4 ms·

Hotel management said that they have now been hit three times by cybercriminals who this time managed to take down the entire key system. The guests could no lo

Hotel management said that they have now been hit three times by cybercriminals who this time managed to take down the entire key system. The guests could no longer get in or out of the hotel rooms and new key cards could not be programmed. Oh dear god, three times? Bump this up your priority list, fellas. Brandstaetter said: "We are planning at the next room refurbishment for old-fashioned door locks with real keys. Just like 111 years ago at the time of our great-grandfathers." Ok. Or couldn't you just disconnect it from the net and secure local access? Have a mechanical override mechanism? I feel like there are many solutions here.

closeparen 10y ago
It's crazy that there wasn't a mechanical override to exit. I'd think that would be required by fire code in the US. >Or couldn't you just disconnect it from the net and secure local access? There are lots of ways this could work without internet access, and "secure local access" is easier said than done for a network which must extend through spaces where random people off the street have access and privacy. Electronic physical security vendors are not exactly shining beacons of top-notch security engineering. Researchers have found extremely careless, serious vulnerabilities in systems such as HID iClass [0] and your average hotel is probably using something much less sophisticated. Denial of service is probably much easier than unauthorized entry, and unauthorized entry isn't exactly hard. [0] https://krebsonsecurity.com/2014/08/how-secure-is-your-security-badge/ https://krebsonsecurity.com/2014/08/how-secure-is-your-secur...