Hotel Keycard Lock Hack Gets Real In Texas

← Back to Stories (view on slashdot.org)

Hotel Keycard Lock Hack Gets Real In Texas

Posted by timothy on Tuesday November 27, 2012 @03:16AM from the those-words-in-that-order dept.

Sparrowvsrevolution writes "You may remember a vulnerability in four million keycard locks presented at the Black Hat conference in July. Hacker Cody Brocious showed he could insert a device he built for less than $50 into the port at the bottom of the common hotel lock, read a key out of its memory, and open it in seconds. Two months later, it turns out at least one burglar was already making use of that technique to rob a series of hotel rooms in Texas. The Hyatt House Galleria in Houston has revealed that in at least three September cases of theft from its rooms, the thief used that Onity vulnerability to effortlessly open rooms and steal valuables like laptops. Petra Risk Solutions, an insurance firm focus the hospitality industry also reports that at least two other hotels in Texas were hit with the attack. Onity has been criticized for its less-than-stellar response to a glaring vulnerability in its devices. The Hyatt says Onity didn't provide a fix until after its break-ins, forcing the hotel to plug its locks' ports with epoxy. And even now, Onity is asking its hotel customers to pay for the full fix, which involves replacing the locks' circuit boards."

24 of 132 comments (clear)

Min score:

Reason:

Sort:

Sure I will pay.... by Anonymous Coward · 2012-11-27 03:23 · Score: 5, Funny

....for a broken product you gave me......who are your competitors?
1. Re:Sure I will pay.... by Applekid · 2012-11-27 04:13 · Score: 5, Insightful
  
  If I were one of Onity's competitors, I would be fast-tracking a replacement system that uses the existing housings at least. Their lunch is right there, on the table, practically begging to get eaten.
  
  --
  More Twoson than Cupertino
2. Re:Sure I will pay.... by plover · 2012-11-27 04:14 · Score: 3, Insightful
  
  The replacement boards slide right into the existing locks, which the competitors product will not do.
  Yet.
  There seems to be a market opportunity here for a vendor who can provide a trustworthy replacement board at a reasonable price. Of course, that means replacing the programming station as well, but it would get a hotel to a potentially better engineered solution, especially if the system was Open Source and scrutinized by the public eye for vulnerabilities.
  
  --
  John
3. Re:Sure I will pay.... by IndustrialComplex · 2012-11-27 05:12 · Score: 3
  
  Very likely there exists a patent which covers some aspect of the board design for fitting in that slot, or interfacing with the remaining mechanism, etc.
  You probably could easily design a board to fit, but it would be seconds before Onity filed an infringement lawsuit, voided support contracts, etc. I'd be willing to bet some of the terminal equipment for programming the cards is leased as well.
  
  --
  Out of modpoints but really liked a post? 1BDkF6TtmmeZ3yqXbz9yhdYVqRYnwFoXDj
4. Re:Sure I will pay.... by Vellmont · 2012-11-27 06:03 · Score: 4, Informative
  
  You assume hotels think that security is some sort of top priority. It's not. You think that there aren't hundreds of people that could open your hotel room?
  If push comes to shove, I guarantee you the preferred solution for 99% of hotels will be simply securing the physical port, and not monkeying around with circuit boards or replacing the whole system entirely. It's just too expensive for too little benefit. Hotel rooms aren't meant to be Fort Knox.
  
  --
  AccountKiller
And a normal locksmith will also charge by Gr33nJ3ll0 · 2012-11-27 03:24 · Score: 3, Insightful

Normal key locks are vulnerable to various cheap lock picks as well, and, shock of shocks, a locksmith will charge you to upgrade those locks as well. So.... where's the story? I don't see anything on slashdot about normal burglars breaking into house with zipguns and the like, why is THIS news?
1. Re:And a normal locksmith will also charge by dav1dc · 2012-11-27 03:29 · Score: 5, Informative
  
  I believe its geek appeal is derived from the fact that a software hack utilized to break the locks, rather than a physical set of lock picks.
  There is also a sub-text about the social responsibility and obligation that manufacturers have to patch security holes found in their devices in a timely manner I suspect as well.
2. Re:And a normal locksmith will also charge by wvmarle · 2012-11-27 03:37 · Score: 3, Informative
  
  Those locks are not sold as highly secure or so. While I'm quite positive Onity will have used "high security" as one of their sales pitches - part of the reason to use such expensive locks is that a guest not returning a key is not an issue any more, and that the keys are not so easy to copy.
3. Re:And a normal locksmith will also charge by PlusFiveTroll · 2012-11-27 03:42 · Score: 3, Insightful
  
  It depends on how the locks are sold, If they cost 10x as much as a regular lock and advertized to protect against this kind of attack, then yes the lock selling company might have an issue. If I sell you a zipgun proof lock and it's not, it become an issue of product misrepresentation.
  Also, up till recently, most people thought of these lock devices as secure, or at least the level of attack that would have to occur would be difficult and rare. Now it's less noticeable to hack these locks then a regular door.
4. Re:And a normal locksmith will also charge by Anonymous Coward · 2012-11-27 03:59 · Score: 4, Informative
  
  Lock picks take time
  Google 'bump key'. They can open a lot of rotary yale-type locks in under 5 seconds.
  https://www.youtube.com/watch?v=hr23tpWX8lM (skip to 1:00)
  Needless to say I never leave the house without locking a deadbolt too.
5. Re:And a normal locksmith will also charge by wvmarle · 2012-11-27 04:08 · Score: 4, Interesting
  
  Cards have a built-in expiry date; usually the date you're supposed to leave the hotel. When extending your stay, they will update your card. So while you may be able to copy them, it's not exactly useful.
6. Re:And a normal locksmith will also charge by Runaway1956 · 2012-11-27 05:16 · Score: 3, Interesting
  
  AC's reply deserves your attention - as it's the same thing I was thinking.
  Not to mention - I have a huge pile of keys. I have keys that I haven't thrown away since my Navy days, more than thirty years ago. I just don't throw keys away, no matter how "useless" they might seem.
  From time to time, I need to open a lock. I examine the lock, think a bit, poke through my big pile of keys, and usually come up with a match. There are three keys that I carry on my key chain that don't fit anything - specific. They just seem to fit a lot of things that need to be opened. There are, after all, only so many combinations that can be cut into a blank key.
  I'll admit, though, that I have few keys that are likely to fit motel room doors.
  
  --
  "Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
7. Re:And a normal locksmith will also charge by kootsoop · 2012-11-27 06:46 · Score: 3, Informative
  
  Actually, housekeeping staff keys are often set to expire on a daily basis. The first thing a housekeeper needs to do in the morning is to revalidate their card. If the card isn't revalidated in time, it needs to human intervention (other than the housekeeper) to be reactivates. Source: I used to work for Onity's parent company (UTC Fire & Security, as it was then), and I worked requirements for some of Onity's newer products.
  
  --
  "Engineering is the art of making what you want from things you can get" - Jerry Avins
A Fix? They're On It, Sort Of by guttentag · 2012-11-27 03:27 · Score: 5, Funny

Chocolatey = Chocolate, Sort of...
Onity = On It, Sort of...
Well handled by slashmydots · 2012-11-27 03:32 · Score: 4, Funny

The Hyatt says Onity didn't provide a fix until after its break-ins, forcing the hotel to plug its locks' ports with epoxy
Well, at least they issued a patch.
Took them two months?! by wvmarle · 2012-11-27 03:34 · Score: 4, Interesting

Surprised it took thieves two months before starting to use this exploit. Even more surprising that the summary says "already".
The exploit was very well documented, and rather simple to copy. It took mere days for YouTube videos showing off the same hack to appear.
It is more likely that other hotels were hit with the issue already, but didn't disclose it to the public for fear of attracting more thieves to their hotels, and/or for the bad publicity and the risk of guests staying away from their insecure rooms.
1. Re:Took them two months?! by rsmith84 · 2012-11-27 03:52 · Score: 4, Insightful
  
  You have to let the chatter about the exploit die down enough so that you can pull the heist off with better success. Going out and attempting it immediately after Black Hat is too risky and the sign of foolish thief.
2. Re:Took them two months?! by Rob+the+Bold · 2012-11-27 04:40 · Score: 4, Insightful
  
  Surprised it took thieves two months before starting to use this exploit. Even more surprising that the summary says "already".
  Maybe it's only after the exploit was revealed that anyone thought to suspect this was the way some hotel burglaries were happening. We don't necessarily know that Brocious was the first to discover the attack mode -- only that he was the first to publicize it.
  
  --
  I am not a crackpot.
Onity provides a fix .... for a fee. by 140Mandak262Jamuna · 2012-11-27 04:02 · Score: 5, Informative

Onity has announced two step solution. The first one is making it difficult to access the port. There is a cover at the bottom it looks like and they are strengthening it. May be metal instead of plastic. And adding a *security* torx screw too. Yeah, may be they will also make it need pentalobulous head like Apple iPads. But all it will do is to slow down but can't stop the intruder. This part is free.
They are also providing a software solution. Even when the locks are programmable and upgradable, flashing the new firmware is available for a "nominal" fee. And if your lock does not have upgradable firmware? Well, you need to call in and ask for the price. I think the current pricing is one arm and one leg per upgrade.
http://www.securityinfowatch.com/news/10766203/onity-provides-lock-upgrades-following-hack

--
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Re:Not "rob", burglarize by clickclickdrone · 2012-11-27 04:06 · Score: 4, Informative

Or just plain 'burgle' if you're English.

--
I want a list of atrocities done in your name - Recoil
Re:Not "rob", burglarize by Phreakiture · 2012-11-27 04:50 · Score: 4, Funny

I bet you feel so embiggened for pointing out this incromulence.

--
www.wavefront-av.com
Re:Not "rob", burglarize by History's+Coming+To · 2012-11-27 05:37 · Score: 4, Informative

To burgle. He burgled. They will burgle. I was burgled. I suffered a burglary. etc

--
Please consider this account deleted, I just can't be bothered with the spam anymore.
Hotel in room safes are not much better by trout007 · 2012-11-27 06:26 · Score: 4, Interesting

I was in a hotel with an in room safe. My kid closed the door and managed to lock it so I called maintenance. The guy came up and hit the # key twice to enter supervisor mode then keyed in 6 9's. Here is a video I shot after he left. I'm pretty sure they don't have an override maintenance code for each room. You could try a few standard combos on your room to figure it out for the hotel. Or just get maintenance up to your room to show you it.
https://www.youtube.com/watch?v=UYjJuE7l7VM

--
I love Jesus, except for his foreign policy.
Re:Even though this is the Hyatt... by Richy_T · 2012-11-27 07:23 · Score: 3, Insightful

Dunno? Deep seated prejudice and intolerance?