Documents and leaked maintenance videos from the manufacturer pointed to a board bought cheaply online, whose firmware had no readout protection, but the firmware turned out to be test code, not the production protocol. Physical attacks on the slot locks followed, including key-pattern analysis and custom key fabrication.

The main takeaway is about persistence across attack surfaces. Each dead end pushed the work toward a different layer, and the talk presents the locker as a case study in why a well-designed cryptographic protocol can still leave the mechanical and manufacturing layers exposed.