The Ghost Key - Illusions of 'Time Management' in TTLock Smart Locks

The talk examines TTLock, a white-label smart lock platform used in rentals, hotels and homes. Its design relies on the lock's clock and on keys issued in advance by the companion app, so the lock trusts a signed packet rather than checking whether that packet is still valid. The presenters began with a lock they owned and an unexpected double unlock, then captured Bluetooth traffic and hooked the Android app to map the command structure.

They found that a single AES key, derived from a default key hardcoded in the app, protects the authorization data, and that the app uploads this key in plaintext to the vendor's cloud. Their scripts, built without the official app, showed that deleting a key on the admin side did not stop it working, that the lock never checked the user ID, and that only the end date was enforced. Clock calibration could move the lock's time backward or forward, reviving an expired keypad code or writing false entries into the unlock log. They also described a cheap Bluetooth connection hold that kept the legitimate owner out.

The takeaway is that offline access control needs a trustworthy clock and server-side key verification. The speakers reported the flaws to the vendor, got no substantive reply within a 90-day window, and published their findings after finding them still present in newer app and firmware versions. Practical advice includes preferring gateway-based revocation, rekeying locks after tenants leave, and never hardcoding keys.