Hackers Found a Way To Open Any of 3 Million Hotel Keycard Locks In Seconds (wired.com) 33
An anonymous reader quotes a report from Wired: When thousands of security researchers descend on Las Vegas every August for what's come to be known as "hacker summer camp," the back-to-back Black Hat and Defcon hacker conferences, it's a given that some of them will experiment with hacking the infrastructure of Vegas itself, the city's elaborate array of casino and hospitality technology. But at one private event in 2022, a select group of researchers were actually invited to hack a Vegas hotel room, competing in a suite crowded with their laptops and cans of Red Bull to find digital vulnerabilities in every one of the room's gadgets, from its TV to its bedside VoIP phone. One team of hackers spent those days focused on the lock on the room's door, perhaps its most sensitive piece of technology of all. Now, more than a year and a half later, they're finally bringing to light the results of that work: a technique they discovered that would allow an intruder to open any of millions of hotel rooms worldwide in seconds, with just two taps.
Today, Ian Carroll, Lennert Wouters, and a team of other security researchers are revealing a hotel keycard hacking technique they call Unsaflok. The technique is a collection of security vulnerabilities that would allow a hacker to almost instantly open several models of Saflok-brand RFID-based keycard locks sold by the Swiss lock maker Dormakaba. The Saflok systems are installed on 3 million doors worldwide, inside 13,000 properties in 131 countries. By exploiting weaknesses in both Dormakaba's encryption and the underlying RFID system Dormakaba uses, known as MIFARE Classic, Carroll and Wouters have demonstrated just how easily they can open a Saflok keycard lock. Their technique starts with obtaining any keycard from a target hotel -- say, by booking a room there or grabbing a keycard out of a box of used ones -- then reading a certain code from that card with a $300 RFID read-write device, and finally writing two keycards of their own. When they merely tap those two cards on a lock, the first rewrites a certain piece of the lock's data, and the second opens it.
Dormakaba says that it's been working since early last year to make hotels that use Saflok aware of their security flaws and to help them fix or replace the vulnerable locks. For many of the Saflok systems sold in the last eight years, there's no hardware replacement necessary for each individual lock. Instead, hotels will only need to update or replace the front desk management system and have a technician carry out a relatively quick reprogramming of each lock, door by door. Wouters and Carroll say they were nonetheless told by Dormakaba that, as of this month, only 36 percent of installed Safloks have been updated. Given that the locks aren't connected to the internet and some older locks will still need a hardware upgrade, they say the full fix will still likely take months longer to roll out, at the very least. Some older installations may take years.
Today, Ian Carroll, Lennert Wouters, and a team of other security researchers are revealing a hotel keycard hacking technique they call Unsaflok. The technique is a collection of security vulnerabilities that would allow a hacker to almost instantly open several models of Saflok-brand RFID-based keycard locks sold by the Swiss lock maker Dormakaba. The Saflok systems are installed on 3 million doors worldwide, inside 13,000 properties in 131 countries. By exploiting weaknesses in both Dormakaba's encryption and the underlying RFID system Dormakaba uses, known as MIFARE Classic, Carroll and Wouters have demonstrated just how easily they can open a Saflok keycard lock. Their technique starts with obtaining any keycard from a target hotel -- say, by booking a room there or grabbing a keycard out of a box of used ones -- then reading a certain code from that card with a $300 RFID read-write device, and finally writing two keycards of their own. When they merely tap those two cards on a lock, the first rewrites a certain piece of the lock's data, and the second opens it.
Dormakaba says that it's been working since early last year to make hotels that use Saflok aware of their security flaws and to help them fix or replace the vulnerable locks. For many of the Saflok systems sold in the last eight years, there's no hardware replacement necessary for each individual lock. Instead, hotels will only need to update or replace the front desk management system and have a technician carry out a relatively quick reprogramming of each lock, door by door. Wouters and Carroll say they were nonetheless told by Dormakaba that, as of this month, only 36 percent of installed Safloks have been updated. Given that the locks aren't connected to the internet and some older locks will still need a hardware upgrade, they say the full fix will still likely take months longer to roll out, at the very least. Some older installations may take years.
Re: (Score:2)
The headline does not match TFS. It's not a way to open any lock at the hotel. It's a way to duplicate a key when you can have first physical access to it. So as a thief/burglar you first need to book room 123, grab the key and duplicate it; then another day you can come back and open the door to steal customer belongings.
Except in many hotels the keys can change as they simply allocate the next available key-pass to your room when you check in so you would need to duplicate the the hotels entire stock of key-passes or one of the master-passes
Re: Not door opening; key duplication (Score:2)
Re: (Score:2)
Social Engineering (Score:3)
Re:Not door opening; key duplication (Score:5, Informative)
This hack uses the card for room 123 to figure out the decryption key and from that generate a programming card and a master key card. The programming card can then be tapped on any room to program the master key card
Re: (Score:2)
Silly me for thinking the mag stripe had a unique 128-bit number on it, tied to your stay dates and room number.
What Summer intern came up with a design where possession of the card's information would permit entry after you've checked out?
Re: (Score:1)
Mag stripes? What decade were you last in a hotel?
You probably also assume all credit cards have raised numbers on them for carbonless imprint machines.
Re:Not door opening; key duplication (Score:4, Interesting)
You've never been to a hotel then, because if you are quick, you can read a housekeeping key in most hotels quite easily - the key is often in the key holder while the housekeeper is making up the room. All you have to do is quickly swipe it, read it, and replace it, and the lights likely won't even blink.
Housekeeping keys will get you in most rooms of the hotel easily, for obvious reasons.
Re: (Score:3)
When they merely tap those two cards on a lock, the first rewrites a certain piece of the lock's data, and the second opens it.
Re: (Score:2)
Thanks for pointing out.
Re: (Score:3)
It opens every door - AND it opens the deadbolt too. The only thing it can't open is any 'chain' on the door (because that's nothing to do with the lock - and so not always available).
One thing about housekeeping keys - they don't typically open the deadbolt. The manager's key likely does, but there are a lot less managers than housekeepers. Suffice to say, this is a pretty catastrophic flaw, and reading between the lines requires some new hardware to resolve in at least some cases.
Re:Not door opening; key duplication (Score:5, Informative)
The headline does not match TFS. It's not a way to open any lock at the hotel. It's a way to duplicate a key when you can have first physical access to it. So as a thief/burglar you first need to book room 123, grab the key and duplicate it; then another day you can come back and open the door to steal customer belongings.
That is not what the summary said:
Re: (Score:2)
No. If you can obtain ANY key card in the hotel for long enough to read it, you can then make a pair of cards that will open any card lock in the hotel. So you get the card for room 123. You can now open any room you want.
Worst case, you rent a room for the night. But you can probably take advantage of a distraction to grab a turned in keycard from the front desk or lift one off of a guest.
Re: (Score:2)
Lock the door? (Score:1)
Re: (Score:3)
Vulnerable to a under door attack - because the deadbolt often unlocks itself if you move the door handle. Thus an attacker with a cheap and easily made tool will slip it between the gap between the floor and bottom of the door, then try to get at the do
Re:Lock the door? (Score:4, Interesting)
Heck, you never know who might try to get into your room.
Yeah, like in Vegas during the last few years of DEFCON when some hired toad comes into your room not respecting the "do not disturb" sign. In several cases they were caught screwing around with people's equipment, rifling through suitcases, etc. In my case, I was sitting down in one of the villages when I got a text message that someone was trying to screw with my laptop. By the time I got up there, they were gone, but left the laptop out of standby mode with an invalid password error message still on the screen. At some of those places, I can't even trust that they don't have hidden cameras stuck somewhere to film high profile people having sex or doing drugs or whatever for blackmail purposes.
Re:Lock the door? (Score:5, Insightful)
You were at DEFCON. If there's one place you expect someone to do something like that it's DEFCON. It may not be a hired toad, it may have been the guy in the room right next to yours, proving a point for their upcoming presentation.
Re: (Score:2)
Not trying to criticise or anything, but why do people take real devices to DEFCON and similar events?
I'd be inclined to either bring a diskless system and boot from a flash drive I kept on my person at all times, or no laptop at all. I'd certainly never let it out of my sight.
Honeypot?
A friend I called paranoid... (Score:4)
A friend I called paranoid told me how they block the door, even with a lock and chain on the door, with a chair, or table.
I called them paranoid then, but now I can see this friend had a point of not trusting the "security" of the door...paranoid but not stupid. Reminds me of the electronics gear in the fat felt marker that could open a certain company's electronic locks used in hotels. Secure seems almost a buzzword in the hospitality industry.
JoshK.
Mifare? (Score:2)
The following spring to mind:
"Definitively the best and the most practical talk at CHES 2011 was given by David Oswald. The work has been descried in the paper titled "Breaking Mifare DESFire MF3ICD40: Power Analysis and Templates in the Real World" by David Oswald and Christof Paar both from Ruhr-University Bochum and concerns practical attacks on contactless smardcards."
"In December 2007, the security of the Mifare Classic 4K card became the subject of
debate. This was invoked by a presentation given at a
Re: (Score:2)
Paywall (Score:1)
The Wired article is behind a paywall.
Is there another link to this "story"?