Catch up on stories from the past week (and beyond) at the Slashdot story archive

 



Forgot your password?
typodupeerror
Security

Hackers Built a 'Master Key' For Millions of Hotel Rooms (zdnet.com) 126

An anonymous reader writes: Security researchers have built a master key that exploits a design flaw in a popular and widely used hotel electronic lock system, allowing unfettered access to every room in the building. The electronic lock system, known as Vision by VingCard and built by Swedish lock manufacturer Assa Abloy, is used in more than 42,000 properties in 166 countries, amounting to millions of hotel rooms -- as well as garages and storage units. These electronic lock systems are commonplace in hotels, used by staff to provide granular controls over where a person can go in a hotel -- such as their room -- and even restricting the floor that the elevator stops at. And these keys can be wiped and reused when guests check-out.

It turns out these key cards aren't as secure as first thought. F-Secure's Tomi Tuominen and Timo Hirvonen, who carried out the work, said they could create a master key 'basically out of thin air.' Any key card will do. Even old and expired, or discarded keys retain enough residual data to be used in the attack. Using a handheld device running custom software, the researchers can steal data off of a key card -- either using wireless radio-frequency identification (RFID) or the magnetic stripe. That device then manipulates the stolen key data, which identifies the hotel, to produce an access token with the highest level of privileges, effectively serving as a master key to every room in the building.

This discussion has been archived. No new comments can be posted.

Hackers Built a 'Master Key' For Millions of Hotel Rooms

Comments Filter:
  • by Kenja ( 541830 ) on Wednesday April 25, 2018 @10:57AM (#56500011)
    They are a deterrent against casual attacks, and nothing more.
    • by H3lldr0p ( 40304 ) on Wednesday April 25, 2018 @11:02AM (#56500039) Homepage

      Yeah, but this has the potential to make casual attacks even easier.

      Does anyone know how hard it would be to update/patch the locks? Can it be patched at all?

      • I would hope that there's a way to upgrade the locks so that they can prevent this attack. Though then the question is how difficult would that be (do you have to upgrade each lock one at a time?) and how many hotels would go through the process.
        • Re: (Score:1, Interesting)

          by Anonymous Coward
          This is generally not an issue. Most hotel rooms include a deadbolt as well as a chain operated entry prevention device (EPD) that function as a manual backup system. If you hear your electronic lock go 'CLACK' in the middle of the night and your door quietly open because you forgot to engage the manual locks, you deserve the robbery that's about to happen.
        • Re: (Score:2, Insightful)

          by Anonymous Coward

          Wow. This sure is a brand new problem that hasn't been existence since forever.

          How will the hotels respond to people having master keys to all their rooms across the entire country?

          It's not as though they pass these out to every person who applies for a low-level cleaning job....

          Oh. Right.

          Never mind.

          • by aaarrrgggh ( 9205 ) on Wednesday April 25, 2018 @02:38PM (#56501505)

            Janitorial keys are limited to a floor or cluster of rooms, are individually assigned, and are traceable/auditable. A true master key that does not follow the audit trail is a problem, but the hotel management system can likely be used to flag on a master key use and send security.

            • the hotel management system can likely be used to flag on a master key use and send security

              To my knowledge, I have never stayed in a hotel where the electronic door locks were connected to a central system. They operate completely independently, and the auditing system must be manually accessed from each unit. There are no alarms or notifications.

              • I know Penninsula hotels has been doing it for decades, although it took them a while to have it fully integrated in real time. Not sure if I am mixing up projects, but I think it was via Dallas Semi's one-wire link to the locks. Originally a door contacted prompted the room controller to get the lock details. Always got a kick out of how seriously they took it; they actually brought (4) DSL lines to each room with two for automation, one for entertainment, and one for guest internet.

                I have seen similar

        • I would hope that there's a way to upgrade the locks so that they can prevent this attack. Though then the question is how difficult would that be (do you have to upgrade each lock one at a time?) and how many hotels would go through the process.

          I can think of one possible upgrade. A small, flat metal object with fancy serrations along one edge. You insert it into a slot that has a mechanism that matches...

          • A small, flat metal object with fancy serrations along one edge. You insert it into a slot that has a mechanism that matches...

            This! Because making a master one of these would be impossible.

            Hint: it takes one valid key and a handful of blanks to figure out the master key.

            • by Anonymous Coward

              Wrong. Knowing the bitting on a operating key typically doesn't even reduce the possible keyspace. An operating key and a master key do not need to share any depths, could share some depths, or could share most.

              If one were to utilize a working key to disassemble a lock and take readings, a six-pin system would require the creation of 36 keys to determine a masterkey.

              So no, not in any way a person could make "a handful" of keys and determine a master key..unless you are accustomed to dealing with master keye

              • If one were to utilize a working key to disassemble a lock and take readings, a six-pin system would require the creation of 36 keys to determine a masterkey.

                No. It takes one key per pin to determine all the correct keyings for any lock. I'll leave the process to your imagination, if you have any.

              • by Anonymous Coward

                http://www.crypto.com/masterkey.html

            • I was make a quite "tongue-in-cheek" response. Never meant to be taken seriously. Although, it seems as soon as you take any everyday device or process and digitize it, it won't be long until someone hacks it, creating yet another security issue that us regular morons have to worry about or get vicitimized by.
          • by morethanapapercert ( 749527 ) on Wednesday April 25, 2018 @02:33PM (#56501465) Homepage
            Well; there were and still are, good reasons to go with a key card system over a traditional key system.

            1) Traditional keys are far more expensive, per unit, than the cards used by these systems. Most use small paper-based cards with a mag strip, which cost mere pennies each. These is offset by the expense of the locks of course, but that's a capital expense rather than an operating expense.

            2) Because of the need for master keys for hotel staff, locks need to have three piece pins rather than the common two piece. Changing these requires a locksmith and changing all the locks invalidates all the keys, master and non. On the other hand, a key card system can not only let staff have master keys, it can let every staff member have their own unique "master key". So if you have to fire Agnes the room cleaner, you can invalidate her key card at the same time, ditto if she just lost her current one.

            3) Similar to the problem with Agnes, guests are constantly losing keys. It is trivial to run off as many extra keys as needed. (which also allows multiple keys when dealing with double occupancy) 4) Many lock systems communicate with the central server over wi-fi, allowing front desk staff to disable a guests access if they want to make sure he comes down to the front desk to talk to them.

            5) As the summary says, it allows granular control. If you fill a batch of rooms with a commercial client (like a work crew for example), you can give them the discounted commercial bulk rate and disable their access to the pool and so on. For special guests who require a lot of privacy, such as celebrities, politicians and people in hiding from an abusive spouse, you can disable the staff master key access if needed. The logic is the same as using permission based security in the IT world

            6) Finally, traditional tumbler and wafer locks using keys are no more secure than these key cards, even in the vulnerable state the article describes. Lock picking is well known these days and a set of picks can be had or made even cheaper than the hand held mag strip writing device. You can't quite pick a lock using paper clips as easily as the movies suggest (paper clips aren't hard and springy enough) but it can be done with some locks. And a skill in picking locks and a basic set of picks opens far more doors and padlocks around the world than this key card exploit can. Note that master keyed traditional locks are often *easier* to pick than standard keyed locks, because you have two breaks, hence two chances per pin to get that pin unlocked. To open a lock only requires that every barrel have a break in the pins lined up in the cylinder, there is nothing preventing you from picking or creating a key which uses some of the master key bitting and some of the standard key bitting.

        • Install cameras at each hallway in the hotels where these locks are used.
          You are thus recording perpetrators and cleaning staff.

          Don't keep all your valuables in your hotel room, as a precaution from theft.

      • by Dutch Gun ( 899105 ) on Wednesday April 25, 2018 @11:11AM (#56500089)

        The linked article answers that question:

        Their discovery also prompted Assa Abloy to release a security patch to fix the flaws. According to their disclosure timeline, Assa Abloy was first told of the vulnerabilities a month later in April 2017, and met again over several months to fix the flaws. The software is patched at the central server, but the firmware on each lock needs to be updated.

        So, it can be patched, but sounds like a bit of a pain. It also sounds like this was responsibly disclosed by the researchers to the manufacturer, so good for them on that point.

        • by AmiMoJo ( 196126 )

          42,000 properties, each with an unknown number of locks each, and they all need a firmware upgrade.

          What have Assa Abloy done to get this firmware upgraded? Are they going to send technicians to every site to do the update for free? Or will they send out a carefully worded email that makes it sound like it's no big deal but if you are concerned you can pay for an upgrade?

        • I'm a little surprised that the locks aren't networked, making mass-updates possible. I'm also impressed that they aren't all networked in a manner that allows f/w updates as that would just be another attack vector. An easily accessible USB port on the bottom of the lock would be just as bad. (as some hacked locks have had, on the *outside*!)

          The hack makes millions of locks vulnerable, but it didn't open them all. The annoyance of updating all the locks individually is a consequence of not having them a

        • So, it can be patched, but sounds like a bit of a pain

          It's less of a pain than re-keying locks which use physical keys.

          The overall security issue here is being overblown because people are incorrectly comparing to a non-existent base state - that if hotel locks were somehow impervious to hacking. You need to compare to the next best alternative [investopedia.com]. In this case, electronic key cards replaced physical keys. Hotels with physical lock keys also had master keys (that's how maids got into every room to clean

          • Yep, that's why I said "a bit of a pain" rather than "a nightmare to fix." I'm not trying to overblow the issue, certainly, and I definitely think electronic keys are more secure than physical keys for the most part.

            It does need to be fixed, but I wouldn't really call this a significant threat to security, given the fairly high technical hurdle to creating a forged master key.

      • Yeah, but this has the potential to make casual attacks even easier.

        Does anyone know how hard it would be to update/patch the locks? Can it be patched at all?

        There [wikipedia.org] are [wikipedia.org] so [thehackernews.com] many [wikihow.com] ways [wikihow.com] to compromise locks, this changes nothing. Hotel locks are not electronic for security, they are electronic for ease of management.

        • Pretty much every keying system that allows a master key, is vulnerable to that master being duplicated.

          And figuring out the master is not particularly difficult.
          Even less so, when there is no mechanical difference between a unit key and a master.

          "it's just bits"

      • From casual to trivial.

        LK

    • E-Locks with a built in backdoor ( intentional or otherwise ) are even less secure.

      I wish the DOJ would learn such things.

  • by QuietLagoon ( 813062 ) on Wednesday April 25, 2018 @11:29AM (#56500209)
    ... you can be sure that state-level entities also have it. It is one of the reasons why I use a disposable notebook, set up with a minimal configuration, when I travel.
    • Only if you have something to hide...
    • I read that the reason F-Secure looked into this in the first place was because one of their people had a laptop stolen from a hotel room with no sign of forced entry and no logs. So I'd guess _someone_ already has access.

      And then you have to wonder if it was just a random laptop theft or if they knew who's laptop it was...
    • by Anonymous Coward

      what sort of international man of mystery are you, that (1) state level entities would be interested in what you do, and yet (2) not post as an anonymous coward, quiet lagoon 813062?

  • Maybe for you (Score:5, Informative)

    by SuperKendall ( 25149 ) on Wednesday April 25, 2018 @11:30AM (#56500219)

    It turns out these key cards aren't as secure as first thought.

    *Reads summary*

    No, they are exactly as secure as I first thought - and second and third.

    It's why I try to take anything valuable with me, or hide it, or lock it away somewhere when in any hotel room.

    Luckily for all of us most hotel rooms are empty or don't hold much of worth plus there is the danger of entering one with someone in it, so it would be very tedious and difficult even with a master key to go through enough rooms to find something of real value.

    If you want to target just one person where you can watch to see when they exit a room - then you are set.

    • by Anonymous Coward

      Or if you do have a master key and not targeting to pilfer rooms. you can always find an empty room for the night to stay free of charge.

      Nathan

      • You might send up some red flags when you unlock an unoccupied room while housekeeping is not making their rounds; and if you unlock the room during their rounds they're likely to visit the room while you're in it, or see you entering the room they just finished cleaning and know is supposed to be empty. Expect a visit from hotel management shortly after you settle in if you try this.
        • You might send up some red flags when you unlock an unoccupied room while housekeeping is not making their rounds

          If you went into an unoccupied room at 11:00pm do you really think anyone is going to check before the morning?

          Yes you will set up "red flags" which is nice because then they can clean the room when they check long after you are gone in the morning.

          • Do you really think these systems don't alert the front desk when an unoccupied room is unlocked? They don't have to check, it alerts the front desk immediately. Housekeeping keycards are tagged with unique IDs (to identify the employee the card was assigned to), so they don't trigger the alerts, but you'd have to know one of those valid IDs in advance; simply setting the access token to whatever is used by housekeeping isn't enough.

            Of course, these systems can be configured not to alert when an empty roo
            • Do you really think these systems don't alert the front desk when an unoccupied room is unlocked?

              Do you honestly think they DO? You have an overactive imagination as to how much hotels care about room security.

              And even if they did, what are the one or two guys at the front going to do about that anyway? Leave the front desk unmanned so they can get physically assaulted? Hardly.

              I'm sure $40/night shitholes go that route because it's not worth it to deal with a squatter over $40 anyway,

              Hint: The $200 shit

              • Do you honestly think they DO? You have an overactive imagination as to how much hotels care about room security.

                No, I know hotels DGAF about room security. They do, however, care a lot about getting paid for their rooms.

                And even if they did, what are the one or two guys at the front going to do about that anyway? Leave the front desk unmanned so they can get physically assaulted?

                A $150+/night hotel is going to have security on site, who will accompany police to the room in question once they arrive on scene.

                No imagination needed when you know people who work at a higher level in the industry.

            • by Anonymous Coward

              So the solution really is to open several unoccupied rooms over the course of a couple hours, but not disturb them. Eventually the employees believe that something in the system is malfunctioning and stop checking the alerts.

            • Of course, these systems can be configured not to alert when an empty room is unlocked, and I'm sure $40/night shitholes go that route because it's not worth it to deal with a squatter over $40 anyway, but you can be sure the alerts are enabled at any of the places your typical egocentric hacker would target.

              Likely, they do care because a squatter still has to be cleaned up after and as well as any damage they cause has to be repaired.

              • There is that, as well, but I was trying not to be too argumentative; you see, the person I was replying to has a history of getting a bit, shall we say, aggressive when his arguments are destroyed too effectively.
            • Nearly every keycard lock made (perhaps until recently) has absolutely no communication with anything. They are programmed by they keys. When a new guest inserts a new card, all old ones are deactivated. No communication needed. They are made to be cheap. Many have a secret port to reprogram them, however.

              How do I know? I used to evaluate these systems. Newer locks use RFID which may be better.

              • So, then, how does the lock know the new card is valid? And how can the lock be opened by two or more cards if inserting a new one invalidates the old ones?
                • by nwf ( 25607 )

                  Timestamp as I recall/guess. Not very secure, but then that's the point of this article. Maybe it encodes that using some algorithm, but there's no networking.

    • by LQ ( 188043 )

      Luckily for all of us most hotel rooms are empty or don't hold much of worth

      My partner went to a conference and three people had laptops stolen from their rooms without forced entry while they were in the bar. Hoteliers just shrugged.

      • Improve your odds (Score:4, Informative)

        by SuperKendall ( 25149 ) on Wednesday April 25, 2018 @12:44PM (#56500747)

        If I have a laptop in the room, I always leave out the do not disturb sign (who needs maid service anyway), a thief is probably not going to enter a room with that on the door. I would say leave the TV on too, but that would be a real asshole move for the rooms around you.

        Also I usually hide valuable things like laptops. Either I put it in a suitcase that I lock (though someone could still take the suitcase if they are hitting a bunch of rooms they probably will not bother to take a bulky suitcase) or hide it somewhere. Under a pillow on a made up bed is a good location, under the bed is not great as thieves will check there. On top of tall shelves in the back is decent.

        Theft prevention is all a numbers game, you do what you can but sometimes the dice come up with missing laptop no matter what you do. But even simple precautions beyond "leave out on desk" can greatly improve your odds of success.

    • Re:Maybe for you (Score:5, Informative)

      by sims 2 ( 994794 ) on Wednesday April 25, 2018 @12:30PM (#56500637)

      This isn't the first time this has happened
      https://www.wired.com/2017/08/... [wired.com]

      They started out just stealing the fixtures like the TV from unoccupied rooms then started waiting for the occupants to leave and then taking their stuff while they were gone.

    • The plot twist... while you are out there with your super important stuff back at home... your home is getting pwned by a brick through the window.
  • Happened before. (Score:2, Insightful)

    by Anonymous Coward

    This has happened before about 6 years ago, with a different hotel lock system. Last time it was Onity, now it's Ving/Abloy.

    https://hardware.slashdot.org/story/12/07/25/1326225/open-millions-of-hotel-rooms-with-arduino

    I'm not terribly convinced this was something that was widespread hackable. Also, the fast that it took 10 years and thousands of hours to exploit tells me that the system was fairly secure BEFORE these guys decided to publish the details, which considerably reduces the costs.

    It shouldn't co

  • by Aristos Mazer ( 181252 ) on Wednesday April 25, 2018 @12:02PM (#56500417)
    When you have one vendor that everyone turns to for the canonical "good security solution", it works fine until a hole is found because then everyone is at risk. The more diversity there is in security, the more likely there is to be a bug in any given implementation (bad), but at least when a hole is found, the entire system isn't at risk. Shuffle your attack surfaces. Have different key systems at different hotels. Or, better, on different floors, so that if a breach is found in one system, you can close that floor while you replace/repair the locks. Would that be more expensive? Yes. Security isn't cheap, but the bigger you make the target, the more tempting the target.
  • by Anonymous Coward

    I will now sleep soundly in my overseas hotel room, in a country whose main language I do not speak, a currency I'm not familiar with, and customs and cultures that are different from my own. However I used to be able to at least lock the hotel room and get a good night's sleep. A proverbial port in the storm.

    Wonderful! /s

    • by PPH ( 736903 )

      You can still secure the door from the inside for privacy. It's just that all bets are off when you leave in the morning for some sightseeing with all your valuables inside.

  • by Cajun Hell ( 725246 ) on Wednesday April 25, 2018 @12:56PM (#56500833) Homepage Journal

    It turns out these key cards aren't as secure as first thought

    I don't remember anyone ever explaining to me why I should think they're secure at all. They just .. exist. I can't even say they've been misrepresented to me.

    • It's a social thing. There is a lock so you feel secure.

      Most hotels I have stayed at actually have signs saying don't leave valuables out.

      It's like the parking lots that advertise "Guarded and video surveillance". Then right next to the sign is another sign saying they aren't responsible for anything in the parking lot.

  • common fireman key let you go to any floor in the elevator

  • by Catbeller ( 118204 ) on Wednesday April 25, 2018 @02:41PM (#56501529) Homepage

    I remember, years back on Slashdot and other sites, being lectured about my naivete and ignorance when I argued we were opening our veins by making everything operable by computers and RFID and cards.
    I am arguing the same now with automating driving, making car controls computer-based rather than mechanical, and linking cars together wirelessly. A half-dead termite can see what's coming. We can't give up profits and convenience even in the face of certain hacking and disaster. (It's a disaster when it happens to YOU).

  • by Anonymous Coward

    Not a single joke about Sauron or "one key to rule them all" yet..

  • Wot? (Score:5, Funny)

    by nospam007 ( 722110 ) * on Wednesday April 25, 2018 @02:52PM (#56501625)

    They let every criminal in, every room and the passwords for their room-safes are found on the internet but _we_ clients get a frown when we order a hooker?

There's no such thing as a free lunch. -- Milton Friendman

Working...