Hackers built a 'master key' for millions of hotel rooms

[Yo_Mama_Been_Loggin]

Security researchers have built a master key that exploits a design flaw in a popular and widely used hotel electronic lock system, allowing unfettered access to every room in the building.

The electronic lock system, known as Vision by VingCard and built by Swedish lock manufacturer Assa Abloy, is used in more than 42,000 properties in 166 countries, amounting to millions of hotel rooms -- as well as garages and storage units.

These electronic lock systems are commonplace in hotels, used by staff to provide granular controls over where a person can go in a hotel -- such as their room -- and even restricting the floor that the elevator stops at. And these keys can be wiped and reused when guests check-out.

It turns out these key cards aren't as secure as first thought.

F-Secure's Tomi Tuominen and Timo Hirvonen, who carried out the work, said they could create a master key "basically out of thin air."

Any key card will do. Even old and expired, or discarded keys retain enough residual data to be used in the attack. Using a handheld device running custom software, the researchers can steal data off of a key card -- either using wireless radio-frequency identification (RFID) or the magnetic stripe. That device then manipulates the stolen key data, which identifies the hotel, to produce an access token with the highest level of privileges, effectively serving as a master key to every room in the building.

This wasn't an overnight effort. It took the researchers over a decade of work to get here.

https://www.msn.com/en-us/travel/news/hackers-built-a-master-key-for-millions-of-hotel-rooms/ar-AAwklKd?li=BBnb7Kz

[dalton99a]

1. "the firmware on each lock needs to be updated"

"This requires someone to be physically present at the lock," the researchers wrote.

At each lock.

[FakeNoose]

5. Hotels need to replace batteries in their door locks periodically

It's expensive, but it's a cost of doing business. I'd say at least once per year or maybe 2x.
They could easily reprogram each lock while inserting new batteries, and it probably wouldn't take more than a minute.

Just sayin'

[Hekate]

2. KnR. Bottom line: modern travel sucks

[hunter]

3. Paranoid me wonders if it was a feature, not a bug.

It would be a handy tool for secret police everywhere.

[hueymahl]

4. Bingo.

And not paranoid at all.

[S.E. TN Liberal]

6. Trusting technology means taking a gamble. nm

[Sherman A1]

7. Wow!

This is disturbing.

[raven mad]

8. I bet y'all will laugh at me...

I don't have a lot of occasion to stay at a hotel/motel. However, I'm still the one wedging a chair under the doorknob....

[HipChick]

9. Nope, I won't laugh...I still do that....I spend a lot of time at hotels travelling for work

as a single female...I ain't taking any chances..

[raven mad]

10. When encountering sliding-glass doors...

I have a well-travelled length of broomstick. My daughter swears it was made from my last witch-broom-tree encounter!