Testing the security of the Kwikset Kevo Bluetooth Door Lock

-Hey, what's happening in CNET? I'm Ry Crist and I'm here with a big update on the Kwikset Kevo Bluetooth deadbolt. Now, I reviewed this lock last week and we gave it a very high mark. We thought it was a very good smart lock. However, some issues were brought up in the comments that we looked into and we wanted to investigate further, primarily the security of the deadbolt itself. Now, the Kevo is basically two products in one. You've got the Kevo itself, which is the outer rim of the lock. It's this touch-controlled, Bluetooth, wired device that you plug into the back casing and it lights up when you touch it. It controls the deadbolt. The inside is the second part. This is the Kwikset SmartKey deadbolt. Now, this is just the inside chamber, but this is the second piece of hardware in the Kevo and this was something that we didn't really test. We didn't see how strong it was. We didn't try and pick it because we don't know how to pick locks and we don't have the equipment needed to determine exactly how strong it is. What we do is we rely on the standard by organizations that are certified to test these things. Underwriters Laboratories test how well it is against lock picking and it's one of the highest graded locks you can find. It's got the top ranking that say it's basically impossible to pick. But if you go on Youtube, you will find videos and you'll find articles through Google that say this is not that great of a lock. The Kwikset SmartKey deadbolt is just a flawed lock. It's got some security problems. If you stick the right tools in it, you execute the right technique, you can get this lock open without a key. We want to know if that was true because, if so, it's a legitimate concern for people who wanna use this lock. What we did was we brought in some additional Kevo locks and we installed them on our test floor and we decided to make a bit of a graded scale to figure out how easy these techniques are if they work at all. We want to imagine your typical idiot thief, someone who is not very skilled, who doesn't really have a lot of specific knowledge, who just maybe saw this video on Youtube, grabbed a screwdriver off the shelf and wanted to go try and hack a lock. So, I played that role. We tried to hack the lock. I ended up breaking into the lock in terms of tearing the face of it off, but that's not a big deal. That doesn't actually turn the deadbolt. As you can see, I didn't get the deadbolt open. So, without the exact right tools, this trick didn't work. However, the next step we tried was more of the amateur as opposed to the idiot thief. Now, this guy was played by our technician, Steve. And Steve has a lot of experience with hardware and tools. He's worked with locks before, so he has some good know how on how they work. He used the exact right screwdriver and the exact same wrench used in the video. Everything was replicated and Steve, on his very first try after about 5 or 6 minutes of jiggling the lock was actually able to get it open. So, we have confirmed that this is a problem. This technique works if you know what you're doing. If Steve practiced a little more, I'm sure he could do it even more cleanly. He could probably do it faster and without destroying the lock quite so much. Now, going even beyond Steve, an amateur lock picker, we wanted to talk to a pro about this. We brought in a local locksmith and here is what he had to say about the Kevo and its security flaw. So, I'm here with Chris Linn from Cook Locksmith services here in Louisville, Kentucky; and we are looking at both a blank Kevo here that hasn't been touched yet and also the Kevo that we just saw Steve get into. So, Chris, what can you tell us about this broken Kevo? What did Steve do that made the lock open? -What it is is you basically take a select cut key, stick it in the lock. -Uh-huh. -It will kinda lets it think that there is a key inside and then you take a pressure tool, which will be used like a screwdriver or Kwikset actually makes a tool for opening this lock. -Uh-huh. -Apply the right amount of pressure to it. It allows the sidebar to retract into the lock, which it is not supposed to due to the fact that it's not the right key being in. And when you wear it in, it makes it easy for you to pressure it over, turn it to where you can open the house, get it. It's not as secure as they want it to be. They need to probably add something a little more in there to make that permanently secure like they want it to be. Some guy, any library can look up a video on it and go out and break in your house. The Bluetooth technology in this is actually pretty nice. I like that feature, but all technology is hackable. -So, just to demonstrate, this is locked right now. We turned the Bluetooth light up, the touch functionality off right now for this test. We have the tools here, the tension wrench, hammer, screwdriver, and then the-- a couple other options then also the key blank that's used in the video. -You know, insert your key blank into the smart lock. And when you do that, this key way is not big enough for you to actually insert your screwdriver into. So, what we're gonna do with the hammer is we're gonna smack the hammer to allow to punch through the first paracentric in the bottom to give you enough room in here to actually get your screwdriver into it. It's mainly made of hard metal. This-- Doesn't take 5 blinks and you're right there. And then if you wanna give it a couple more just to ensure it. Now, given where your position is and your vise grips, fighting against this handle is gonna be a bit of a pain. I'm gonna do is come up above it. Get a better grip. Now that my key blank that I put in there is stuck in there, they won't be able to put their key in to try to debolt. -Right. -So, you will notice either your lock has malfunctioned or you'll notice a lot of your stuff being gone in the house and somebody came by and Christmas shopped at the house. -But it's just that easy and that-- when you do that, I think, 30 seconds, maybe a minute and the lock doesn't appear to be damaged, nothing is bent,-- -Yeah. -you did a much better job than we did and angled it-- -You can't tell that I even came by and did the-- -And do you know of any other locks aside from the SmartKey deadbolt that have this specific problem with, you know, sticking a blank key and a screwdriver and twisting it with a torque wrench? -No, because the only thing that lock depends on is that sidebar. -Uh-huh. -And a sidebar will just spring load it. As you can tell, it just came right open. -Kwikset told us that this Kevo deadbolt, the SmartKey in the Kevo, is an updated version. It's model 925 and that the Youtube video model that was tested wasn't a Kevo. It was the model 980, a previous SmartKey. It is said that there is some security enhancements in this deadbolt to prevent attacks like this, but that doesn't look to be the case. This lock is hackable. Now, the question is, is this a big deal? I think it's a deal. I don't know how big it is. Yes, this lock is hackable, but a lot of locks can be broken into. A lot of locks can be forced to open with brute force. From our sources, the majority of burglaries are forced entry so the fact that this lock is vulnerable to forced entry is concerning. However, if someone wants to get into your house badly enough, they can do it. This lock does function very well. It's a smart lock. It does do what you want it to do in terms of touching it, getting in, and recognizing your phone. And it will provide a very basic level of security as a deadbolt, but it will not provide 100 percent peace of mind because if someone knows this trick and has watched that video and knows a thing or two about locks, they'll be able to get in. They'll need to know that you have the specific deadbolt if you need to case your joint, but if they do that, they'll have a way to get in and that's kind of unsettling if you are away on vacation for a week. So, I don't know if I can recommend this lock anymore and that's disappointing because I like the Kevo a lot. I think UniKey made a great product and it's just a shame that the Kwikset deadbolt inside of it isn't as good as it needs to be to really reassure you when you're buying that lock. The important takeaway of the Kevo is that it is a convenient and cool lock, but it's not as secure as it needs to be. If you want a smart lock, I would wait and see what August and Goji have to offer because they're coming out soon and they look pretty interesting. I would also wanna wait and see if the Kevo gets better because if they improve that lock, if they fix this problem, then it's a great lock and one that I will rush out to buy. But until then, I'm gonna hold and I'm gonna wait. For CNET, I'm Ry Crist.