Cybersecurity researchers discover a way to use old key cards to access every room in...

[Polycount]

If you thought hotels were one of the more secure places to spend the night on the road, cybersecurity firm F-Secure's latest findings might change your mind.

As reported by ZDNet, researchers working at the firm have built a "master key" that can unlock virtually any electronic lock in a hotel.

They've accomplished this feat by exploiting a flaw in one of the most popular electronic lock systems out there, "Vision." Built by Swedish company Assa Abloy, Vision locks are reportedly used in over 42,000 properties across 166 countries.

While these electronic locks are likely good enough for keeping the average would-be intruder at bay, F-Secure's researchers have found a way to swipe data from functional or expired hotel cards to bypass Vision locks entirely.

"It can be your own room key, a cleaning staff key, even to the garage or workout facility," F-Secure Practice Leader Tomi Tuominen said in a statement to Gizmodo. "We can even do it in an elevator if you have your key in your front pocket; we can just clone it from there."

They clone these key cards by using a "handheld device running custom software." The device can send out wireless RFID signals to acquire and transform the key's data. For example, a hacker using a similar device to the one F-Secure's researches developed could theoretically use your hotel key card's data to create a master key to every electronic lock in the building.

If that sounds like a terrifying prospect to you, F-Secure feels there's no real cause for worry at the moment. "Developing [the] attack took a considerable amount of time and effort," F-Secure said in an email. Furthermore, the firm claims they aren't aware of any other instances of this method being used throughout the world.

Permalink to story.

https://www.techspot.com/news/74323-cybersecurity-researchers-discover-way-use-old-key-cards.html

 

[Uncle Al]

One of the major issues is the simplicity of these cards. Even the one time paper cards use a simple routine that is easily broken. I'm told by a friend in the industry that hotel employee's don't want better security because it makes it harder for them to get into the rooms ..... for what reason you can guess, but it's certainly not very comforting .....

 

[GreenNova343]

And this is why, when we're in the hotel room, we make sure the deadbolt latch is turned -- or, for more security, that the manual catch bar near the top of the door is hooked up.

 

[DelJo63]

And this is why, when we're in the hotel room, we make sure the deadbolt latch is turned -- or, for more security, that the manual catch bar near the top of the door is hooked up.

Just how does one do that when you're out-n-about town taking in the sights??

 

[GreenNova343]

Just how does one do that when you're out-n-about town taking in the sights??

That's the downfall...although to be fair, when we're "on walkabout" we have the important things -- smartphones, wallets/purses, credit cards, etc. -- with us. So at worst, if someone breaks in they'll be able to pawn off our stolen toothpaste, hairspray, underwear, charger cords, etc. -- items that are either a) most likely not able to be used by them (because the size doesn't match), or b) they're so cheap to buy new that you won't make any money off of them.

 

[DoNotBeFooled]

The only saving grace here is that the person trying to compromise security needs to be there in person and put int the time and effort to acquire the keys. So chances are they will want a compromised hotel staff member, someone paid off to collect all the key information. But then again, shouldn't modern hotel security system be changing up the keycodes for every lock after the previous client had moved out?

And if you are worried about your security of your stuff when you are away, can't you put a camera to record your room when you are away?

 

[nestorius]

I have a .40 surprise for anyone entering a room I am sleeping in. I also have a way to know when someone is tampering with my locked door. I don't care who they are there will be a funeral in 3 days!