In 2017, Amazon released Amazon Key, a smart-home IOT product that lets Amazon deliverers open your door to drop off your packages. It’s a system that includes a motorized door lock and a camera. The former gets installed on the door that you want to receive deliveries at. The latter is meant to be placed to give you full view of the door and delivery area. The idea is that your Amazon deliverer can unlock your door with their Amazon app, drop off your package, and re-lock your door while you have full view of the process through the camera. As long as you’re not worried about your deliverer intentionally doing something malicious, the idea seems sound. If you’re at all aware of the sorry state of IOT device security, however, Amazon Key should be massive red flag.

Case in point, someone has revealed a new vulnerability in Amazon Key that supposedly allows a third party to enter a house after delivery. A video, released on Twitter, shows a demonstration of it occurring. First, the third party hides a small device in the a lamp near a door. After the deliverer drops off the package and leaves, the third party returns to find the door unlocked. The demonstrator then shows that when the door unlock is triggered in the app, the door physically unlocks while the app loops with its status reading “unlocking...”. After a short while, the door lock makes a sound before the app briefly flashes a status that says the unlocking event timed out. The door remains unlocked, however, and the app does not log any unlocking event.

No details on what the hidden box is doing or the nature of the vulnerability were revealed because the demonstrator is withholding the details until Amazon fixes the issue. The demonstrator claims that the Amazon Key this was tested on uses the most current software.

We don’t know exactly what is happening in this exploit, but the unlocking timeout brings to mind an earlier exploit shown off late last year. Rhino Labs, who discovered it, explained that by DDOSing the Amazon Key system after the unlocking event, they could both prevent re-locking and freeze the image transmitted by the camera. Rhino’s scenario showed how the DDOS could be executed right after the door closes but just before the door locks. A third party could then enter, while the camera continues to show a closed door, before ending the DDOS attack and allowing the door to lock. Again, we can’t say these exploits are related, but the hidden device that plays a role in the new exploit certainly suggest some kind of Wi-Fi DDOS is involved.