Slashdot Mirror
Hackers Built a 'Master Key' For Millions of Hotel Rooms (zdnet.com)
An anonymous reader writes: Security researchers have built a master key that exploits a design flaw in a popular and widely used hotel electronic lock system, allowing unfettered access to every room in the building. The electronic lock system, known as Vision by VingCard and built by Swedish lock manufacturer Assa Abloy, is used in more than 42,000 properties in 166 countries, amounting to millions of hotel rooms -- as well as garages and storage units. These electronic lock systems are commonplace in hotels, used by staff to provide granular controls over where a person can go in a hotel -- such as their room -- and even restricting the floor that the elevator stops at. And these keys can be wiped and reused when guests check-out.
It turns out these key cards aren't as secure as first thought. F-Secure's Tomi Tuominen and Timo Hirvonen, who carried out the work, said they could create a master key 'basically out of thin air.' Any key card will do. Even old and expired, or discarded keys retain enough residual data to be used in the attack. Using a handheld device running custom software, the researchers can steal data off of a key card -- either using wireless radio-frequency identification (RFID) or the magnetic stripe. That device then manipulates the stolen key data, which identifies the hotel, to produce an access token with the highest level of privileges, effectively serving as a master key to every room in the building.
It turns out these key cards aren't as secure as first thought. F-Secure's Tomi Tuominen and Timo Hirvonen, who carried out the work, said they could create a master key 'basically out of thin air.' Any key card will do. Even old and expired, or discarded keys retain enough residual data to be used in the attack. Using a handheld device running custom software, the researchers can steal data off of a key card -- either using wireless radio-frequency identification (RFID) or the magnetic stripe. That device then manipulates the stolen key data, which identifies the hotel, to produce an access token with the highest level of privileges, effectively serving as a master key to every room in the building.
They are a deterrent against casual attacks, and nothing more.
"Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"
Thats why they have a safe in all rooms im sure will be the answer to this.
You mean those hotel safes that were found to all share the same master combination of 00000?
The correct term is cracker, however that battle was lost a long time ago.
... you can be sure that state-level entities also have it. It is one of the reasons why I use a disposable notebook, set up with a minimal configuration, when I travel.
I like the way you turned your comment into an advertisement. Good work!
It turns out these key cards aren't as secure as first thought.
*Reads summary*
No, they are exactly as secure as I first thought - and second and third.
It's why I try to take anything valuable with me, or hide it, or lock it away somewhere when in any hotel room.
Luckily for all of us most hotel rooms are empty or don't hold much of worth plus there is the danger of entering one with someone in it, so it would be very tedious and difficult even with a master key to go through enough rooms to find something of real value.
If you want to target just one person where you can watch to see when they exit a room - then you are set.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
You should really update your website. It looks like one I made in High School, 15 years ago.
This has happened before about 6 years ago, with a different hotel lock system. Last time it was Onity, now it's Ving/Abloy.
https://hardware.slashdot.org/story/12/07/25/1326225/open-millions-of-hotel-rooms-with-arduino
I'm not terribly convinced this was something that was widespread hackable. Also, the fast that it took 10 years and thousands of hours to exploit tells me that the system was fairly secure BEFORE these guys decided to publish the details, which considerably reduces the costs.
It shouldn't come as a surprise that a hotel room isn't secure. They're vulnerable to social engineering, and just about every staff member can get into your hotel room. You think these keys are all kept securely, and don't leak out?
Years ago I stayed at a hotel with a slightly paranoid friend of mine. This slight paranoia led him to putting locks on his luggage, which had nothing of value in them anyway. We went out to get something to eat, and while we were away someone broke into the room, broke his cheap-ass luggage locks, and stole... nothing, because he didn't have anything valuable in your luggage. He was pissed because now he had several broken luggage locks, which probably cost $30 total. I didn't have luggage locks (because... why?) and didn't suffer any loss.
The point being that he the best defense against theft is to simply not bring much value with you. Keep your cell phone with you, bring a cheap laptop, and don't lock your bags. Also lock the damn door with the deadbolt that doesn't have a key when you sleep.
When you have one vendor that everyone turns to for the canonical "good security solution", it works fine until a hole is found because then everyone is at risk. The more diversity there is in security, the more likely there is to be a bug in any given implementation (bad), but at least when a hole is found, the entire system isn't at risk. Shuffle your attack surfaces. Have different key systems at different hotels. Or, better, on different floors, so that if a breach is found in one system, you can close that floor while you replace/repair the locks. Would that be more expensive? Yes. Security isn't cheap, but the bigger you make the target, the more tempting the target.
You might send up some red flags when you unlock an unoccupied room while housekeeping is not making their rounds
If you went into an unoccupied room at 11:00pm do you really think anyone is going to check before the morning?
Yes you will set up "red flags" which is nice because then they can clean the room when they check long after you are gone in the morning.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
And then what? Oh look, there is motion in our hotel room, but we are 50 miles away at the moment. I suppose you could call the hotel, but that might be too late.
I will now sleep soundly in my overseas hotel room, in a country whose main language I do not speak, a currency I'm not familiar with, and customs and cultures that are different from my own. However I used to be able to at least lock the hotel room and get a good night's sleep. A proverbial port in the storm.
Wonderful! /s
I'm a little surprised that the locks aren't networked, making mass-updates possible. I'm also impressed that they aren't all networked in a manner that allows f/w updates as that would just be another attack vector. An easily accessible USB port on the bottom of the lock would be just as bad. (as some hacked locks have had, on the *outside*!)
The hack makes millions of locks vulnerable, but it didn't open them all. The annoyance of updating all the locks individually is a consequence of not having them all connected in a way that would have made them more vulnerable.
If I have a laptop in the room, I always leave out the do not disturb sign (who needs maid service anyway), a thief is probably not going to enter a room with that on the door. I would say leave the TV on too, but that would be a real asshole move for the rooms around you.
Also I usually hide valuable things like laptops. Either I put it in a suitcase that I lock (though someone could still take the suitcase if they are hitting a bunch of rooms they probably will not bother to take a bulky suitcase) or hide it somewhere. Under a pillow on a made up bed is a good location, under the bed is not great as thieves will check there. On top of tall shelves in the back is decent.
Theft prevention is all a numbers game, you do what you can but sometimes the dice come up with missing laptop no matter what you do. But even simple precautions beyond "leave out on desk" can greatly improve your odds of success.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
I don't remember anyone ever explaining to me why I should think they're secure at all. They just .. exist. I can't even say they've been misrepresented to me.
"Believe me!" -- Donald Trump
Almost every room I stay in nowadays (and for a while) has electronic keycards. I have never had a room with a safe, though
Why do you have a cell phone if you don't keep it on you when you are mobile?
I remember, years back on Slashdot and other sites, being lectured about my naivete and ignorance when I argued we were opening our veins by making everything operable by computers and RFID and cards.
I am arguing the same now with automating driving, making car controls computer-based rather than mechanical, and linking cars together wirelessly. A half-dead termite can see what's coming. We can't give up profits and convenience even in the face of certain hacking and disaster. (It's a disaster when it happens to YOU).
Not a single joke about Sauron or "one key to rule them all" yet..
They let every criminal in, every room and the passwords for their room-safes are found on the internet but _we_ clients get a frown when we order a hooker?