5 ms·

If I stay at a hotel with such a lock how can I tell it's affected? If the hotel hasn't patched it can I patch my rooms door myself without causing issues to th

If I stay at a hotel with such a lock how can I tell it's affected? If the hotel hasn't patched it can I patch my rooms door myself without causing issues to the hotel?

gabrielsroka 3y ago
I think it's in the bottom of the article
michaelt 3y ago
You can generally assume at any hotel with keycards, that any other guest who wants to can get into your room. The only question is whether they do some hacker shit, or whether they just go to reception and say "My keycard isn't working, I'm in room 123" and reception gives them a new keycard for room 123, with no ID check and no questions asked. Luckily thieves are relatively rare and 97% of hotel rooms just contain a suitcase of second-hand clothes.
- jules-jules 3y ago
  I locked myself out of the room on several occastions, and at the very least they ask for your name and double check in the system. It's not as easy as you describe.
  - c0pium 3y ago
    I was traveling a lot for work at one point, and I decided to test this out. I would ask for a new key at every hotel I stayed at, and make a point to not tell them my name unless they asked. They almost never did.
  - Retr0id 3y ago
    A little social engineering would sort that out
  - michaelt 3y ago
    Perhaps you're staying at better hotels than I am? In my experience, keycards fail so often that the hotel workers don't bat an eyelid when you say your card has failed, they just make you a new one.
  - blendergeek 3y ago
    I have often either locked myself out of a hotel room or demagnetized my key. I have never been asked my name or been verified in any way (different clerk than the one I checked in with, etc). While I'm sure some hotels (maybe more upscale ones?) do verification, it is far from universal in the USA.
  - kadoban 3y ago
    Names are not generally considered secret. It will be relatively easy for someone to social engineer the name for a room either with the desk or with you (calling the room).
- paulddraper 3y ago
  Similar to the wrench principle. [1] [1] https://xkcd.com/538/ https://xkcd.com/538/
iancarroll 3y ago
Our disclosure mentions how to try and detect a vulnerable hotel, but it’s not possible to patch the lock yourself.

If I stay at a hotel with such a lock how can I tell it's affected? If the hotel hasn't patched it can I patch my rooms door myself without causing issues to the hotel?

gabrielsroka 3y ago

I think it's in the bottom of the article

michaelt 3y ago

You can generally assume at any hotel with keycards, that any other guest who wants to can get into your room. The only question is whether they do some hacker shit, or whether they just go to reception and say "My keycard isn't working, I'm in room 123" and reception gives them a new keycard for room 123, with no ID check and no questions asked. Luckily thieves are relatively rare and 97% of hotel rooms just contain a suitcase of second-hand clothes.

jules-jules 3y ago
I locked myself out of the room on several occastions, and at the very least they ask for your name and double check in the system. It's not as easy as you describe.
- c0pium 3y ago
  I was traveling a lot for work at one point, and I decided to test this out. I would ask for a new key at every hotel I stayed at, and make a point to not tell them my name unless they asked. They almost never did.
- Retr0id 3y ago
  A little social engineering would sort that out
- michaelt 3y ago
  Perhaps you're staying at better hotels than I am? In my experience, keycards fail so often that the hotel workers don't bat an eyelid when you say your card has failed, they just make you a new one.
- blendergeek 3y ago
  I have often either locked myself out of a hotel room or demagnetized my key. I have never been asked my name or been verified in any way (different clerk than the one I checked in with, etc). While I'm sure some hotels (maybe more upscale ones?) do verification, it is far from universal in the USA.
- kadoban 3y ago
  Names are not generally considered secret. It will be relatively easy for someone to social engineer the name for a room either with the desk or with you (calling the room).
paulddraper 3y ago
Similar to the wrench principle. [1] [1] https://xkcd.com/538/ https://xkcd.com/538/

iancarroll 3y ago

Our disclosure mentions how to try and detect a vulnerable hotel, but it’s not possible to patch the lock yourself.