Slashdot Mirror
Hotel Keycard Lock Hack Gets Real In Texas
Sparrowvsrevolution writes "You may remember a vulnerability in four million keycard locks presented at the Black Hat conference in July. Hacker Cody Brocious showed he could insert a device he built for less than $50 into the port at the bottom of the common hotel lock, read a key out of its memory, and open it in seconds. Two months later, it turns out at least one burglar was already making use of that technique to rob a series of hotel rooms in Texas. The Hyatt House Galleria in Houston has revealed that in at least three September cases of theft from its rooms, the thief used that Onity vulnerability to effortlessly open rooms and steal valuables like laptops. Petra Risk Solutions, an insurance firm focus the hospitality industry also reports that at least two other hotels in Texas were hit with the attack. Onity has been criticized for its less-than-stellar response to a glaring vulnerability in its devices. The Hyatt says Onity didn't provide a fix until after its break-ins, forcing the hotel to plug its locks' ports with epoxy. And even now, Onity is asking its hotel customers to pay for the full fix, which involves replacing the locks' circuit boards."
....for a broken product you gave me......who are your competitors?
Normal key locks are vulnerable to various cheap lock picks as well, and, shock of shocks, a locksmith will charge you to upgrade those locks as well. So.... where's the story? I don't see anything on slashdot about normal burglars breaking into house with zipguns and the like, why is THIS news?
Chocolatey = Chocolate, Sort of...
Onity = On It, Sort of...
The Hyatt says Onity didn't provide a fix until after its break-ins, forcing the hotel to plug its locks' ports with epoxy
Well, at least they issued a patch.
Surprised it took thieves two months before starting to use this exploit. Even more surprising that the summary says "already".
The exploit was very well documented, and rather simple to copy. It took mere days for YouTube videos showing off the same hack to appear.
It is more likely that other hotels were hit with the issue already, but didn't disclose it to the public for fear of attracting more thieves to their hotels, and/or for the bad publicity and the risk of guests staying away from their insecure rooms.
Easy now; don't blame something on stupidity that you assign to sheer incompetence. Or a third variation, towards a quest of more profit!
I can design a super-secure lock. It will cost more to develop, and then it will cost more to produce, which will raise its price. Which in turn will lower my potential customers (90% of folks just want a lock that can be easily managed and is simple for their users). The accounting people said, "Do the simpler version, it will be good enough and return us 87% more profit. BTW, we already printed the brochures so your comments are moot."
If Onity comes up with a more secure model then it could well be that there is a cost associated. Mind you, this is a PR nightmare, so some companies would just eat the cost.
The hotels bought a lock for a specific purpose. It provides a decent detterent. Someone motivated will always find a way in.
Car analogy: You bought the BMW 325 to impress your friends while driving with the collar of your polo shirt up. It turns out that thieves can steal your muffler for the precious precious platinum in the catalyctic converted. The brand new M3 model developed after the news broke out has the muffler protected by the body. Do you expect a free upgrade from BMW?
Wearing pants should always be optional.
They are also providing a software solution. Even when the locks are programmable and upgradable, flashing the new firmware is available for a "nominal" fee. And if your lock does not have upgradable firmware? Well, you need to call in and ask for the price. I think the current pricing is one arm and one leg per upgrade.
http://www.securityinfowatch.com/news/10766203/onity-provides-lock-upgrades-following-hack
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Or just plain 'burgle' if you're English.
I want a list of atrocities done in your name - Recoil
Nicely caught. I meant to say "malice" instead of "stupidity". I'm stuck in a two-hour meeting with the project management team at work, so my subsconscious let out a small cry for help in my post.
Wearing pants should always be optional.
I bet you feel so embiggened for pointing out this incromulence.
www.wavefront-av.com
I would argue that the muffler is not as important, more akin to the management of cards or the 'wow factor.' A car's main function is transportation, so if it fails that it almost can't impress anyone. So a lock can have several ancillary features but if it is easily defeated, it gets a fail in my book.
And I am not sure how you would measure a lock to get the 99.99% and if that number is even possible for a lock(Google 'myth 5 9s')
And I am happy with my hippie GNU friends...and I let MUNI drive me around, so I'm probably not impressing anyone who would be impressed by a car. I would love to drive a Tesla for a couple of days though.
To burgle. He burgled. They will burgle. I was burgled. I suffered a burglary. etc
Please consider this account deleted, I just can't be bothered with the spam anymore.
I was in a hotel with an in room safe. My kid closed the door and managed to lock it so I called maintenance. The guy came up and hit the # key twice to enter supervisor mode then keyed in 6 9's. Here is a video I shot after he left. I'm pretty sure they don't have an override maintenance code for each room. You could try a few standard combos on your room to figure it out for the hotel. Or just get maintenance up to your room to show you it.
https://www.youtube.com/watch?v=UYjJuE7l7VM
I love Jesus, except for his foreign policy.
Dunno? Deep seated prejudice and intolerance?