5 ms·

I worked on this research along with many others, happy to answer any questions! Our disclosure is also available at https://unsaflok.com https://unsaflok.com.

ildjarn 3y ago
Did you set out to find a vulnerability or just stumble on it? If setting out to find a vulnerability, how do you get started? What is the “open ide, write print(“hello world”)” for this kind of work?
- xeornet 3y ago
  The article explains that they were at a hackathon of sorts, where these 2 were specifically targeting the locks/passes. I would assume reading the cards with a reader would be a great start.
aftbit 3y ago
When do you plan to release technical details on the attack? Surely the long tail of door locks will not be replaced for a decade or more.
rwmj 3y ago
How did Saflok respond? Were they collaborative or did they try to threaten you / suppress the information?
- iancarroll 3y ago
  They have been taking it seriously although they didn’t have any sort of formal bug bounty / security disclosure method at the time. The disclosure timeline is in our article as well!
kidbomb 3y ago
This part caught my eye: "Note that this information only applies to dormakaba Saflok systems; several other lock manufacturers use MIFARE Classic keycards and are not affected by the Unsaflok vulnerability" So it is likely they way that Saflok implemented MIFARE Classic. Will start to read about this protocol more.
- lxgr 3y ago
  At this point, MIFARE Classic can pretty much be considered plaintext. There are very fast card-only cloning attacks against even the newest "hardened" cards, and in many of these lock systems (no idea about Saflok in particular though), MIFARE is the only layer of cryptography, and the card only contains a bitmask of locks/doors that it should be able to open.
  - rwmj 3y ago
    I have an original London Underground Oyster Card which still works fine! It's MIFARE Classic according to Wikipedia, and do often wonder when TfL will cancel them.
    - lxgr 3y ago
      They'll probably keep it around either indefinitely, or will replace it with a fully account-based scheme where there's nothing stored on the card itself (i.e. no stored-value balance) other than an authentication key for the card number. That's the model they already use for bank (credit and debit) cards too, so they need the backend to manage a deferred account-based system anyway. That's also what the MTA in New York does: They've never supported stored-value cards, and their new physical OMNY cards are effectively just a weird type of closed-loop EMV payment card.
  - zettabomb 3y ago
    >There are very fast card-only cloning attacks against even the newest "hardened" cards Do you mean for MIFARE Classic or for all RFID cards? I was not aware of any cloning attacks for types such as HID Seos.
sschueller 3y ago
If I stay at a hotel with such a lock how can I tell it's affected? If the hotel hasn't patched it can I patch my rooms door myself without causing issues to the hotel?
- gabrielsroka 3y ago
  I think it's in the bottom of the article
- michaelt 3y ago
  You can generally assume at any hotel with keycards, that any other guest who wants to can get into your room. The only question is whether they do some hacker shit, or whether they just go to reception and say "My keycard isn't working, I'm in room 123" and reception gives them a new keycard for room 123, with no ID check and no questions asked. Luckily thieves are relatively rare and 97% of hotel rooms just contain a suitcase of second-hand clothes.
  - jules-jules 3y ago
    I locked myself out of the room on several occastions, and at the very least they ask for your name and double check in the system. It's not as easy as you describe.
    - c0pium 3y ago
      I was traveling a lot for work at one point, and I decided to test this out. I would ask for a new key at every hotel I stayed at, and make a point to not tell them my name unless they asked. They almost never did.
    - Retr0id 3y ago
      A little social engineering would sort that out
    - michaelt 3y ago
      Perhaps you're staying at better hotels than I am? In my experience, keycards fail so often that the hotel workers don't bat an eyelid when you say your card has failed, they just make you a new one.
newhotelowner 3y ago
As an owner, these companies are scumbags. You have to deal with salesmen whose only job is to sell these at maximum price. Thanks for doing this. Hopefully, you guys expose all other lock companies.

ildjarn 3y ago

Did you set out to find a vulnerability or just stumble on it? If setting out to find a vulnerability, how do you get started? What is the “open ide, write print(“hello world”)” for this kind of work?

xeornet 3y ago
The article explains that they were at a hackathon of sorts, where these 2 were specifically targeting the locks/passes. I would assume reading the cards with a reader would be a great start.

aftbit 3y ago

When do you plan to release technical details on the attack? Surely the long tail of door locks will not be replaced for a decade or more.

rwmj 3y ago

How did Saflok respond? Were they collaborative or did they try to threaten you / suppress the information?

iancarroll 3y ago
They have been taking it seriously although they didn’t have any sort of formal bug bounty / security disclosure method at the time. The disclosure timeline is in our article as well!

kidbomb 3y ago

This part caught my eye: "Note that this information only applies to dormakaba Saflok systems; several other lock manufacturers use MIFARE Classic keycards and are not affected by the Unsaflok vulnerability" So it is likely they way that Saflok implemented MIFARE Classic. Will start to read about this protocol more.

lxgr 3y ago
At this point, MIFARE Classic can pretty much be considered plaintext. There are very fast card-only cloning attacks against even the newest "hardened" cards, and in many of these lock systems (no idea about Saflok in particular though), MIFARE is the only layer of cryptography, and the card only contains a bitmask of locks/doors that it should be able to open.
- rwmj 3y ago
  I have an original London Underground Oyster Card which still works fine! It's MIFARE Classic according to Wikipedia, and do often wonder when TfL will cancel them.
  - lxgr 3y ago
    They'll probably keep it around either indefinitely, or will replace it with a fully account-based scheme where there's nothing stored on the card itself (i.e. no stored-value balance) other than an authentication key for the card number. That's the model they already use for bank (credit and debit) cards too, so they need the backend to manage a deferred account-based system anyway. That's also what the MTA in New York does: They've never supported stored-value cards, and their new physical OMNY cards are effectively just a weird type of closed-loop EMV payment card.
- zettabomb 3y ago
  >There are very fast card-only cloning attacks against even the newest "hardened" cards Do you mean for MIFARE Classic or for all RFID cards? I was not aware of any cloning attacks for types such as HID Seos.

sschueller 3y ago

If I stay at a hotel with such a lock how can I tell it's affected? If the hotel hasn't patched it can I patch my rooms door myself without causing issues to the hotel?

gabrielsroka 3y ago
I think it's in the bottom of the article
michaelt 3y ago
You can generally assume at any hotel with keycards, that any other guest who wants to can get into your room. The only question is whether they do some hacker shit, or whether they just go to reception and say "My keycard isn't working, I'm in room 123" and reception gives them a new keycard for room 123, with no ID check and no questions asked. Luckily thieves are relatively rare and 97% of hotel rooms just contain a suitcase of second-hand clothes.
- jules-jules 3y ago
  I locked myself out of the room on several occastions, and at the very least they ask for your name and double check in the system. It's not as easy as you describe.
  - c0pium 3y ago
    I was traveling a lot for work at one point, and I decided to test this out. I would ask for a new key at every hotel I stayed at, and make a point to not tell them my name unless they asked. They almost never did.
  - Retr0id 3y ago
    A little social engineering would sort that out
  - michaelt 3y ago
    Perhaps you're staying at better hotels than I am? In my experience, keycards fail so often that the hotel workers don't bat an eyelid when you say your card has failed, they just make you a new one.

newhotelowner 3y ago

As an owner, these companies are scumbags. You have to deal with salesmen whose only job is to sell these at maximum price. Thanks for doing this. Hopefully, you guys expose all other lock companies.