13 ms·
Hackers found a way to open any of 3M hotel keycard locks
- tromp 3y agohttps://archive.is/a7ntC https://archive.is/a7ntC
- Symbiote 3y ago> They warn that the deadbolt on the room is also controlled by the keycard lock, so it doesn't provide an extra safeguard. That is the biggest surprise to me. I had assumed getting around the deadbolt would require a locksmith or breaking the door. (What's the point of it otherwise?)
- swells34 3y agoGood feels and security theater
- westmeal 3y agoA lot of hotels I've been to also have a latch you can physically lock the door with which would prevent someone from actually entering, but I bet you may be able to slowly pry that open with a jig of some sort.
- Onawa 3y agohttps://foleybelsawlocksmithing.com/products/hotel-door-hinged-bar-lock-bypass-tool https://foleybelsawlocksmithing.com/products/hotel-door-hing...
- drspacemonkey 3y agoIt's called a "swing bar". It's easy to open from tho2e outside with some duct tape and a rubber band, unfortunately. Plenty of easy instructions on YouTube.
- fitchjo 3y agoI assume/hope the newer versions in hotels that are a little l bracket that flips are little harder to get open?
- Kye 3y agoThere are tools specifically designed to open these. At best, they make an attempt to break in more conspicuous.
- dylan604 3y ago> (What's the point of it otherwise?) How else would the hotel staff enter the room when the current occupant is locked in the room, but dead or some lesser medical emergency condition?
- Symbiote 3y agoBeing dead isn't urgent, they could call a locksmith. A medical emergency would justify breaking the door. The same applies to my apartment door.
- dylan604 3y agoImagine how much faster it would be with an emergency key unlocking the security deadbolt rather than just the door lock. Housekeeping keys do not have the ability to unlock the security bolt, but management does that can used by the appropriate emergency responders. Police doing an investigation with a warrant would be appropriate, but a cop with a hunch would not
- urbandw311er 3y agoIt only becomes non-urgent once you can get in the room to confirm they’re dead.
- shermantanktop 3y agoSchrödinger's Hotel Guest.
- wongarsu 3y agoOnce the hotel is big enough this will occur so frequently that all those locksmith bills and new doors incur a notable cost, enough that for your next lock system you choose something that lets hotel employees override the deadbolt. Most customers won't care or notice, and those that do are offset by those that got inconvenienced by someone breaking down the door next to them.
- sandworm101 3y ago>> I had assumed getting around the deadbolt would require a locksmith or breaking the door. Look into what happens when someone pulls a fire alarm. Some building-wide lock systems will actively unlock doors during a fire scenario.
- Cheer2171 3y agoPeople lock themselves in hotel rooms and refuse to leave more often than you'd think.
- mint2 3y agoOkay that title was confusing, the 3M is quantity not the company 3M’s locks. The locks are not build by 3M or a subsidiary.
- mikestew 3y agoIt would be nice if the title could get changed, as per below, because it confused me, too: https://corporatefinanceinstitute.com/resources/fixed-income/mm-millions/ https://corporatefinanceinstitute.com/resources/fixed-income...
- Shog9 3y agoThe original title sez "millions" and is clearly distinct from both "Minnesota mining and manufacturing" and "millimeters".
- rad_gruchalski 3y agoYes, because the millimeter is “mm”, a meter is “m” and “M” means mega (for example MPa for megapascal) in SI.
- Shog9 3y agoThe gp here was referencing a weird little bit of accountant jargon that uses a corruption of roman numerals to indicate million as a product of thousands. It's a terrible idea, but crops up in software circles occasionally due to the number of folks stuck writing financial software. AFAIK, even accountants are slowly moving away from it for ... Obvious reasons.
- TylerE 3y agoIt's especially confusing because 3M does make almost every thing under the sun, from respirators to electrical tape to medical equipment and supplies. No locks as far as I can find though.
- 3y ago
- dboreham 3y agoPresumably with Scotch Tape or Post-it Notes.
- barbazoo 3y agoNot that kind of "3M" :)
- iancarroll 3y agoI worked on this research along with many others, happy to answer any questions! Our disclosure is also available at https://unsaflok.com https://unsaflok.com.
- ildjarn 3y agoDid you set out to find a vulnerability or just stumble on it? If setting out to find a vulnerability, how do you get started? What is the “open ide, write print(“hello world”)” for this kind of work?
- xeornet 3y agoThe article explains that they were at a hackathon of sorts, where these 2 were specifically targeting the locks/passes. I would assume reading the cards with a reader would be a great start.
- aftbit 3y agoWhen do you plan to release technical details on the attack? Surely the long tail of door locks will not be replaced for a decade or more.
- rwmj 3y agoHow did Saflok respond? Were they collaborative or did they try to threaten you / suppress the information?
- iancarroll 3y agoThey have been taking it seriously although they didn’t have any sort of formal bug bounty / security disclosure method at the time. The disclosure timeline is in our article as well!
- kidbomb 3y agoThis part caught my eye: "Note that this information only applies to dormakaba Saflok systems; several other lock manufacturers use MIFARE Classic keycards and are not affected by the Unsaflok vulnerability" So it is likely they way that Saflok implemented MIFARE Classic. Will start to read about this protocol more.
- pajko 3y agoJust like microcorruption in real life :) https://microcorruption.com/map https://microcorruption.com/map
- NooneAtAll3 3y agoI love these asm hacking challenges
- jerpint 3y ago> An attacker only needs to read one keycard from the property to perform the attack against any door in the property That’s a pretty serious vulnerability, pretty much all it takes is to be a guest at a hotel
- duderific 3y agoOften times, the hotels don't even require to turn in these cards upon checkout, so they are thrown in the trash. A nefarious actor could just pull one out of the trash and so not even have to be a guest in the hotel.
- nerevarthelame 3y agoIt seems irresponsible that it took dormakaba more than a year to fix a single lock. And even now, 1.5 years after the initial disclosure, still only around a third have been updated.
- jeffbee 3y agoI hate to break it to anyone but most locked doors can be opened "in seconds" by a variety of means. For the most part the locked state is a signal of prohibition, rather than a meaningful enforcement thereof.
- SquirrelOnFire 3y ago"Locked doors only stop honest people" -Abe Lincoln
- dhosek 3y agoI could open any locked door at my high school by slipping my ID in the gap between the door and the frame and wedging the bolt open. I kind of suspect that forty years later, this vulnerability remains.
- pineaux 3y agoFormer locksmith here. That is called "to flipper" a door. (Guess that is where the flipperzero name comes from) However you can only flipper doors that are held closed by the latch bolt. If the lock deadbolt is engaged, you cannot flipper it, because the deadbolt will not budge when manipulated by a card or piece of plastic. Technically a lock without an engaged deadbolt is not really "locked" but "closed". That being said, an unbelievable amount of people believe their doors are locked when in fact they are closed.
- bluGill 3y agoMost locked doors can be bypassed even faster in some other way than unlocking them. A rock through the window...
- cesarb 3y ago> Most locked doors can be bypassed even faster in some other way than unlocking them. A rock through the window... This is a bit harder when said window is only reachable from the outside, and is 78m above ground level (and all the walls are brick, so they're stronger than the wooden door).
- kawsper 3y agoThe building where I rent have doorlocks from Scantron ( https://scantron.dk/ https://scantron.dk/ ) they use RFID keys to open locks, and last year someone discovered a way of creating masterkeys from any key because of the weak encryption used by MiFare Classic. It took a journalist and a lot of e-mails and calls for my landlord to understand the problem, I suspect that Scantron were also downplaying the issue towards them. They finally budged and upgraded all the locks to use a better encryption scheme and re-issue keys. My building have 197 apartments, each of them have at least 2 keys, I have to trust all of the tenants (and their friends), in order for my apartment not to get burgled, and if I were burgled my insurance wouldn't cover because there's likely no proof of entry.
- mdekkers 3y agoI have rented my entire life, and “change all the locks” has always been the very first thing I do. I have a couple of different size high security cylinder locks, and whilst no cylinder lock is unpickable, I’m pretty happy with mine.
- NeoTar 3y agoInteresting, because many renters (myself included) would not be permitted to change the locks.
- lxgr 3y agoThis is quite different around the world. I've rented both at places where I could bring my own security locks and others where the landlord pretty much insisted in having a copy of all keys so they could enter in an emergency (e.g. a water leak) without breaking down the front door.
- Turing_Machine 3y agoMaybe operating on the "easier to ask forgiveness than permission" principle? I think landlords have to give you notice before entering your unit in most areas. Swapping locks is maybe a ten minute job (probably less if you've done it a lot). There's nothing to stop a tenant from swapping out the locks, then swapping the landlord's locks back in before a scheduled visit.
- samcheng 3y agoSeems like it's only a matter of time before someone writes a Flipper Zero script to do this.
- datameta 3y agoThe more pertinent matter is that it took this long for RFID exploits to start catching the public eye. RFID is the least secure communication protocol that could be used for locks. At the very least we should have NFC be the standard. Someone with the intent and know-how to crack RFID readers could put together a hardware tool to do so. Does the Flipper Zero provide such a tool? Yeah. Does the responsibility of following ethics fall with the user? Debatable, but I think absolutely yes. If one carries around a lockpicking set and learns how to use it, they can go right ahead, correct? We accept the fact that people exist that can pick locks and yet 80% of states allow possession and use of lockpicking tools in a legal manner.
- wongarsu 3y agoIt's not just that RFID isn't very secure, it's that a lot of locks are using the worst possible implementations. Just checking the ID of the RFID chip against a whitelist is an astonishingly common method. Not only makes that access cards easy to clone and provides no cryptographic security at all, if you bulk buy access cards you often get sequentially numbered cards ...
- jdalgetty 3y agoAnother strike against the Flipper Zero!
- brevitea 3y ago> "their attack could be pulled off with little more than a $300 Proxmark RFID read-write device and a couple of blank RFID cards, an Android phone, or a Flipper Zero radio hacking tool." And Android, and EBay, and Proxmark...
- dmpanch 3y agoI work for a company that manufactures access control and communication systems. The readers we develop support a variety of ID standards, from unencrypted EM-Marin and a long time ago cracked Mifare Classic to modern Desfire EVx standards. According to our statistics, more than 95% of customers still continue to use the most insecure identifiers because of their low cost and ease of operation. Many of the installed devices are not properly maintained, even if the manufacturers continue to support them, because you have to pay for maintenance. In addition, not all equipment can be updated remotely over the network or even have a network connection to do so remotely. Even if your cards are encrypted, it still can't guarantee you protection, because in most cases card readers are connected to controllers (not in the case of all-in-one devices like this lock) via Wiegand protocol, which doesn't provide any data encryption, so the identifier ID is transmitted over two wires in the clear form.
- lol768 3y agoAt some point, isn't there some responsibility that rests with manufacturers for choosing to continue to support known-insecure standards? How many browsers do you think support the TLS_NULL_WITH_NULL_NULL cipher?
- Nextgrid 3y agoIt's often a compatibility thing too. Insecure standards can often coexist because they're the lowest common denominator. It's just a "password" stored and transmitted as plaintext. A secure system would involve a PKI which increases complexity and management overhead significantly (you won't be able to just copy "passwords" from one system to another, etc).
- sonicanatidae 3y agoCompat is a factor and valid in some instances. It's not valid at all in this case. The old systems are wholly insecure, and should not be offered at all. This is just some faceless corp being cheap and ignoring the consequences, not their problem.
- 3y ago
- dpsych 3y agohttps://archive.is/gifH6 https://archive.is/gifH6
- asynchronous 3y agoGoing to go against the grain and say thank you to devices like the Flipper Zero for getting vulnerabilities like this out into the public eye for scrutiny.
- saagarjha 3y agoNot really against the grain here :)
- CyberDildonics 3y agoBy exploiting weaknesses in both Dormakaba's encryption and the underlying RFID system Dormakaba uses, known as MIFARE Classic, Carroll and Wouters have demonstrated just how easily they can open a Saflok keycard lock.
- oneplane 3y agoRFID and NFC are the new Magstripe and Barcodes. People think that they are mysterious things that are secure because they aren't able to see what they mean. But in reality, they are all still just a machine-readable number. (even if a rolling key, challenge-response or pubkey authentication is supported, we're often still just using a single number, but my point is more about the perceived obscurity for the public)
- lxgr 3y agoIt really depends. There are some contactless tags that really do nothing other than transmit a static identification number which is trivially spoofable, but many systems today use cryptography (again, some long cracked and horribly outdated, but others quite strong). I have a contactless card that runs GPG as a Java Card applet and creates 4096-bit RSA signatures. That's pretty secure!
- hnav 3y agoDESFire based systems, HID iClass SE (properly installed where the reader only accepts the SE credential) are generally pretty secure.
- neilv 3y ago> [...] shared the full technical details of their hacking technique with Dormakaba in November 2022. [...] told by Dormakaba that, as of this month, only 36 percent of installed Safloks have been updated. Did Dormakaba not make this a first-priority, all-out effort? Or have 2/3 of the installations been offered a timely free fix, but are dragging their feet for some reason? > “Our customers and partners all take security very seriously, and we are confident all reasonable steps will be taken to address this matter in a responsible way.” That "reasonable" in a PR response is suspicious. Wikipedia: > dormakaba Holding AG is a global security group based in Rümlang, Switzerland. It employs more than 15,000 people in over 50 countries. Sounds like they probably have the resources, if they have the will to solve this before potential very bad things happen to some hotel customers. > publicly traded on the SIX Swiss Exchange. https://www.google.com/finance/quote/DOKA:SWX?comparison=INDEXSP%3A.INX&window=5Y https://www.google.com/finance/quote/DOKA:SWX?comparison=IND... https://www.google.com/finance/quote/DOKA:SWX?comparison=INDEXSP%3A.INX&window=1Y https://www.google.com/finance/quote/DOKA:SWX?comparison=IND...
- lazide 3y agoHotel and hotel safe locks have always been of dubious security.
- deleted 3y ago[deleted]
- deleted 3y ago[deleted]
- JudasGoat 3y agohttps://archive.ph/PypxP https://archive.ph/PypxP
- LeoPanthera 3y agoApparently I don't understand how hotel card keys work. I always assumed that keys were manufactured with a random UUID inside them, and then when you checked in, a random card was attached to your room and given to you. When you try to open a door, it compares your card's ID to the room database to see if the door should open. Is that... not how it works? Because that seems simpler than anything that involves encryption, or actually writing shit to the card.
- Kinrany 3y agoI wonder if it's possible to answer pubkey challenges without electricity
- crotchfire 3y agoHigh-end JavaCards can do this. A few have RFID/NFC interfaces, but they are expensive. https://www.cardlogix.com/product-tag/ecdsa/ https://www.cardlogix.com/product-tag/ecdsa/
- jcrawfordor 3y agoThe locks don't have network connectivity, so they have no way to check. Access has to be managed by key expiry and replacement. There are network-connected systems but they can be considerably more expensive to install.
- palata 3y agoIt would mean that the door's reader is connected to the network. Is it?
- WrongAssumption 3y agoHaving doors not work because the network is unavailable or the database is corrupted sounds neither simpler nor better.
- LeoPanthera 3y agoWell, valid key IDs could be pushed to the locks, and remembered for a short time.
- seplox 3y ago> Dormakaba started selling Saflok locks in 1988, which means that vulnerable locks have been in use for over 36 years. Ok, my eyebrows are up. Authentication has grown so much as a field since then that I'm having trouble with the idea that this flaw has always been present. In fact, Saflok predates MIFARE Classic by at least five years. Perhaps all will become clear if a full technical disclosure is ever made available, but it seems like the authors are making an overstatement here. https://unsaflok.com/ https://unsaflok.com/
- iancarroll 3y agoOur understanding is that the magnetic stripe version of Saflok (which indeed predates MIFARE Classic) is vulnerable to the same issues, just in a different card format.
- r3trohack3r 3y agoI travel with a door jammer. Most hotel door locks I’ve seen are designed to be opened from the outside. A door jammer wedges the door shut. With it, I sleep better at night.
- namaria 3y agoWhile my instinct is to do the same, depending on what jurisdiction you travel to, you might be liable for damages if staff tries to open the door and decide to break in because you were in the shower or sleeping on ambien or something like that.
- aniavictor777 3y ago[dead]
- space_oddity 3y agoI always stay cautious and take additional measures to secure belongings while staying at a hotel
- davidmurphy 3y agoPhysical security is what you need. Buy this strap for your door lock while you're inside. https://www.youtube.com/watch?v=EoWGgH1YBC0 https://www.youtube.com/watch?v=EoWGgH1YBC0 https://www.redteamtools.com/super_grip_deadbolt_strap https://www.redteamtools.com/super_grip_deadbolt_strap
- a5y 3y agoSomewhat related questions: How can I use an Android phone as a room keycard? Is there an app for reading a card and acting as a tag? How can I use an iPhone as a room keycard? Why can't I easily add it to Wallet? Is there another app for that?