Slashdot Mirror
Hotel Keycard Lock Hack Gets Real In Texas
Sparrowvsrevolution writes "You may remember a vulnerability in four million keycard locks presented at the Black Hat conference in July. Hacker Cody Brocious showed he could insert a device he built for less than $50 into the port at the bottom of the common hotel lock, read a key out of its memory, and open it in seconds. Two months later, it turns out at least one burglar was already making use of that technique to rob a series of hotel rooms in Texas. The Hyatt House Galleria in Houston has revealed that in at least three September cases of theft from its rooms, the thief used that Onity vulnerability to effortlessly open rooms and steal valuables like laptops. Petra Risk Solutions, an insurance firm focus the hospitality industry also reports that at least two other hotels in Texas were hit with the attack. Onity has been criticized for its less-than-stellar response to a glaring vulnerability in its devices. The Hyatt says Onity didn't provide a fix until after its break-ins, forcing the hotel to plug its locks' ports with epoxy. And even now, Onity is asking its hotel customers to pay for the full fix, which involves replacing the locks' circuit boards."
...unless the victim was present.
....for a broken product you gave me......who are your competitors?
Normal key locks are vulnerable to various cheap lock picks as well, and, shock of shocks, a locksmith will charge you to upgrade those locks as well. So.... where's the story? I don't see anything on slashdot about normal burglars breaking into house with zipguns and the like, why is THIS news?
Chocolatey = Chocolate, Sort of...
Onity = On It, Sort of...
The Hyatt says Onity didn't provide a fix until after its break-ins, forcing the hotel to plug its locks' ports with epoxy
Well, at least they issued a patch.
Surprised it took thieves two months before starting to use this exploit. Even more surprising that the summary says "already".
The exploit was very well documented, and rather simple to copy. It took mere days for YouTube videos showing off the same hack to appear.
It is more likely that other hotels were hit with the issue already, but didn't disclose it to the public for fear of attracting more thieves to their hotels, and/or for the bad publicity and the risk of guests staying away from their insecure rooms.
Easy now; don't blame something on stupidity that you assign to sheer incompetence. Or a third variation, towards a quest of more profit!
I can design a super-secure lock. It will cost more to develop, and then it will cost more to produce, which will raise its price. Which in turn will lower my potential customers (90% of folks just want a lock that can be easily managed and is simple for their users). The accounting people said, "Do the simpler version, it will be good enough and return us 87% more profit. BTW, we already printed the brochures so your comments are moot."
If Onity comes up with a more secure model then it could well be that there is a cost associated. Mind you, this is a PR nightmare, so some companies would just eat the cost.
The hotels bought a lock for a specific purpose. It provides a decent detterent. Someone motivated will always find a way in.
Car analogy: You bought the BMW 325 to impress your friends while driving with the collar of your polo shirt up. It turns out that thieves can steal your muffler for the precious precious platinum in the catalyctic converted. The brand new M3 model developed after the news broke out has the muffler protected by the body. Do you expect a free upgrade from BMW?
Wearing pants should always be optional.
I am waiting for the story about Cody Brocious being sued by Onity for enabling this crime.
If Slashdot were chemistry it would look like this:Cadaverine
They are also providing a software solution. Even when the locks are programmable and upgradable, flashing the new firmware is available for a "nominal" fee. And if your lock does not have upgradable firmware? Well, you need to call in and ask for the price. I think the current pricing is one arm and one leg per upgrade.
http://www.securityinfowatch.com/news/10766203/onity-provides-lock-upgrades-following-hack
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
I don't think your car analogy is accurate. In this case I bought the BMW(and really a 325 impresses my friends? I need better friends!) to impress my friends, not to protect the platinum in my muffler. If someone steals my muffler, my friends should still be impressed by my status symbol, so long as it isn't running. (Unless my friends are Joe Dirt, and then that loud roar is badass, yeeehaawww!)
A lock on the other hand, was purchased for the sole purpose of denying entry to unauthorized people. It failed to do so.
So I guess a better car analogy would be I bought a BMW 750i to impress my friends, but since they are all hippie GNU users who shun material things, it failed to do so. I would have been better off buying a Tesla Motors car to appeal to their green side.
Oh wait, the car didn't fail, my friends failed to appreciate the Ultimate Driving Machine. Sorry, my car-analogy-fu is weak today.
Car analogy: You bought the BMW 325 to impress your friends while driving with the collar of your polo shirt up. It turns out that thieves can steal your muffler for the precious precious platinum in the catalyctic converted. The brand new M3 model developed after the news broke out has the muffler protected by the body. Do you expect a free upgrade from BMW?
+1 for the car analogy. And as far as my ancient Ford truck goes, I don't think they'd issue a recall for anything other than a safety issue. But a BMW? I would indeed expect a product recall from BMW, where they would freely install some "catalytic converter locks" that would be nearly as effective as the body redesign solution you hypothesized.
John
Well done. Yeah, I suck at car analogies. The thing is, the muffler is an important ingredient in the overall product.
One could argue that the only "key" (pun partly intended) feature is the security of the room protected by the lock as you rightly stated, and yes, it failed to do so. The other pieces would be the management of the cards, auditing of entry to the rooms and the wow factor to the clientele.
Could also the argument not be made that it would deter 99.99% of unauthorized access? In most circles, that would be pretty good. This is not a trivial exploit either.
Your analogy has more potential than mine: maybe you expect BMW to get you a Tesla or a new set of country-club friends?
Wearing pants should always be optional.
Nicely caught. I meant to say "malice" instead of "stupidity". I'm stuck in a two-hour meeting with the project management team at work, so my subsconscious let out a small cry for help in my post.
Wearing pants should always be optional.
Why is it when I hear "Texas" and "Hotel", I think of an obese tattooed couple with a meth lab in a suitcase? (obviously both meat-eaters??)
I would argue that the muffler is not as important, more akin to the management of cards or the 'wow factor.' A car's main function is transportation, so if it fails that it almost can't impress anyone. So a lock can have several ancillary features but if it is easily defeated, it gets a fail in my book.
And I am not sure how you would measure a lock to get the 99.99% and if that number is even possible for a lock(Google 'myth 5 9s')
And I am happy with my hippie GNU friends...and I let MUNI drive me around, so I'm probably not impressing anyone who would be impressed by a car. I would love to drive a Tesla for a couple of days though.
The car analogy is simple. The uber secure keyless systems in cars turned out to be insecure like the hotel rooms. Maybe a tad more difficult to break, but still very breakable. BMW is one of the lucky ones to be hacked. Just one example http://www.geekosystem.com/keyless-bmw-hacked-3-minutes/
I was in a hotel with an in room safe. My kid closed the door and managed to lock it so I called maintenance. The guy came up and hit the # key twice to enter supervisor mode then keyed in 6 9's. Here is a video I shot after he left. I'm pretty sure they don't have an override maintenance code for each room. You could try a few standard combos on your room to figure it out for the hotel. Or just get maintenance up to your room to show you it.
https://www.youtube.com/watch?v=UYjJuE7l7VM
I love Jesus, except for his foreign policy.
Next up: Apple to Samsung: "Oh no you din't" and "Axe Slashdot"