-[Zack] There have been a lot of rumors on the internet
that I am secretly the Lock Picking Lawyer.
-[The Lock Picking Lawyer's voice] This just isn't true.
-[Zack] I do however like to review locks every now and then,
and today we'll be reviewing a Visionis outdoor facial recognition lock.
-[LPL] As the name suggests, this device can see your face,
compare it with an internal database and then decide whether or not to allow access.
-[Zack] Facial recognition might sound secure, but today I'll be showing you how a high tech
lock like this can be defeated with an ultra low-tech bypass. Let's get started.
[Intro]
This lock costs about $300 on Amazon. It features a 4.3 inch touch screen, and
dual 720p wide angle cameras that do the facial unlocking. Having two cameras supposedly helps
defeat any facial spoofing. Also, the Visionis has enough internal storage to hold 1500 faces.
-[LPL] Which when taken out of context sounds pretty creepy. But before we wire this up
and install it, let's take it apart and see if there's anything that gives cause for concern.
On the back there are 6 very common torque screws holding down the large metal panel.
-[Zack] Once that panel is off we can see the large teal colored thermal foam cooling pad
over the internal processor, along with the white rectangle up top.
This helps transfer heat from the processor to the back metal panel.
This facial recognition lock is ip65, which means it can be mounted outdoors. And judging
by the rubber gasket around that inner edge, I have no reason to doubt that ingress protection.
-[LPL] However, the protection I do doubt comes in the form of this small electromagnetic relay.
It's just like the ones I use to control a variety of peripherals and systems in my ongoing EV Hummer
project. Obviously, this one is a lot smaller, but also doesn't need to handle as much current.
Presumably, this controls the flow of electricity to whatever device holds the door closed.
If so, that could be a major security flaw. It may allow the lock to be tripped by
holding a magnet to the outside of the unit. That's something we're going to test later.
-[Zack] For now, let's put this back together, wire it up, and see how well it actually works.
There is a wiring harness that plugs to the back of the unit before it's mounted on the wall.
You can see there are a rainbow of wires, most of which I will not be
using today. These allow the device to be set up in several different ways.
-[LPL] It can be used as a standalone system, or as part of a network of access control devices.
These different arrangements offer varying degrees of security. Since I do not have
a network of access control devices, I'm going to set this up as a standalone system.
-[Zack] That system is simulated with this demo board which has three main components, a 12 volt
transformer which supplies power to the system. Then we have a button that would be securely
placed inside the building to let people exit. Then we have the electronic strike itself which
would lock the door when it's powered. If the power ever goes out, the door unlocks, which would
insure that people won't ever be trapped inside. This is common and required by many fire codes.
-[LPL] Now it's time to wire the harness to the demo board. I'll spare you the nitty
gritty. The wires are now connected as shown in the instructions for a standalone system.
Basically we have 12 volts powering the facial recognition unit,
which then supplies power to the electronic strike, keeping it in the locked position.
The exit button is also connected to the same base unit. The rest of the wires are not required
in a standalone system, nor will they provide additional security unless we network this to a
centralized access control system. That would be uncommon outside of large commercial facilities.
-[Zack] Now, moment of truth, let's power this up.
With the lock powered on, the strike is secured,
unless we press the exit button from inside the building. [Beeping sounds]
To set up the facial recognition, I'll activate the device with a pass code and set myself as
the administrator. I'm pleased to see that this unit does not require an external app to operate.
-[LPL] With my face now locally stored inside the base unit...
-[Device voice] Thank you.
-[LPL]...we can check the dual camera recognition.
-[Device voice] Thank you.
-[LPL] It does indeed work and surprisingly fast.
When my face is not present, the strike remains in the locked position. Just for kicks and giggles,
I'll try using a picture of my face to spoof the lock. But with dual cameras providing depth to
the facial recognition software, there's no surprise that the lock remains secure.
-[Zack] However, if you recall, I previously saw something that might be of concern
inside the unit. There was a small relay, which is essentially a switch controlled
by an electromagnet. And of course, if an internal magnet can actuate the switch,
so too can a sufficiently powerful external magnet. Let's see if my concern was justified.
-[LPL] You can see the unit is currently locked. However,
if we bring the magnet close to that internal relay located near the bottom,
even without my beautiful face in front of the cameras, it still magically opens.
Not ideal for security. It's always interesting to see new lock technologies brought to the market.
-[Device voice] Thank you.
-[LPL] This one did seem to perform reasonably well when presented with my face.
And equally important, it did not unlock when presented with a picture of my face.
-[Zack] That said, a $300 lock being defeated in moments by a zero skill attack involving a $10
magnet is simply inexcusable. If Visionis would have used some form
of solid state power switching, this would not have been a problem
because there would be no moving parts to magnetically manipulate.
Unfortunately, the company did not do that and this lock is not secure.
-[Device voice] Thank you.
-[LPL] If you are interested in learning more about lock defeat methods,
you can always go subscribe to that Lock Picking Lawyer guy who is definitely not me.
-[Zack] But he does seem like a pretty funny, and clever guy.
-[LPL] Maybe even one of the funniest around.
-[Zack] I don't think I would go quite that far.
-[LPL] But then again, maybe I would.
-[Zack] But what I can confirm without hesitation
is that I'm definitely not the Lock Picking Lawyer.
-[LPL] In any case, that's all I have for you today.
-[Zack] Hit that subscribe button if you haven't already.
-[LPL] If you do have any questions or comments about this, please put them below.
-[Zack] And thanks a ton for watching. I'll see you around.