Master Lock — the company synonymous with "lock" — made a smart padlock where: the API leaks the unlock code to guests, revoking access doesn't work, the anti-theft PIN is stored in plaintext, and attackers can erase the audit log. The digital lock is less secure than a $5 combination padlock from 1970. Presented at USENIX by researchers who could not believe what they found.
What they claim: Master Lock promotes smart padlocks as convenient, secure access control
What we found: USENIX WOOT 2025 researchers found the Master Lock smart padlock API leaks primary unlock codes to guest users — who retain access even after revocation. The mobile app is unobfuscated, API endpoints use hard-coded static credentials, the anti-theft PIN is stored in plaintext on the device, and malformed Bluetooth messages cause denial-of-service. Attackers can also forge audit events and suppress real ones.