Slashdot Mirror
Hotel Keycard Lock Hack Gets Real In Texas
Sparrowvsrevolution writes "You may remember a vulnerability in four million keycard locks presented at the Black Hat conference in July. Hacker Cody Brocious showed he could insert a device he built for less than $50 into the port at the bottom of the common hotel lock, read a key out of its memory, and open it in seconds. Two months later, it turns out at least one burglar was already making use of that technique to rob a series of hotel rooms in Texas. The Hyatt House Galleria in Houston has revealed that in at least three September cases of theft from its rooms, the thief used that Onity vulnerability to effortlessly open rooms and steal valuables like laptops. Petra Risk Solutions, an insurance firm focus the hospitality industry also reports that at least two other hotels in Texas were hit with the attack. Onity has been criticized for its less-than-stellar response to a glaring vulnerability in its devices. The Hyatt says Onity didn't provide a fix until after its break-ins, forcing the hotel to plug its locks' ports with epoxy. And even now, Onity is asking its hotel customers to pay for the full fix, which involves replacing the locks' circuit boards."
...unless the victim was present.
....for a broken product you gave me......who are your competitors?
Normal key locks are vulnerable to various cheap lock picks as well, and, shock of shocks, a locksmith will charge you to upgrade those locks as well. So.... where's the story? I don't see anything on slashdot about normal burglars breaking into house with zipguns and the like, why is THIS news?
Chocolatey = Chocolate, Sort of...
Onity = On It, Sort of...
The Hyatt says Onity didn't provide a fix until after its break-ins, forcing the hotel to plug its locks' ports with epoxy
Well, at least they issued a patch.
Surprised it took thieves two months before starting to use this exploit. Even more surprising that the summary says "already".
The exploit was very well documented, and rather simple to copy. It took mere days for YouTube videos showing off the same hack to appear.
It is more likely that other hotels were hit with the issue already, but didn't disclose it to the public for fear of attracting more thieves to their hotels, and/or for the bad publicity and the risk of guests staying away from their insecure rooms.
Now who's the robber/thief?
I am waiting for the story about Cody Brocious being sued by Onity for enabling this crime.
If Slashdot were chemistry it would look like this:Cadaverine
They are also providing a software solution. Even when the locks are programmable and upgradable, flashing the new firmware is available for a "nominal" fee. And if your lock does not have upgradable firmware? Well, you need to call in and ask for the price. I think the current pricing is one arm and one leg per upgrade.
http://www.securityinfowatch.com/news/10766203/onity-provides-lock-upgrades-following-hack
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
usually socially the person who figured it out gets the blame for letting this dangerous knowledge out and into the hands of criminal rather than the criminal who used it but it isn't like criminals wouldn't have figured it out as then it would just be reported as hotel theft and be left at that until it becomes an epidemic which would get less of an outrage as there is a proper role of victim and perpetrator rather than the perception of someone openly teaching someone how to steal
I thought it was "oh-nity", like "chocolatey" = "you got chocolate", and "onity" = "you got owned"
Why is it when I hear "Texas" and "Hotel", I think of an obese tattooed couple with a meth lab in a suitcase? (obviously both meat-eaters??)
I was in a hotel with an in room safe. My kid closed the door and managed to lock it so I called maintenance. The guy came up and hit the # key twice to enter supervisor mode then keyed in 6 9's. Here is a video I shot after he left. I'm pretty sure they don't have an override maintenance code for each room. You could try a few standard combos on your room to figure it out for the hotel. Or just get maintenance up to your room to show you it.
https://www.youtube.com/watch?v=UYjJuE7l7VM
I love Jesus, except for his foreign policy.
Next up: Apple to Samsung: "Oh no you din't" and "Axe Slashdot"
. . . useful. Rob is correct, just not specific. Look it up yourself. Burgle would be more specific. Burglarize is a silly word that means burgled.
I think the person that released to exploit to the world should be paying over half the experiences. The manufacturer who sells the lock needs to pay to get the fix installed that should be taken from any profits they initially made from a defective product. But in real life the only ones who are going to pay are the customers of the hotel.
Jack of all trades,master of none
Some of their locks appear to be spec'd to ANSI level 3.
I wonder if that means able to withstand 30 minutes with reasonable tools.
(IE Big guy with sledge hammer.)
If so, seems like a modified dry eraser might be a 'reasonable' tool.
Especially if it includes no non-public key information.
First step would be to get the certification lab to pull the approval for the existing locks.
Then get have a lawyer write them a nice letter explaining why they need to fix the problem.