Hackers can now clone your keys just by listening to them with a smartphone

Every time you unlock your front door, your key whispers a small, but audible, secret. Hackers finally learned how to listen. 

Researchers at the National University of Singapore published a paper earlier this year detailing how, using only a smartphone microphone and a program they designed, a hacker can clone your key. What’s more, if a thief was able to install malware on your smartphone, smartwatch, or smart doorbell to record the audio from afar, they wouldn’t even need to be physically nearby to pull off the attack. 

The key (ahem) to the attack, dubbed SpiKey, is the sound made by the lock pins as they move over a typical key’s ridges.

“When a victim inserts a key into the door lock, an attacker walking by records the sound with a smartphone microphone,” describes the paper written by Soundarya Ramesh, Harini Ramprasad, and Jun Han.

With that recording, the thief is able to use the time between the audible clicks to determine distance between the ridges along the key. Using this information, a bad actor could then compute and then produce a series of likely keys. 

“[On] average, SpiKey is able to provide 5.10 candidate keys guaranteeing inclusion of the correct victim key from a total of 330,424 keys, with 3 candidate keys being the most frequent case,” reads the study. 

In other words, instead of fooling around with lock-picking tools, a thief could simply try a few pre-made keys and then stroll right through the victim’s door. 

Of course, there are some limitations in the real world. For staters, the attacker would need to know what type of lock the victim has. That information can be figured out by simply looking at the exterior of the lock, though.

Second, the speed at which the key is placed into the lock is assumed to be constant. But the researchers have thought of that, too. 

“This assumption may not always hold in [the] real-world, hence, we plan to explore the possibility of combining information across multiple insertions,” they explain. 

It’s worth noting that at present this is a relatively easy attack to defeat. Simply make sure no one is around you, recording, when you put your key into a lock. However, that won’t always be the case. 

“We may exploit other approaches of collecting click sounds such as installing malware on a victim’s smartphone or smartwatch, or from door sensors that contain microphones to obtain a recording with higher signal-to-noise ratio,” explain the study authors. “We may also exploit long distance microphones to reduce suspicion. Furthermore, we may increase the scalability of SpiKey by installing one microphone in an office corridor and collect recordings for multiple doors.”

SEE ALSO: Police used ‘smart streetlights’ to surveil protesters, just as privacy groups warned

In other words, they’re already thinking about ways to make this attack easier to pull off. And, sorry, so-called smart locks just present their own security issues. Amazon’s Ring security cameras, remember, are hacked all the time. And as the researchers postulate, a hacker could, in theory, use the microphone embedded in such a camera to capture the sounds your key makes and then use the SpiKey technique to produce physical keys to your home. 

However, if a hacker got access to your Ring, there are easier ways to clone your key than listening to it. Even so, maybe make a little noise when unlocking your door going forward. Your neighbors may think you’re a tad weird, but at least they won’t be able to use SpiKey to break into your place.