Slashdot Mirror
Hackers Built a 'Master Key' For Millions of Hotel Rooms (zdnet.com)
An anonymous reader writes: Security researchers have built a master key that exploits a design flaw in a popular and widely used hotel electronic lock system, allowing unfettered access to every room in the building. The electronic lock system, known as Vision by VingCard and built by Swedish lock manufacturer Assa Abloy, is used in more than 42,000 properties in 166 countries, amounting to millions of hotel rooms -- as well as garages and storage units. These electronic lock systems are commonplace in hotels, used by staff to provide granular controls over where a person can go in a hotel -- such as their room -- and even restricting the floor that the elevator stops at. And these keys can be wiped and reused when guests check-out.
It turns out these key cards aren't as secure as first thought. F-Secure's Tomi Tuominen and Timo Hirvonen, who carried out the work, said they could create a master key 'basically out of thin air.' Any key card will do. Even old and expired, or discarded keys retain enough residual data to be used in the attack. Using a handheld device running custom software, the researchers can steal data off of a key card -- either using wireless radio-frequency identification (RFID) or the magnetic stripe. That device then manipulates the stolen key data, which identifies the hotel, to produce an access token with the highest level of privileges, effectively serving as a master key to every room in the building.
It turns out these key cards aren't as secure as first thought. F-Secure's Tomi Tuominen and Timo Hirvonen, who carried out the work, said they could create a master key 'basically out of thin air.' Any key card will do. Even old and expired, or discarded keys retain enough residual data to be used in the attack. Using a handheld device running custom software, the researchers can steal data off of a key card -- either using wireless radio-frequency identification (RFID) or the magnetic stripe. That device then manipulates the stolen key data, which identifies the hotel, to produce an access token with the highest level of privileges, effectively serving as a master key to every room in the building.
They are a deterrent against casual attacks, and nothing more.
"Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"
The correct term is cracker, however that battle was lost a long time ago.
... you can be sure that state-level entities also have it. It is one of the reasons why I use a disposable notebook, set up with a minimal configuration, when I travel.
It turns out these key cards aren't as secure as first thought.
*Reads summary*
No, they are exactly as secure as I first thought - and second and third.
It's why I try to take anything valuable with me, or hide it, or lock it away somewhere when in any hotel room.
Luckily for all of us most hotel rooms are empty or don't hold much of worth plus there is the danger of entering one with someone in it, so it would be very tedious and difficult even with a master key to go through enough rooms to find something of real value.
If you want to target just one person where you can watch to see when they exit a room - then you are set.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
This has happened before about 6 years ago, with a different hotel lock system. Last time it was Onity, now it's Ving/Abloy.
https://hardware.slashdot.org/story/12/07/25/1326225/open-millions-of-hotel-rooms-with-arduino
I'm not terribly convinced this was something that was widespread hackable. Also, the fast that it took 10 years and thousands of hours to exploit tells me that the system was fairly secure BEFORE these guys decided to publish the details, which considerably reduces the costs.
It shouldn't come as a surprise that a hotel room isn't secure. They're vulnerable to social engineering, and just about every staff member can get into your hotel room. You think these keys are all kept securely, and don't leak out?
Years ago I stayed at a hotel with a slightly paranoid friend of mine. This slight paranoia led him to putting locks on his luggage, which had nothing of value in them anyway. We went out to get something to eat, and while we were away someone broke into the room, broke his cheap-ass luggage locks, and stole... nothing, because he didn't have anything valuable in your luggage. He was pissed because now he had several broken luggage locks, which probably cost $30 total. I didn't have luggage locks (because... why?) and didn't suffer any loss.
The point being that he the best defense against theft is to simply not bring much value with you. Keep your cell phone with you, bring a cheap laptop, and don't lock your bags. Also lock the damn door with the deadbolt that doesn't have a key when you sleep.
When you have one vendor that everyone turns to for the canonical "good security solution", it works fine until a hole is found because then everyone is at risk. The more diversity there is in security, the more likely there is to be a bug in any given implementation (bad), but at least when a hole is found, the entire system isn't at risk. Shuffle your attack surfaces. Have different key systems at different hotels. Or, better, on different floors, so that if a breach is found in one system, you can close that floor while you replace/repair the locks. Would that be more expensive? Yes. Security isn't cheap, but the bigger you make the target, the more tempting the target.
Do you really think these systems don't alert the front desk when an unoccupied room is unlocked? They don't have to check, it alerts the front desk immediately. Housekeeping keycards are tagged with unique IDs (to identify the employee the card was assigned to), so they don't trigger the alerts, but you'd have to know one of those valid IDs in advance; simply setting the access token to whatever is used by housekeeping isn't enough.
Of course, these systems can be configured not to alert when an empty room is unlocked, and I'm sure $40/night shitholes go that route because it's not worth it to deal with a squatter over $40 anyway, but you can be sure the alerts are enabled at any of the places your typical egocentric hacker would target.
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
If I have a laptop in the room, I always leave out the do not disturb sign (who needs maid service anyway), a thief is probably not going to enter a room with that on the door. I would say leave the TV on too, but that would be a real asshole move for the rooms around you.
Also I usually hide valuable things like laptops. Either I put it in a suitcase that I lock (though someone could still take the suitcase if they are hitting a bunch of rooms they probably will not bother to take a bulky suitcase) or hide it somewhere. Under a pillow on a made up bed is a good location, under the bed is not great as thieves will check there. On top of tall shelves in the back is decent.
Theft prevention is all a numbers game, you do what you can but sometimes the dice come up with missing laptop no matter what you do. But even simple precautions beyond "leave out on desk" can greatly improve your odds of success.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Do you really think these systems don't alert the front desk when an unoccupied room is unlocked?
Do you honestly think they DO? You have an overactive imagination as to how much hotels care about room security.
And even if they did, what are the one or two guys at the front going to do about that anyway? Leave the front desk unmanned so they can get physically assaulted? Hardly.
I'm sure $40/night shitholes go that route because it's not worth it to deal with a squatter over $40 anyway,
Hint: The $200 shitholes also do not really care. Of course there are alerts but I am saying if you go in late and leave early the late shift people are just going to say "screw it".
"There is more worth loving than we have strength to love." - Brian Jay Stanley
I don't remember anyone ever explaining to me why I should think they're secure at all. They just .. exist. I can't even say they've been misrepresented to me.
"Believe me!" -- Donald Trump
You can still secure the door from the inside for privacy. It's just that all bets are off when you leave in the morning for some sightseeing with all your valuables inside.
Have gnu, will travel.
I remember, years back on Slashdot and other sites, being lectured about my naivete and ignorance when I argued we were opening our veins by making everything operable by computers and RFID and cards.
I am arguing the same now with automating driving, making car controls computer-based rather than mechanical, and linking cars together wirelessly. A half-dead termite can see what's coming. We can't give up profits and convenience even in the face of certain hacking and disaster. (It's a disaster when it happens to YOU).
They let every criminal in, every room and the passwords for their room-safes are found on the internet but _we_ clients get a frown when we order a hooker?