Hackers Built a 'Master Key' For Millions of Hotel Rooms (zdnet.com)

An anonymous reader writes: Security researchers have built a master key that exploits a design flaw in a popular and widely used hotel electronic lock system, allowing unfettered access to every room in the building. The electronic lock system, known as Vision by VingCard and built by Swedish lock manufacturer Assa Abloy, is used in more than 42,000 properties in 166 countries, amounting to millions of hotel rooms -- as well as garages and storage units. These electronic lock systems are commonplace in hotels, used by staff to provide granular controls over where a person can go in a hotel -- such as their room -- and even restricting the floor that the elevator stops at. And these keys can be wiped and reused when guests check-out.

It turns out these key cards aren't as secure as first thought. F-Secure's Tomi Tuominen and Timo Hirvonen, who carried out the work, said they could create a master key 'basically out of thin air.' Any key card will do. Even old and expired, or discarded keys retain enough residual data to be used in the attack. Using a handheld device running custom software, the researchers can steal data off of a key card -- either using wireless radio-frequency identification (RFID) or the magnetic stripe. That device then manipulates the stolen key data, which identifies the hotel, to produce an access token with the highest level of privileges, effectively serving as a master key to every room in the building.

Comments

Locks in general, are not very secure.

[Kenja]

They are a deterrent against casual attacks, and nothing more.

Re:Locks in general, are not very secure.

[H3lldr0p]

Yeah, but this has the potential to make casual attacks even easier.

Does anyone know how hard it would be to update/patch the locks? Can it be patched at all?

Re:Locks in general, are not very secure.

[Dutch Gun]

The linked article answers that question:

Their discovery also prompted Assa Abloy to release a security patch to fix the flaws. According to their disclosure timeline, Assa Abloy was first told of the vulnerabilities a month later in April 2017, and met again over several months to fix the flaws. The software is patched at the central server, but the firmware on each lock needs to be updated.

So, it can be patched, but sounds like a bit of a pain. It also sounds like this was responsibly disclosed by the researchers to the manufacturer, so good for them on that point.

Re:Locks in general, are not very secure.

[omnichad]

And you can engage neither of these if you're not in the room.

Re:Locks in general, are not very secure.

[morethanapapercert]

Well; there were and still are, good reasons to go with a key card system over a traditional key system.

1) Traditional keys are far more expensive, per unit, than the cards used by these systems. Most use small paper-based cards with a mag strip, which cost mere pennies each. These is offset by the expense of the locks of course, but that's a capital expense rather than an operating expense.

2) Because of the need for master keys for hotel staff, locks need to have three piece pins rather than the common two piece. Changing these requires a locksmith and changing all the locks invalidates all the keys, master and non. On the other hand, a key card system can not only let staff have master keys, it can let every staff member have their own unique "master key". So if you have to fire Agnes the room cleaner, you can invalidate her key card at the same time, ditto if she just lost her current one.

3) Similar to the problem with Agnes, guests are constantly losing keys. It is trivial to run off as many extra keys as needed. (which also allows multiple keys when dealing with double occupancy) 4) Many lock systems communicate with the central server over wi-fi, allowing front desk staff to disable a guests access if they want to make sure he comes down to the front desk to talk to them.

5) As the summary says, it allows granular control. If you fill a batch of rooms with a commercial client (like a work crew for example), you can give them the discounted commercial bulk rate and disable their access to the pool and so on. For special guests who require a lot of privacy, such as celebrities, politicians and people in hiding from an abusive spouse, you can disable the staff master key access if needed. The logic is the same as using permission based security in the IT world

6) Finally, traditional tumbler and wafer locks using keys are no more secure than these key cards, even in the vulnerable state the article describes. Lock picking is well known these days and a set of picks can be had or made even cheaper than the hand held mag strip writing device. You can't quite pick a lock using paper clips as easily as the movies suggest (paper clips aren't hard and springy enough) but it can be done with some locks. And a skill in picking locks and a basic set of picks opens far more doors and padlocks around the world than this key card exploit can. Note that master keyed traditional locks are often *easier* to pick than standard keyed locks, because you have two breaks, hence two chances per pin to get that pin unlocked. To open a lock only requires that every barrel have a break in the pins lined up in the cylinder, there is nothing preventing you from picking or creating a key which uses some of the master key bitting and some of the standard key bitting.

Re:Locks in general, are not very secure.

[aaarrrgggh]

Janitorial keys are limited to a floor or cluster of rooms, are individually assigned, and are traceable/auditable. A true master key that does not follow the audit trail is a problem, but the hotel management system can likely be used to flag on a master key use and send security.

If the hackers have the master key...

[QuietLagoon]

... you can be sure that state-level entities also have it. It is one of the reasons why I use a disposable notebook, set up with a minimal configuration, when I travel.

Maybe for you

[SuperKendall]

It turns out these key cards aren't as secure as first thought.

*Reads summary*

No, they are exactly as secure as I first thought - and second and third.

It's why I try to take anything valuable with me, or hide it, or lock it away somewhere when in any hotel room.

Luckily for all of us most hotel rooms are empty or don't hold much of worth plus there is the danger of entering one with someone in it, so it would be very tedious and difficult even with a master key to go through enough rooms to find something of real value.

If you want to target just one person where you can watch to see when they exit a room - then you are set.

Re:Maybe for you

[sims 2]

This isn't the first time this has happened
https://www.wired.com/2017/08/...

They started out just stealing the fixtures like the TV from unoccupied rooms then started waiting for the occupants to leave and then taking their stuff while they were gone.

Improve your odds

[SuperKendall]

If I have a laptop in the room, I always leave out the do not disturb sign (who needs maid service anyway), a thief is probably not going to enter a room with that on the door. I would say leave the TV on too, but that would be a real asshole move for the rooms around you.

Also I usually hide valuable things like laptops. Either I put it in a suitcase that I lock (though someone could still take the suitcase if they are hitting a bunch of rooms they probably will not bother to take a bulky suitcase) or hide it somewhere. Under a pillow on a made up bed is a good location, under the bed is not great as thieves will check there. On top of tall shelves in the back is decent.

Theft prevention is all a numbers game, you do what you can but sometimes the dice come up with missing laptop no matter what you do. But even simple precautions beyond "leave out on desk" can greatly improve your odds of success.

Wot?

[nospam007]

They let every criminal in, every room and the passwords for their room-safes are found on the internet but _we_ clients get a frown when we order a hooker?