Amazon Key, a new service unveiled in October that allows couriers for the e-commerce giant to unlock doors to drop off packages, could be manipulated by would-be burglars or those same delivery people, through a flaw exposed by security researchers, according to a report.

Rhino Security Labs, a Seattle-based penetration testing company, discovered that the Cloud Cam required for use of the service can be disabled and frozen through a program that can be installed with relative ease on a handheld device, according to a report on Thursday by Wired.

The glitch, security experts warn, could allow rogue Amazon couriers to enter homes legitimately to drop off deliveries before leaving the property and freezing the camera on an image of the closed door—then subsequently returning, this time undetected by the disabled camera. Using the Key app, Amazon Prime subscribers would see the courier enter and leave, but would not be notified of his or her illicit return, Rhino Security Labs experts told Wired.

Beside couriers, the flaw could be exploited by enterprising burglars, who could theoretically run the so-called ‘deauth command,’ or ‘deauthentication command,’ immediately following a delivery of Amazon products. Of course, that would require a thief to closely follow the courier.

A request for comment on the flaw from Amazon wasn’t immediately returned, but a spokesperson told Wired on Thursday that the company was working on an update to the application.

“Later this week we will deploy an update to more quickly provide notifications if the camera goes offline during delivery,” a spokesperson told Wired.

Unveiled in October, the Amazon Key application and service are technically free to use, but, in addition to subscription fees for Amazon Prime, an Amazon Key In-Home Kit containing the smart lock and Cloud Cam costs $250. Key also works with locks from Kwikset and Yale.

Currently available in 37 metropolitan markets, Amazon Key can also be used to allow entry for cleaners, dog walkers, repair technicians and visiting relatives, the company announced.

In addition to Amazon, several other companies are already targeting the real estate industry with smart lock app integrations and digital lockboxes, including Master Lock, Toor, August Home and Prempoint, each with varying remote unlocking and security features.

Email Jotham Sederstrom

Show Comments Hide Comments
Sign up for Inman’s Morning Headlines
What you need to know to start your day with all the latest industry developments
By submitting your email address, you agree to receive marketing emails from Inman.
Success!
Thank you for subscribing to Morning Headlines.
Back to top
×
Log in
If you created your account with Google or Facebook
Don't have an account?
Forgot your password?
No Problem

Simply enter the email address you used to create your account and click "Reset Password". You will receive additional instructions via email.

Forgot your username? If so please contact customer support at (510) 658-9252

Password Reset Confirmation

Password Reset Instructions have been sent to

Subscribe to The Weekender
Get the week's leading headlines delivered straight to your inbox.
Top headlines from around the real estate industry. Breaking news as it happens.
15 stories covering tech, special reports, video and opinion.
Unique features from hacker profiles to portal watch and video interviews.
Unique features from hacker profiles to portal watch and video interviews.
It looks like you’re already a Select Member!
To subscribe to exclusive newsletters, visit your email preferences in the account settings.
Up-to-the-minute news and interviews in your inbox, ticket discounts for Inman events and more
1-Step CheckoutPay with a credit card
By continuing, you agree to Inman’s Terms of Use and Privacy Policy.

You will be charged . Your subscription will automatically renew for on . For more details on our payment terms and how to cancel, click here.

Interested in a group subscription?
Finish setting up your subscription
×