Master Key For Hotel Rooms

seckorama (68)in #security • 8 years ago

Specialists from F-Secure, Tomi Tuominen, and Timo Hirvonen discover a security problem in hotel key card system and created a passkey that unlocks million of hotel room doors.

kaleidoscope source

Weakness is in a widely used electronic lock system Vision made by VingCard, by the world's largest lock manufacturer, Assa Abloy. It can be exploited to unlock every locked room in a facility. This system is used in more than 42,000 facilities in 166 different countries, which equals to millions of doors.

The researchers had the ability to create a technique that allowed them to use any keycard from the target facility, no matter a card was old, expired or discarded.

gif source

An attacker could read the data remotely by standing near to a hotel guest or employee owning a keycard in his pocket, or just could book a room and then use that card as the source.

The custom device (an RFID reader/writer) than try different keys in less than one minute, locates the master key and unlocks the door. So, the attack can be executed without any attention or any alerts.

Here's the video:

Dr.Richard Ford, Forcepoint, says:

With today's technology, it is inevitable that we will see lapses in security that expose us to risk. What's, therefore, most important is that we practice defense in detail wherever we can (for example, leave your wallet in the safe!) and that we become agile in our ability to mitigate risks as they are found. This is unlikely to remain the last time we are aware of major insecurities in systems; what we need to do is be ready to respond."

F-Secure has not yet released full technical details of the hack. Also, there's no proof that the hack has ever been utilized.

More security news:
Internet Passwords Will Soon Be A History?
Does This Change Will Speed Up Your Internet?
5 Privacies You Didn't Know You Lost
Piracy Is Popular Like Never Before
Kaspersky Lab Joins Enterprise Ethereum Alliance
Slingshot - A State-Sponsored Malware
In Egypt And Turkey Users Got State Spyware
New Security Threat: ADB.Miner
Stolen Credit Card Numbers In OnePlus
Backdoor Found In Lenovo Network Switches
Skype And Signal