Slashdot Mirror
Maker of Hackable Hotel Locks Finally Agrees To Pay For Bug Fix
Sparrowvsrevolution writes "Slashdot readers are no doubt familiar by now with the case of Onity, the company whose locks are found on 4 million hotel room doors worldwide and, as came to light over the summer, can be opened in seconds with a $50 Arduino device. Since that hacking technique was unveiled by Mozilla developer Cody Brocious at Black Hat, Onity first downplayed its security flaws and then tried to force its hotel customers to pay the cost of the necessary circuit board replacements to fix the bug. But now, after at least one series of burglaries exploiting the bug hit a series of hotel rooms in Texas, Onity has finally agreed to shoulder the cost of replacing the hardware itself — at least for its locks in major chain hotels in the U.S. installed after 2005. Score one point for full disclosure."
A bunch of people got their stuff stolen, a bunch of smaller hotels are out money, and Onity takes a huge hit? Seems like everyone would have been better off if everyone kept quiet and Onity just started shipping new units with the fix.
Full disclosure by a third party.
Sheesh, evil *and* a jerk. -- Jade
I give it a month before the new firmware is discovered vulnerable to a very similar attack, or a way to bypass the plug is found.
That said, if I were Marriot, of course I'd have negotiated just this kind of deal. It would be quite simple, and any number of electronic lock-makers would fall over themselves to install reduced costs locks (or even compatible boards) and just live off the future support for them.
What bothers me is not the replacement policy (which looks like you need to argue lots to get something quite reasonable, like a free firmware fix), or the security (we all know that lots of modern products have security flaws and to be honest, this one requires quite some skills / balls to exploit), but the denials and brushing-under-the-carpet.
Your locks have one purpose. To stay shut against an intruder. That's all. Sure, we don't expect the room to be impenetrable or them to be crowbar-proof, but we do expect you to not be able to walk up to them with just a device and start changing their settings without that device being authenticated, revokable and protocol-protected. And certainly not to the point that you can work out what to do to make it accept any card from just a lock alone without some serious reverse-engineering.
Damn right, you'd replace my locks. Or your insurance would have one huge hefty claim on it by now from chains like Marriott. Hell, I'd even let you off if I could fit them myself on my own schedule so as to not disturb guests or interfere with business operations, and even let you charge me for delivery.
But what I wouldn't accept would be it taking MONTHS to get to the position that a fix was available after a successful public demonstration. You should have been calling me up and shipping the updated boards/firmware the next day, at least, and worrying about the cost later.
If there's a repeat of this incident with the new board, I would need to KNOW that you were going to do something timely about it BEFORE burglaries start hitting my hotel insurance, which may not even pay out if the locks are that bad.
Too many !!
I think you could have a career in politics.
It is a miracle that curiosity survives formal education. - Einstein
"Score one point for full disclosure". I don't think so. "Score one for bad publicity" yes. With the previous customer looking somewhere else to provide new lock as Onity wheren't caring about them and their promise of high security electronic locks...
The leaked agreement contains this paragraph:
"Onity’s proposal for franchisees is conditioned on the franchisee’s acknowledgement that Onity does not guarantee a lock’s invulnerability to hacking."
While this is a reasonable statement on its own, the real issue here is competence. Onity's design was in such blatant and avoidable violation of basic security principles (e.g. a small keyspace and a lack of real cryptography) that it might be be called negligent.
If by that you mean disassembling the face of the lock, plugging the widget in shoving the magic electrons in.
You know what else works "in seconds"? A $10 crowbar, 100% of the time.
It's a ridiculous nerd-rage non-issue, given that to work the hack you'd have to be on site for an extended period, cool as a cucumber, looking and acting like a member of staff. You might as well be staff, and that's where the real vulnerability is, and always will be.
If you were blocking sigs, you wouldn't have to read this.
I was just in a hotel last week and had put my laptop in the room safe. I entered my 6 digit code and locked the safe. Two days later, I tried to open it and it wouldn't take my pin. I called the hotel staff and a maintenance guy came to my room with a small 10-key pad that had an LCD display. He plugged an RJ45 cable into a port on the bottom of the locking device, entered 2468#, then 1357#, and the safe opened. After it was open, it flashed LO-BAT, so that explains why it lost my combination.
If it's as easy as having one of those pin pads, why even have the safe in the room?
LOAD "SIG",8,1
LOADING...
READY.
RUN
Too many !!
But were they "legitimate?"
One, the vulnerability is such that after the fact there is no indication that the lock was ever hacked. If somebody has used this hack on a lock, there is no way for the owner or anyone else to tell that somebody has bypassed it (as there would be with a physically broken lock, for instance).
Two the hack did not require access to abnormally sophisticated skills or tools (arduino's can be purchased, retail, by anybody, and used by anybody, even if they do not know how to how to program, any more than it requires unusually specific skills or tools to... say, use a word processor, or build ikea furniture).
Three, the port did not require any special tools to access. It was accessible from the outside of the unit, and was common port type, so the type of plug that fits it are cheap and easily to find.
In a nutshell, once the means of bypassing this vulnerability became widely known, Onity locks became about as practical a means of security as those which might put its assembly hardware (of common type) access on the the same side of the door as that which is supposed to need some sort of key or pass code to enter.
File under 'M' for 'Manic ranting'
The first level is basically making the DC charging port more difficult access. Replace plastic with metal etc. It was willing to ship that thing for free.
Then, it had the second second level fix, flashing new firmware. It wanted some 40$ per lock for the locks that were capable of accepting the patch! This is basically daylight robbery. There is simply no justification for charging that much for a security upgrade in software! If the locks were not capable of being upgraded, then the entire board has to be changed, costing even more money.
I think Onnity does not seem to get one striking fact. 90% of the motels and economy hotels are owned by Indian immigrants. It is very much possible they have a cousin back home who might hack out a patch.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact