Hackers Built a 'Master Key' For Millions of Hotel Rooms (zdnet.com) 126
An anonymous reader writes: Security researchers have built a master key that exploits a design flaw in a popular and widely used hotel electronic lock system, allowing unfettered access to every room in the building. The electronic lock system, known as Vision by VingCard and built by Swedish lock manufacturer Assa Abloy, is used in more than 42,000 properties in 166 countries, amounting to millions of hotel rooms -- as well as garages and storage units. These electronic lock systems are commonplace in hotels, used by staff to provide granular controls over where a person can go in a hotel -- such as their room -- and even restricting the floor that the elevator stops at. And these keys can be wiped and reused when guests check-out.
It turns out these key cards aren't as secure as first thought. F-Secure's Tomi Tuominen and Timo Hirvonen, who carried out the work, said they could create a master key 'basically out of thin air.' Any key card will do. Even old and expired, or discarded keys retain enough residual data to be used in the attack. Using a handheld device running custom software, the researchers can steal data off of a key card -- either using wireless radio-frequency identification (RFID) or the magnetic stripe. That device then manipulates the stolen key data, which identifies the hotel, to produce an access token with the highest level of privileges, effectively serving as a master key to every room in the building.
It turns out these key cards aren't as secure as first thought. F-Secure's Tomi Tuominen and Timo Hirvonen, who carried out the work, said they could create a master key 'basically out of thin air.' Any key card will do. Even old and expired, or discarded keys retain enough residual data to be used in the attack. Using a handheld device running custom software, the researchers can steal data off of a key card -- either using wireless radio-frequency identification (RFID) or the magnetic stripe. That device then manipulates the stolen key data, which identifies the hotel, to produce an access token with the highest level of privileges, effectively serving as a master key to every room in the building.
Locks in general, are not very secure. (Score:5, Insightful)
Re:Locks in general, are not very secure. (Score:5, Insightful)
Yeah, but this has the potential to make casual attacks even easier.
Does anyone know how hard it would be to update/patch the locks? Can it be patched at all?
Re: (Score:3)
Re: (Score:1, Interesting)
Re:Locks in general, are not very secure. (Score:5, Insightful)
And you can engage neither of these if you're not in the room.
Re: (Score:2)
And then what? Oh look, there is motion in our hotel room, but we are 50 miles away at the moment. I suppose you could call the hotel, but that might be too late.
Re: (Score:2, Insightful)
Wow. This sure is a brand new problem that hasn't been existence since forever.
How will the hotels respond to people having master keys to all their rooms across the entire country?
It's not as though they pass these out to every person who applies for a low-level cleaning job....
Oh. Right.
Never mind.
Re:Locks in general, are not very secure. (Score:4, Insightful)
Janitorial keys are limited to a floor or cluster of rooms, are individually assigned, and are traceable/auditable. A true master key that does not follow the audit trail is a problem, but the hotel management system can likely be used to flag on a master key use and send security.
Re: (Score:3)
the hotel management system can likely be used to flag on a master key use and send security
To my knowledge, I have never stayed in a hotel where the electronic door locks were connected to a central system. They operate completely independently, and the auditing system must be manually accessed from each unit. There are no alarms or notifications.
Re: (Score:2)
I know Penninsula hotels has been doing it for decades, although it took them a while to have it fully integrated in real time. Not sure if I am mixing up projects, but I think it was via Dallas Semi's one-wire link to the locks. Originally a door contacted prompted the room controller to get the lock details. Always got a kick out of how seriously they took it; they actually brought (4) DSL lines to each room with two for automation, one for entertainment, and one for guest internet.
I have seen similar
Re: (Score:2)
I would hope that there's a way to upgrade the locks so that they can prevent this attack. Though then the question is how difficult would that be (do you have to upgrade each lock one at a time?) and how many hotels would go through the process.
I can think of one possible upgrade. A small, flat metal object with fancy serrations along one edge. You insert it into a slot that has a mechanism that matches...
Re: (Score:2)
A small, flat metal object with fancy serrations along one edge. You insert it into a slot that has a mechanism that matches...
This! Because making a master one of these would be impossible.
Hint: it takes one valid key and a handful of blanks to figure out the master key.
Re: (Score:1)
Wrong. Knowing the bitting on a operating key typically doesn't even reduce the possible keyspace. An operating key and a master key do not need to share any depths, could share some depths, or could share most.
If one were to utilize a working key to disassemble a lock and take readings, a six-pin system would require the creation of 36 keys to determine a masterkey.
So no, not in any way a person could make "a handful" of keys and determine a master key..unless you are accustomed to dealing with master keye
Re: (Score:3)
If one were to utilize a working key to disassemble a lock and take readings, a six-pin system would require the creation of 36 keys to determine a masterkey.
No. It takes one key per pin to determine all the correct keyings for any lock. I'll leave the process to your imagination, if you have any.
Re: Locks in general, are not very secure. (Score:1)
http://www.crypto.com/masterkey.html
Re: (Score:2)
Re:Locks in general, are not very secure. (Score:4, Informative)
1) Traditional keys are far more expensive, per unit, than the cards used by these systems. Most use small paper-based cards with a mag strip, which cost mere pennies each. These is offset by the expense of the locks of course, but that's a capital expense rather than an operating expense.
2) Because of the need for master keys for hotel staff, locks need to have three piece pins rather than the common two piece. Changing these requires a locksmith and changing all the locks invalidates all the keys, master and non. On the other hand, a key card system can not only let staff have master keys, it can let every staff member have their own unique "master key". So if you have to fire Agnes the room cleaner, you can invalidate her key card at the same time, ditto if she just lost her current one.
3) Similar to the problem with Agnes, guests are constantly losing keys. It is trivial to run off as many extra keys as needed. (which also allows multiple keys when dealing with double occupancy) 4) Many lock systems communicate with the central server over wi-fi, allowing front desk staff to disable a guests access if they want to make sure he comes down to the front desk to talk to them.
5) As the summary says, it allows granular control. If you fill a batch of rooms with a commercial client (like a work crew for example), you can give them the discounted commercial bulk rate and disable their access to the pool and so on. For special guests who require a lot of privacy, such as celebrities, politicians and people in hiding from an abusive spouse, you can disable the staff master key access if needed. The logic is the same as using permission based security in the IT world
6) Finally, traditional tumbler and wafer locks using keys are no more secure than these key cards, even in the vulnerable state the article describes. Lock picking is well known these days and a set of picks can be had or made even cheaper than the hand held mag strip writing device. You can't quite pick a lock using paper clips as easily as the movies suggest (paper clips aren't hard and springy enough) but it can be done with some locks. And a skill in picking locks and a basic set of picks opens far more doors and padlocks around the world than this key card exploit can. Note that master keyed traditional locks are often *easier* to pick than standard keyed locks, because you have two breaks, hence two chances per pin to get that pin unlocked. To open a lock only requires that every barrel have a break in the pins lined up in the cylinder, there is nothing preventing you from picking or creating a key which uses some of the master key bitting and some of the standard key bitting.
Re: Locks in general, are not very secure. (Score:2)
Install cameras at each hallway in the hotels where these locks are used.
You are thus recording perpetrators and cleaning staff.
Don't keep all your valuables in your hotel room, as a precaution from theft.
Re:Locks in general, are not very secure. (Score:5, Informative)
The linked article answers that question:
Their discovery also prompted Assa Abloy to release a security patch to fix the flaws. According to their disclosure timeline, Assa Abloy was first told of the vulnerabilities a month later in April 2017, and met again over several months to fix the flaws. The software is patched at the central server, but the firmware on each lock needs to be updated.
So, it can be patched, but sounds like a bit of a pain. It also sounds like this was responsibly disclosed by the researchers to the manufacturer, so good for them on that point.
Re: (Score:2)
If not for that, they'd have incorporated some kind of signing mechanism so that the hotel's door readers can easily verify that a given card actually belonged to that hotel prior to processing any privilege tokens
Of course, but this vastly increases the cost of the locks themselves, which will have been made as cheap as they can possibly be. In real life, the security of the hotel's room locks isn't that important to the hotel.
Re: (Score:2)
42,000 properties, each with an unknown number of locks each, and they all need a firmware upgrade.
What have Assa Abloy done to get this firmware upgraded? Are they going to send technicians to every site to do the update for free? Or will they send out a carefully worded email that makes it sound like it's no big deal but if you are concerned you can pay for an upgrade?
Re: (Score:2)
At least they can't be updated over the network (Score:2)
I'm a little surprised that the locks aren't networked, making mass-updates possible. I'm also impressed that they aren't all networked in a manner that allows f/w updates as that would just be another attack vector. An easily accessible USB port on the bottom of the lock would be just as bad. (as some hacked locks have had, on the *outside*!)
The hack makes millions of locks vulnerable, but it didn't open them all. The annoyance of updating all the locks individually is a consequence of not having them a
Re: (Score:2)
It's less of a pain than re-keying locks which use physical keys.
The overall security issue here is being overblown because people are incorrectly comparing to a non-existent base state - that if hotel locks were somehow impervious to hacking. You need to compare to the next best alternative [investopedia.com]. In this case, electronic key cards replaced physical keys. Hotels with physical lock keys also had master keys (that's how maids got into every room to clean
Re: (Score:2)
Yep, that's why I said "a bit of a pain" rather than "a nightmare to fix." I'm not trying to overblow the issue, certainly, and I definitely think electronic keys are more secure than physical keys for the most part.
It does need to be fixed, but I wouldn't really call this a significant threat to security, given the fairly high technical hurdle to creating a forged master key.
Re: (Score:2)
I think they must be. How else would they change the keys everyday?
I've had them change the key same day when I lost my card
Re: (Score:3)
Yeah, but this has the potential to make casual attacks even easier.
Does anyone know how hard it would be to update/patch the locks? Can it be patched at all?
There [wikipedia.org] are [wikipedia.org] so [thehackernews.com] many [wikihow.com] ways [wikihow.com] to compromise locks, this changes nothing. Hotel locks are not electronic for security, they are electronic for ease of management.
Re: (Score:2)
Pretty much every keying system that allows a master key, is vulnerable to that master being duplicated.
And figuring out the master is not particularly difficult.
Even less so, when there is no mechanical difference between a unit key and a master.
"it's just bits"
Re: (Score:1)
From casual to trivial.
LK
Re: Locks in general, are not very secure. (Score:2)
Re: (Score:2)
Re: (Score:3)
Re: Locks in general, are not very secure. (Score:2)
E-Locks with a built in backdoor ( intentional or otherwise ) are even less secure.
I wish the DOJ would learn such things.
Re: (Score:2)
Thats why they have a safe in all rooms im sure will be the answer to this.
You mean those hotel safes that were found to all share the same master combination of 00000?
Re: (Score:2)
Almost every room I stay in nowadays (and for a while) has electronic keycards. I have never had a room with a safe, though
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Why do you have a cell phone if you don't keep it on you when you are mobile?
If the hackers have the master key... (Score:5, Insightful)
Re: (Score:2)
At any given time, the state-level entities of 1 state can do that. There are like 200 other states that cannot (I doubt the Chinese police can get a key to a US hotel room just by asking.)
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
And then you have to wonder if it was just a random laptop theft or if they knew who's laptop it was...
Re: (Score:1)
I would imagine staff have access.
yeah, but... no logs?!
Re: (Score:1)
what sort of international man of mystery are you, that (1) state level entities would be interested in what you do, and yet (2) not post as an anonymous coward, quiet lagoon 813062?
Maybe for you (Score:5, Informative)
It turns out these key cards aren't as secure as first thought.
*Reads summary*
No, they are exactly as secure as I first thought - and second and third.
It's why I try to take anything valuable with me, or hide it, or lock it away somewhere when in any hotel room.
Luckily for all of us most hotel rooms are empty or don't hold much of worth plus there is the danger of entering one with someone in it, so it would be very tedious and difficult even with a master key to go through enough rooms to find something of real value.
If you want to target just one person where you can watch to see when they exit a room - then you are set.
Re: (Score:1)
Or if you do have a master key and not targeting to pilfer rooms. you can always find an empty room for the night to stay free of charge.
Nathan
Re: (Score:2)
Probably not (Score:2)
You might send up some red flags when you unlock an unoccupied room while housekeeping is not making their rounds
If you went into an unoccupied room at 11:00pm do you really think anyone is going to check before the morning?
Yes you will set up "red flags" which is nice because then they can clean the room when they check long after you are gone in the morning.
Re: (Score:3)
Of course, these systems can be configured not to alert when an empty roo
Re: (Score:3)
Do you really think these systems don't alert the front desk when an unoccupied room is unlocked?
Do you honestly think they DO? You have an overactive imagination as to how much hotels care about room security.
And even if they did, what are the one or two guys at the front going to do about that anyway? Leave the front desk unmanned so they can get physically assaulted? Hardly.
I'm sure $40/night shitholes go that route because it's not worth it to deal with a squatter over $40 anyway,
Hint: The $200 shit
Re: (Score:2)
Do you honestly think they DO? You have an overactive imagination as to how much hotels care about room security.
No, I know hotels DGAF about room security. They do, however, care a lot about getting paid for their rooms.
And even if they did, what are the one or two guys at the front going to do about that anyway? Leave the front desk unmanned so they can get physically assaulted?
A $150+/night hotel is going to have security on site, who will accompany police to the room in question once they arrive on scene.
No imagination needed when you know people who work at a higher level in the industry.
Re: (Score:1)
So the solution really is to open several unoccupied rooms over the course of a couple hours, but not disturb them. Eventually the employees believe that something in the system is malfunctioning and stop checking the alerts.
Re: (Score:2)
Of course, these systems can be configured not to alert when an empty room is unlocked, and I'm sure $40/night shitholes go that route because it's not worth it to deal with a squatter over $40 anyway, but you can be sure the alerts are enabled at any of the places your typical egocentric hacker would target.
Likely, they do care because a squatter still has to be cleaned up after and as well as any damage they cause has to be repaired.
Re: (Score:2)
Re: Probably not (Score:2)
Nearly every keycard lock made (perhaps until recently) has absolutely no communication with anything. They are programmed by they keys. When a new guest inserts a new card, all old ones are deactivated. No communication needed. They are made to be cheap. Many have a secret port to reprogram them, however.
How do I know? I used to evaluate these systems. Newer locks use RFID which may be better.
Re: Probably not (Score:2)
Re: (Score:2)
Timestamp as I recall/guess. Not very secure, but then that's the point of this article. Maybe it encodes that using some algorithm, but there's no networking.
Re: (Score:3)
Luckily for all of us most hotel rooms are empty or don't hold much of worth
My partner went to a conference and three people had laptops stolen from their rooms without forced entry while they were in the bar. Hoteliers just shrugged.
Improve your odds (Score:4, Informative)
If I have a laptop in the room, I always leave out the do not disturb sign (who needs maid service anyway), a thief is probably not going to enter a room with that on the door. I would say leave the TV on too, but that would be a real asshole move for the rooms around you.
Also I usually hide valuable things like laptops. Either I put it in a suitcase that I lock (though someone could still take the suitcase if they are hitting a bunch of rooms they probably will not bother to take a bulky suitcase) or hide it somewhere. Under a pillow on a made up bed is a good location, under the bed is not great as thieves will check there. On top of tall shelves in the back is decent.
Theft prevention is all a numbers game, you do what you can but sometimes the dice come up with missing laptop no matter what you do. But even simple precautions beyond "leave out on desk" can greatly improve your odds of success.
Re:Maybe for you (Score:5, Informative)
This isn't the first time this has happened
https://www.wired.com/2017/08/... [wired.com]
They started out just stealing the fixtures like the TV from unoccupied rooms then started waiting for the occupants to leave and then taking their stuff while they were gone.
Re: (Score:2)
Happened before. (Score:2, Insightful)
This has happened before about 6 years ago, with a different hotel lock system. Last time it was Onity, now it's Ving/Abloy.
https://hardware.slashdot.org/story/12/07/25/1326225/open-millions-of-hotel-rooms-with-arduino
I'm not terribly convinced this was something that was widespread hackable. Also, the fast that it took 10 years and thousands of hours to exploit tells me that the system was fairly secure BEFORE these guys decided to publish the details, which considerably reduces the costs.
It shouldn't co
The problem with de facto standards for security (Score:3)
Wonderful! (Score:1)
I will now sleep soundly in my overseas hotel room, in a country whose main language I do not speak, a currency I'm not familiar with, and customs and cultures that are different from my own. However I used to be able to at least lock the hotel room and get a good night's sleep. A proverbial port in the storm.
Wonderful! /s
Re: (Score:3)
You can still secure the door from the inside for privacy. It's just that all bets are off when you leave in the morning for some sightseeing with all your valuables inside.
Now that I think of it.... (Score:3)
I don't remember anyone ever explaining to me why I should think they're secure at all. They just .. exist. I can't even say they've been misrepresented to me.
Re: (Score:3)
It's a social thing. There is a lock so you feel secure.
Most hotels I have stayed at actually have signs saying don't leave valuables out.
It's like the parking lots that advertise "Guarded and video surveillance". Then right next to the sign is another sign saying they aren't responsible for anything in the parking lot.
common fireman key let you go to any floor in the (Score:1)
common fireman key let you go to any floor in the elevator
I remember being lectured this was impossible (Score:3)
I remember, years back on Slashdot and other sites, being lectured about my naivete and ignorance when I argued we were opening our veins by making everything operable by computers and RFID and cards.
I am arguing the same now with automating driving, making car controls computer-based rather than mechanical, and linking cars together wirelessly. A half-dead termite can see what's coming. We can't give up profits and convenience even in the face of certain hacking and disaster. (It's a disaster when it happens to YOU).
I am disappointed by the /. nerds today (Score:1)
Not a single joke about Sauron or "one key to rule them all" yet..
Wot? (Score:5, Funny)
They let every criminal in, every room and the passwords for their room-safes are found on the internet but _we_ clients get a frown when we order a hooker?