9 ms·

HN's Daeken will expose security flaw in 4m hotel room keycard locks

253 points by ssclafani 14y ago

wheelerwj 14y ago
so reverse engineering seems cool. What skills do you find most useful/versatile/neat/groovy or otherwise necessary for your reverse engineering projects?
- daeken 14y ago
  I can't really narrow it down to a single specific skill. When I'm reversing, my steps are generally: figure out how I would design the system, come up with a set of assumptions based on that, check the assumptions as quickly as possible, then refactor your model of the system based on what you find. It's really all about making educated guesses and then checking those; as you gain experience, you start making better guesses.
  - wheelerwj 14y ago
    okay very cool. the scientific method, rinse, repeat. how long have you been reversing?
    - daeken 14y ago
      About a decade now, probably. Started with MMOs, specifically Everquest, then moved on to DRM (which, oddly enough, is what I was in Forbes for last time), then on to locks and other hardware.
deleted 14y ago
[deleted]
- deleted 14y ago
  [deleted]
daeken 14y ago
I'm planning on doing a Reddit AMA for reversing in general -- as well as this work -- in the next hour or two, but if anyone has any questions I'll do my best to answer here. All I ask is no protocol details (paper and full code will be out tomorrow immediately following my talk) and no legal questions. Go wild. Edit: Since this thread has blown up a bit, we may as well just do it here for real. If you have any reversing questions or background questions or whatnot, feel free.
- shimon_e 14y ago
  Do you kindly mind only leaking the information on Friday? Thanks from all us who spend our weekdays living in hotels.
  - daeken 14y ago
    Regardless of which hotel you're in and what locks they use, always use the physical security mechanisms provides, e.g. door chains. Deadbolts are engaged by the lock mechanism and will be retracted by, say, maintenance key cards. While this definitely opens up new bad things, the message is the same: don't trust the software, trust the physical. Then again, after doing this for a few years, I may be a bit on the paranoid side.
    - shimon_e 14y ago
      Little hard to lock the door with door chains while you're not in the room. Hotel occupancy is a lot lower on the weekend. I'm sure many people living in hotel rooms with more belonging than can fit in the safe will appreciated this information being released on a weekend.
      - DanBC 14y ago
        Hotel safes in rooms are notoriously insecure.
        gameshot911 14y ago
jgrahamc 14y ago
It won't be a surprise to learn that these types of locks are vulnerable, but I'll be fascinated to learn the details especially since it sounds like you can get access to an internal bus easily. The assassination of Mahmoud Al-Mabhouh (http://en.wikipedia.org/wiki/Assassination_of_Mahmoud_al-Mabhouh http://en.wikipedia.org/wiki/Assassination_of_Mahmoud_al-Mab...) allegedly by Mossad involved attacking an electronic hotel lock to get access to his room: "A readout of activity that took place on the hotel room's electronic door lock indicated that an attempt was made to reprogram al-Mabhouh’s electronic door lock at this time. The investigators believe that the electronic lock on al-Mabhouh’s door may have been reprogrammed and that the killers gained entry to his room this way. The locks in question, VingCard Locklink brand (Dubai police video, 21:42), can be accessed and reprogrammed directly at the hotel room door."
- daeken 14y ago
  Yep, bus is clearly accessible on the bottom of the lock. As for Ving, I think they're going to be next up; spent years honing my skills in reversing this sort of thing, seems like a shame to stop now.
  - shurane 14y ago
    How did you hone your skills for years? Have you been working with other lock providers? Or other methods, or just the process of reverse-engineering the software that hardware interacts with? You are cool, you know that?
    - daeken 14y ago
      I haven't been working on other lock hardware, but reversing the whole Onity system from the ground up has been quite an undertaking. I described a rough version of the whole process in another comment. I've also worked on a couple other devices, e.g. the Emotiv EPOC EEG. And thanks, I like to think so.
screwt 14y ago
Could you explain a little more why you didn't go for responsible disclosure to Onity? In the article you suggest that you don't think they could fix it. Maybe true but shouldn't you (a) give them the oppurtunity to try (just cos you can't spot the fix doesn't mean it's impossible), and (b) give them the chance to say "yep, it's broken - give us 3 months to ship out new locks to all our customers" (yes, highly unlikely I know!). Given that you sat on this for a year before publishing, there was ample oppurtunity to inform Onity before you publish.
- daeken 14y ago
  Given the simplicity of the vulnerabilities (as mentioned in the article, you have full and unauthenticated memory access) and the length of time -- over a decade -- that these locks have been on the market, there is absolutely no doubt that they knew about this. Given that, I felt that they would delay, delay, delay, and delay some more before finally going silent, at which point I would be forced to do this anyway. Simply put, I have zero confidence in their ability to mitigate this properly, and I believe that the only proper course of action is to make this public and let the hotels make themselves secure by whatever means possible. I know that's a bit of a strange answer, but this is a strange situation; it's taken me a while to figure out the correct course of action, and I feel that this really is the best way for the safety of the public. Edit: Toned down some of the wording; unnecessary.
  - akamaka 14y ago
    That's a completly bogus excuse. The question wasn't why you're releasing it publicly, but why you haven't made any attempt to contact the company beforehand, which you seem to have had a year to do. Edit: The only reasons I can think of are laziness or just plain not giving a shit about responsible disclosure.
    - Kadin 14y ago
      In order so that they could do ... what, exactly? It doesn't sound like there's any mitigation that they could perform. At the very least, the guts of every lock has to be replaced. Given that, the rational, profit-maximizing thing for them to do is to stonewall, misdirect, bring out the lawyers, shoot the messenger, and generally continue to sell as many flawed locks as possible. We've all seen vendors do that in the past when faced with intractable, deep-seated defects in a product, so it wouldn't be unexpected or unreasonable to assume. All the notification would be is a courtesy, allowing them time to start designing and marketing a new product, instead of having the market get handed to their competitors when hotels suddenly have to start replacing their locks with less-flawed ones. And I'm not sure a company that produced a flawed products deserves that.
webjprgm 14y ago
Is the obvious fix to make the programming port available only from the inside of the room? That's where the screws for physical bolt locks go. And you can still have a DC power port on the outside in case of a powered-down door, just no programming access. Why have they not done it that way???
- endianswap 14y ago
  Probably because if the system glitches out and they can't into the room anymore (even with maintenance keys) then they wouldn't ever be able to fix it?
  - daeken 14y ago
    Well, you can always drill the lock cylinder out, but that's a destructive process. It is possible to do this sort of thing in the right way, they just didn't.
    - rcfox 14y ago
      What happens to the lock when the battery dies/the power goes out?
      - daeken 14y ago
        Once the batteries go out (they're not powered on guest room doors), the lock won't open to keycards anymore. The batteries, though, are on the front of the door just below the handle (see the panel at the bottom, in the story photo) and can be replaced from the outside. Otherwise, it's possible to use the portable programmer's open function to open the lock, if the batteries in the PP are full enough; that's really iffy and has a tendency to not work, though.
ulope 14y ago
Interesting, but it's not as if hotels in general have been high security installations. Very easy experiment: Just go to the front desk an thell them that you sadly seem to have lost your room card. 90% of the time they will just ask for your room number without requiring any kind of proof that it's actually your room.
- otoburb 14y ago
  90%? Anecdotally, I was asked for ID each time my wife or I lost hotel room cards on 4 occasions (3 for me, once for my wife). I believe they were 2 Courtyard Marriotts, 1 Residence Inn (Marriott), and a Sheraton (don't remember the hotel class). EDIT: Grammar
- petitmiam 14y ago
  Or there's those hotels where you have to leave the keys at the front desk. Each time you come back you say your room number and they give you the key.
  - tripzilch 14y ago
    Yeah, that was our hostel in NYC. I asked about that, and they kind of looked at me funny, as if I was paranoid or something. If figured the best way would be to semi-jokingly show her my ID regardless and be friendly and chatty in the hopes she'd remember my face with the room number. In hindsight I might have tried asking for a different room number's key to see if she was paying attention and then quickly correct myself "No, just kidding, my room's 208 not 210. I just wanted to see if you'd give people any room key they ask for". Maybe that would've made them see the issue. Instead, I took the easy route and made sure to never leave my netbook, passport, tickets, etc in the room (all the rest was replaceable and we were travelling light). I would have probably done differently if I wasn't in a foreign country on a different continent and still getting used to the cultural uncanny valley of NYC being "almost, but not quite like Europe", so I opted for the safe choice of not being a bother to these obviously hard-working people.
javajosh 14y ago
I was always curious about elock systems, particularly about how they are reprogrammed. Presumably they are reprogrammed by the front desk, centrally, but how does the signal reach the lock? Presumably there must be wires attached (at least for power). So why is there an external port on the lock at all? Also, what is the possibility that a lock exploit could affect the central reprogramming system? Edit: just read below that these things are battery powered, which raises two questions, first, ok, how are they reprogrammed, and second, how does a hotel not go bankrupt replacing thousands of batteries all the time?
- daeken 14y ago
  The locks are programmed by the front desk, but then the data is transferred to the Portable Programmer which then is used to update the doors. The doors themselves are not connected to power, but are rather completely battery-driven. The likelihood of anything impacting the front desk equipment is effectively nil. (Note: This is all specific to Onity locks)
  - javajosh 14y ago
    I'm surprised that's how they are designed. How often do the batteries need replacement? (I realize that this isn't exactly related to your hack, but I'm finding myself fascinated by the economics of maintaining lots of locks. It reminds me of the problem of early computers having to replace vacuum tubes at a certain rate, limiting the size of the machine). Also, is it the housekeeping staff that reprograms the lock after they clean the room? It seems like it would be very inefficient to send a special person around to reprogram the lock after every check out.
    - daeken 14y ago
      The battery lifetime depends on how much traffic the door gets, but generally I believe it's 4-6 months, which is pretty impressive for 4 AAs. As for reprogramming the doors, that only happens very rarely. The cards have an expiration date and a code that cycles, meaning that when a new card is introduced, the old ones won't work anymore. So really it only needs to be reprogrammed when the clock gets out of sync or the batteries die (there's no non-volatile storage, just RAM).
jcfrei 14y ago
let's do this AMA thing right here, because my questions might get lost in the reddit noise. You seem like the prototype hacker to me - what's your personal stack? like OS, text editor, the computer you use daily? thanks for answering those 3 little questions.
- daeken 14y ago
  Haha, it seems we already are doing the AMA here. My stack now is a Lenovo W520 running Ubuntu and KDE, and Sublime Text as my editor. Over the years when I did this, I was running everything from a cheapo, hacked-together box to a 13" Macbook Pro, all running Windows Vista/7.
  - otoburb 14y ago
    Do you use Backtrack at all, or do you simply craft/download/build-from-source your own tools as you need them? Also, did you switch from Windows to Linux because of the available tools and development environment, or because the Linux desktop had matured enough you could get sh*t done without worrying about driver compatibility issues or other common complaints about Linux [lap|desk]tops?
    - daeken 14y ago
      I don't use Backtrack or similar tools; the only tools I use that I didn't write myself are IDA Pro and Burp Proxy (if I'm doing websec work). As for switching OSes, the primary reason I did so is that my work for my day job all requires Linux. In terms of reversing, Windows is really the only way to fly; the tools just aren't there otherwise.
      - tripzilch 14y ago
        > In terms of reversing, Windows is really the only way to fly; the tools just aren't there otherwise. Curious, why is that, and what tools are those then?
kristopolous 14y ago
duh? I'm sorry but low security systems like hotel rooms of course have wide vulnerabilities. The front desk will just give out keys based on trust since you don't have to register everyone staying in the room; they don't even have an audit trail if they wanted to use it. Keyless entry cars are mostly crackable ... garage door systems are trivial, you can bump pin tumbler locks, many home security systems have no backup power. rfid skimmers are cheap and easy-to-use. almost every elock I've seen has the bus readily exposed on the outside (secured by a single screw at best). There's at most 6 things I can think of that actually do not have trivial security issues. If I knew I would become famous by informing the press that, for instance, a car model only has a handful of key patterns for millions of cars, I would have done it a long time ago, but I thought such things were just stupefyingly obvious.
- twodayslate 14y ago
  I completely agree with you but I think you should read the following: http://sivers.org/obvious/ http://sivers.org/obvious/
- lgeek 14y ago
  > a car model only has a handful of key patterns for millions of cars This reminds me of growing up in Eastern Europe. Story time: Under the Romanian communist regime, there was only one car factory (Dacia[1]) making cars for personal use. Their main model was essentially the same from the '70s until 2004. For the first 10 years or so after the '89 revolution, Dacia dominated the local car market (because their cars were cheap and really easy to fix). Now that we have the oh-so-important context, your comment reminded me that when I was a kid, my parents bought a Dacia. What confused me at a time was that random people would periodically ask to borrow the key. It turns out that for 30-something years, Dacia only used a few models of keys. In fact there were so few that if you locked your keys inside (doors were unlocked by key and they locked automatically) it was feasible to try keys from random cars until one worked. To be fair, the engine key was different from the door key, and it didn't have this problem. But, getting back to your comment, if you're talking about a recent card model then that's just crazy. Also, I would have thought that keyless entry systems use correctly implemented public key cryptography. Is that not the case? [1]: http://en.wikipedia.org/wiki/Automobile_Dacia http://en.wikipedia.org/wiki/Automobile_Dacia [2]: http://en.wikipedia.org/wiki/Romanian_Revolution_of_1989 http://en.wikipedia.org/wiki/Romanian_Revolution_of_1989
st3fan 14y ago
I think that making this public is not a very good example of responsible disclosure and I hope there will be a lawsuit before the presentation to prevent the details from being exposed. I am all about exposing vulnerabilities but I honestly think there needs to be a dialog with the vendor first. Specially for exploits like this where there is a lot at stake. I find the excuse of 'there is nothing they can do anyway' very poor. I have no doubt that this technique is known to locksmiths and law enforcement and maybe a smaller group of criminals. But making this public and exposing it to the world will allow any criminal with a soldering iron and an Arduino to start exploiting this. Daeken, you have done an awesome job making this known. Maybe that it enough to get the ball rolling. Or do you just want to do damage for fame and profit?
- m0nastic 14y ago
  This argument has been going around for as long as I can remember, and I think it's incredibly harmful to researchers (whether they be security or other). Upon discovering the vulnerability, the only real action he could take which would be universally considered unacceptable would be to use that research to go around breaking into hotel rooms (which is illegal). If he decided to go into business selling devices to bypass hotel room locks, there would also probably be a majority opinion that that isn't really "above-board". Even that isn't necessarily universally agreed on though (as there are a lot of people who argue that providing access to tools isn't criminal) But he didn't do that either. He decided that this was a pretty severe vulnerability (made worse by the fact that remediating it isn't trivial), and that he wanted people to know about it. Hoping that the vendor will sue him to prevent that information from being disseminated is about the worst possible outcome from research of any kind; ignoring the fact that you don't seem to posit any rationale for what exactly they'd be suing about (protected trade secrets? violation of a license agreement?) The thing about "responsible disclosure" is that it isn't something that exists by fiat. It's an intentional reframing of disclosure policies by vendors to attempt to steer the research community towards doing what's in the vendors best interests. I understand their desire to reframe that policy, but that doesn't make it "the only ethically responsible way to conduct vulnerability disclosures". Recently, there's been a lot of news about BMW's being able to be stolen trivially through access to the OBD port on certain models. There's an OSVDB entry for it and everything‡. That's another example where providing information to the public was considered to be very important (like the issue Cody discovered, it's also not something that can be easily fixed. It's also been ignored by the vendor). In virtually all other regards, making research public is considered the responsible thing to do. While I'm not a card-carrying member of the full-disclosure sentiment, I strongly disagree that releasing research publicly is boolean irresponsible. ‡ http://osvdb.org/83707 http://osvdb.org/83707
kylebrown 14y ago
What tools do you use for reversing hardware? Did you have to open up the lock and tap into it with something like a logic analyzer? Or was it as simple as creating a DC port adapter so you could read the data from the portable programmer?
- daeken 14y ago
  So, reversing it was sort of all over the place. I first had to reverse the front desk system and all that; that was primarily done by sitting between the equipment with a serial proxy and working from there. Once I had a good bit of data captured, I'd write software to emulate being one side or the other. Everything is RS232 and RS485, pretty straightforward. In terms of reversing the actual lock protocol, that was a bit more tricky. First step was tapping the line between the portable programmer and lock with an o-scope (a 70s-era HP scope; only thing I could afford at the time, haha) to figure out the voltage levels involved and the basic properties of the communication. From there, I hit it with the Saleae Logic to see what the communication actually looked like. From there, I wrote some Python scripts to walk over the data from the logic analyzer and attempt to decode the data. With some tweaking, I managed to finally see some data that I knew, specifically the site code (which I knew from other parts of the system). After I knew all that, it was a matter of figuring out the actual hardware level. Given that I have effectively no experience with this level of things, this was a lot of asking questions, googling, and experimenting. I knew that it was a one-wire protocol, so by reading up on other one-wire protocols I managed to figure out a lot. Once that was done, everything just fell into place; making the opening device work initially took maybe a day given all the info I had.
stcredzero 14y ago
> HN's Daeken will expose You have my attention... > security flaw in 4m sounding really interesting... > hotel room keycard locks. Oh. Well, still pretty cool. EDIT: Actually, this kid of thing needs to get a lot more attention and awareness. I could suggest a certification of some kind, but there's often a reaction against that. But a certification that just indicated: - No passwords in plaintext - Not vulnerable to replay attacks - No "toy" encryption Would be of great benefit in today's world.
thornofmight 14y ago
How did you practice this and discover it? I can't imagine just wondering around hotel rooms playing around with the doors...
- daeken 14y ago
  I was working on a replacement of the Onity front-desk system at the time, and I suspected it existed for a while. In another comment I detail how I reversed everything, but everything was done on my own hardware, not just random hotels.
bugmenot 14y ago
How about a little super glue in/on the DC power port?
mark_g 14y ago
The poor hacker's alternative: http://www.youtube.com/watch?v=WAkJRpKeyYg&has_verified=1 http://www.youtube.com/watch?v=WAkJRpKeyYg&has_verified=...
rdl 14y ago
Any idea what locks Caesars and the Rio use?
tmpaccount 14y ago
I'm not certain, but in the picture from the Forbes article the lock looks exactly like the kind used on many doors in my university - the shape is exactly the same, and ours had the same type of electrical connector in the same place at the bottom of the lock. I remember because I considered attacking this interface before noticing the torx security screw next to the connector; removing this screw allows the panel covering the bottom part of the lock to be removed (the edge of this panel is visible in the Forbes photo), exposing the bolt mechanism of the lock. Turning this mechanism one way opened the lock, turning it the other double-locked it so it couldn't be opened with the proper keycard. I wonder if any HN readers have access to an Onity lock to check whether this method works on them?
- daeken 14y ago
  I'm looking at my test lock (which doesn't have panels on it) and it looks to me that there's no way you could access the lock mechanism from the battery panel. With the HT locks I've played with, the locking mechanism sits inside the door, between the lock itself (with the circuit board, card reader, batteries, etc) and the back plate containing the deadbolt and such. Don't think it's vulnerable to what you're describing. However, it should be noted that if it's used in the university, it's almost definitely the Integra/CT line from Onity, which is different.
  - tmpaccount 14y ago
    Ah I see, no doubt a cheaper, lower-security line. Thanks for the info and congratulations on your hack.

253 points by ssclafani 14y ago

so reverse engineering seems cool. What skills do you find most useful/versatile/neat/groovy or otherwise necessary for your reverse engineering projects?

daeken 14y ago
I can't really narrow it down to a single specific skill. When I'm reversing, my steps are generally: figure out how I would design the system, come up with a set of assumptions based on that, check the assumptions as quickly as possible, then refactor your model of the system based on what you find. It's really all about making educated guesses and then checking those; as you gain experience, you start making better guesses.
- wheelerwj 14y ago
  okay very cool. the scientific method, rinse, repeat. how long have you been reversing?
  - daeken 14y ago
    About a decade now, probably. Started with MMOs, specifically Everquest, then moved on to DRM (which, oddly enough, is what I was in Forbes for last time), then on to locks and other hardware.

deleted 14y ago

[deleted]

deleted 14y ago
[deleted]

daeken 14y ago

I'm planning on doing a Reddit AMA for reversing in general -- as well as this work -- in the next hour or two, but if anyone has any questions I'll do my best to answer here. All I ask is no protocol details (paper and full code will be out tomorrow immediately following my talk) and no legal questions. Go wild. Edit: Since this thread has blown up a bit, we may as well just do it here for real. If you have any reversing questions or background questions or whatnot, feel free.

shimon_e 14y ago
Do you kindly mind only leaking the information on Friday? Thanks from all us who spend our weekdays living in hotels.
- daeken 14y ago
  Regardless of which hotel you're in and what locks they use, always use the physical security mechanisms provides, e.g. door chains. Deadbolts are engaged by the lock mechanism and will be retracted by, say, maintenance key cards. While this definitely opens up new bad things, the message is the same: don't trust the software, trust the physical. Then again, after doing this for a few years, I may be a bit on the paranoid side.
  - shimon_e 14y ago
    Little hard to lock the door with door chains while you're not in the room. Hotel occupancy is a lot lower on the weekend. I'm sure many people living in hotel rooms with more belonging than can fit in the safe will appreciated this information being released on a weekend.
    - DanBC 14y ago
      Hotel safes in rooms are notoriously insecure.
      - gameshot911 14y ago

jgrahamc 14y ago

It won't be a surprise to learn that these types of locks are vulnerable, but I'll be fascinated to learn the details especially since it sounds like you can get access to an internal bus easily. The assassination of Mahmoud Al-Mabhouh (http://en.wikipedia.org/wiki/Assassination_of_Mahmoud_al-Mabhouh http://en.wikipedia.org/wiki/Assassination_of_Mahmoud_al-Mab...) allegedly by Mossad involved attacking an electronic hotel lock to get access to his room: "A readout of activity that took place on the hotel room's electronic door lock indicated that an attempt was made to reprogram al-Mabhouh’s electronic door lock at this time. The investigators believe that the electronic lock on al-Mabhouh’s door may have been reprogrammed and that the killers gained entry to his room this way. The locks in question, VingCard Locklink brand (Dubai police video, 21:42), can be accessed and reprogrammed directly at the hotel room door."

daeken 14y ago
Yep, bus is clearly accessible on the bottom of the lock. As for Ving, I think they're going to be next up; spent years honing my skills in reversing this sort of thing, seems like a shame to stop now.
- shurane 14y ago
  How did you hone your skills for years? Have you been working with other lock providers? Or other methods, or just the process of reverse-engineering the software that hardware interacts with? You are cool, you know that?
  - daeken 14y ago
    I haven't been working on other lock hardware, but reversing the whole Onity system from the ground up has been quite an undertaking. I described a rough version of the whole process in another comment. I've also worked on a couple other devices, e.g. the Emotiv EPOC EEG. And thanks, I like to think so.

screwt 14y ago

Could you explain a little more why you didn't go for responsible disclosure to Onity? In the article you suggest that you don't think they could fix it. Maybe true but shouldn't you (a) give them the oppurtunity to try (just cos you can't spot the fix doesn't mean it's impossible), and (b) give them the chance to say "yep, it's broken - give us 3 months to ship out new locks to all our customers" (yes, highly unlikely I know!). Given that you sat on this for a year before publishing, there was ample oppurtunity to inform Onity before you publish.

daeken 14y ago
Given the simplicity of the vulnerabilities (as mentioned in the article, you have full and unauthenticated memory access) and the length of time -- over a decade -- that these locks have been on the market, there is absolutely no doubt that they knew about this. Given that, I felt that they would delay, delay, delay, and delay some more before finally going silent, at which point I would be forced to do this anyway. Simply put, I have zero confidence in their ability to mitigate this properly, and I believe that the only proper course of action is to make this public and let the hotels make themselves secure by whatever means possible. I know that's a bit of a strange answer, but this is a strange situation; it's taken me a while to figure out the correct course of action, and I feel that this really is the best way for the safety of the public. Edit: Toned down some of the wording; unnecessary.
- akamaka 14y ago
  That's a completly bogus excuse. The question wasn't why you're releasing it publicly, but why you haven't made any attempt to contact the company beforehand, which you seem to have had a year to do. Edit: The only reasons I can think of are laziness or just plain not giving a shit about responsible disclosure.
  - Kadin 14y ago
    In order so that they could do ... what, exactly? It doesn't sound like there's any mitigation that they could perform. At the very least, the guts of every lock has to be replaced. Given that, the rational, profit-maximizing thing for them to do is to stonewall, misdirect, bring out the lawyers, shoot the messenger, and generally continue to sell as many flawed locks as possible. We've all seen vendors do that in the past when faced with intractable, deep-seated defects in a product, so it wouldn't be unexpected or unreasonable to assume. All the notification would be is a courtesy, allowing them time to start designing and marketing a new product, instead of having the market get handed to their competitors when hotels suddenly have to start replacing their locks with less-flawed ones. And I'm not sure a company that produced a flawed products deserves that.

webjprgm 14y ago

Is the obvious fix to make the programming port available only from the inside of the room? That's where the screws for physical bolt locks go. And you can still have a DC power port on the outside in case of a powered-down door, just no programming access. Why have they not done it that way???

endianswap 14y ago
Probably because if the system glitches out and they can't into the room anymore (even with maintenance keys) then they wouldn't ever be able to fix it?
- daeken 14y ago
  Well, you can always drill the lock cylinder out, but that's a destructive process. It is possible to do this sort of thing in the right way, they just didn't.
  - rcfox 14y ago
    What happens to the lock when the battery dies/the power goes out?
    - daeken 14y ago
      Once the batteries go out (they're not powered on guest room doors), the lock won't open to keycards anymore. The batteries, though, are on the front of the door just below the handle (see the panel at the bottom, in the story photo) and can be replaced from the outside. Otherwise, it's possible to use the portable programmer's open function to open the lock, if the batteries in the PP are full enough; that's really iffy and has a tendency to not work, though.

ulope 14y ago

Interesting, but it's not as if hotels in general have been high security installations. Very easy experiment: Just go to the front desk an thell them that you sadly seem to have lost your room card. 90% of the time they will just ask for your room number without requiring any kind of proof that it's actually your room.

otoburb 14y ago
90%? Anecdotally, I was asked for ID each time my wife or I lost hotel room cards on 4 occasions (3 for me, once for my wife). I believe they were 2 Courtyard Marriotts, 1 Residence Inn (Marriott), and a Sheraton (don't remember the hotel class). EDIT: Grammar
petitmiam 14y ago
Or there's those hotels where you have to leave the keys at the front desk. Each time you come back you say your room number and they give you the key.
- tripzilch 14y ago
  Yeah, that was our hostel in NYC. I asked about that, and they kind of looked at me funny, as if I was paranoid or something. If figured the best way would be to semi-jokingly show her my ID regardless and be friendly and chatty in the hopes she'd remember my face with the room number. In hindsight I might have tried asking for a different room number's key to see if she was paying attention and then quickly correct myself "No, just kidding, my room's 208 not 210. I just wanted to see if you'd give people any room key they ask for". Maybe that would've made them see the issue. Instead, I took the easy route and made sure to never leave my netbook, passport, tickets, etc in the room (all the rest was replaceable and we were travelling light). I would have probably done differently if I wasn't in a foreign country on a different continent and still getting used to the cultural uncanny valley of NYC being "almost, but not quite like Europe", so I opted for the safe choice of not being a bother to these obviously hard-working people.

javajosh 14y ago

I was always curious about elock systems, particularly about how they are reprogrammed. Presumably they are reprogrammed by the front desk, centrally, but how does the signal reach the lock? Presumably there must be wires attached (at least for power). So why is there an external port on the lock at all? Also, what is the possibility that a lock exploit could affect the central reprogramming system? Edit: just read below that these things are battery powered, which raises two questions, first, ok, how are they reprogrammed, and second, how does a hotel not go bankrupt replacing thousands of batteries all the time?

daeken 14y ago
The locks are programmed by the front desk, but then the data is transferred to the Portable Programmer which then is used to update the doors. The doors themselves are not connected to power, but are rather completely battery-driven. The likelihood of anything impacting the front desk equipment is effectively nil. (Note: This is all specific to Onity locks)
- javajosh 14y ago
  I'm surprised that's how they are designed. How often do the batteries need replacement? (I realize that this isn't exactly related to your hack, but I'm finding myself fascinated by the economics of maintaining lots of locks. It reminds me of the problem of early computers having to replace vacuum tubes at a certain rate, limiting the size of the machine). Also, is it the housekeeping staff that reprograms the lock after they clean the room? It seems like it would be very inefficient to send a special person around to reprogram the lock after every check out.
  - daeken 14y ago
    The battery lifetime depends on how much traffic the door gets, but generally I believe it's 4-6 months, which is pretty impressive for 4 AAs. As for reprogramming the doors, that only happens very rarely. The cards have an expiration date and a code that cycles, meaning that when a new card is introduced, the old ones won't work anymore. So really it only needs to be reprogrammed when the clock gets out of sync or the batteries die (there's no non-volatile storage, just RAM).

jcfrei 14y ago

let's do this AMA thing right here, because my questions might get lost in the reddit noise. You seem like the prototype hacker to me - what's your personal stack? like OS, text editor, the computer you use daily? thanks for answering those 3 little questions.

daeken 14y ago
Haha, it seems we already are doing the AMA here. My stack now is a Lenovo W520 running Ubuntu and KDE, and Sublime Text as my editor. Over the years when I did this, I was running everything from a cheapo, hacked-together box to a 13" Macbook Pro, all running Windows Vista/7.
- otoburb 14y ago
  Do you use Backtrack at all, or do you simply craft/download/build-from-source your own tools as you need them? Also, did you switch from Windows to Linux because of the available tools and development environment, or because the Linux desktop had matured enough you could get sh*t done without worrying about driver compatibility issues or other common complaints about Linux [lap|desk]tops?
  - daeken 14y ago
    I don't use Backtrack or similar tools; the only tools I use that I didn't write myself are IDA Pro and Burp Proxy (if I'm doing websec work). As for switching OSes, the primary reason I did so is that my work for my day job all requires Linux. In terms of reversing, Windows is really the only way to fly; the tools just aren't there otherwise.
    - tripzilch 14y ago
      > In terms of reversing, Windows is really the only way to fly; the tools just aren't there otherwise. Curious, why is that, and what tools are those then?

kristopolous 14y ago

duh? I'm sorry but low security systems like hotel rooms of course have wide vulnerabilities. The front desk will just give out keys based on trust since you don't have to register everyone staying in the room; they don't even have an audit trail if they wanted to use it. Keyless entry cars are mostly crackable ... garage door systems are trivial, you can bump pin tumbler locks, many home security systems have no backup power. rfid skimmers are cheap and easy-to-use. almost every elock I've seen has the bus readily exposed on the outside (secured by a single screw at best). There's at most 6 things I can think of that actually do not have trivial security issues. If I knew I would become famous by informing the press that, for instance, a car model only has a handful of key patterns for millions of cars, I would have done it a long time ago, but I thought such things were just stupefyingly obvious.

twodayslate 14y ago
I completely agree with you but I think you should read the following: http://sivers.org/obvious/ http://sivers.org/obvious/
lgeek 14y ago
> a car model only has a handful of key patterns for millions of cars This reminds me of growing up in Eastern Europe. Story time: Under the Romanian communist regime, there was only one car factory (Dacia[1]) making cars for personal use. Their main model was essentially the same from the '70s until 2004. For the first 10 years or so after the '89 revolution, Dacia dominated the local car market (because their cars were cheap and really easy to fix). Now that we have the oh-so-important context, your comment reminded me that when I was a kid, my parents bought a Dacia. What confused me at a time was that random people would periodically ask to borrow the key. It turns out that for 30-something years, Dacia only used a few models of keys. In fact there were so few that if you locked your keys inside (doors were unlocked by key and they locked automatically) it was feasible to try keys from random cars until one worked. To be fair, the engine key was different from the door key, and it didn't have this problem. But, getting back to your comment, if you're talking about a recent card model then that's just crazy. Also, I would have thought that keyless entry systems use correctly implemented public key cryptography. Is that not the case? [1]: http://en.wikipedia.org/wiki/Automobile_Dacia http://en.wikipedia.org/wiki/Automobile_Dacia [2]: http://en.wikipedia.org/wiki/Romanian_Revolution_of_1989 http://en.wikipedia.org/wiki/Romanian_Revolution_of_1989

st3fan 14y ago

I think that making this public is not a very good example of responsible disclosure and I hope there will be a lawsuit before the presentation to prevent the details from being exposed. I am all about exposing vulnerabilities but I honestly think there needs to be a dialog with the vendor first. Specially for exploits like this where there is a lot at stake. I find the excuse of 'there is nothing they can do anyway' very poor. I have no doubt that this technique is known to locksmiths and law enforcement and maybe a smaller group of criminals. But making this public and exposing it to the world will allow any criminal with a soldering iron and an Arduino to start exploiting this. Daeken, you have done an awesome job making this known. Maybe that it enough to get the ball rolling. Or do you just want to do damage for fame and profit?

m0nastic 14y ago
This argument has been going around for as long as I can remember, and I think it's incredibly harmful to researchers (whether they be security or other). Upon discovering the vulnerability, the only real action he could take which would be universally considered unacceptable would be to use that research to go around breaking into hotel rooms (which is illegal). If he decided to go into business selling devices to bypass hotel room locks, there would also probably be a majority opinion that that isn't really "above-board". Even that isn't necessarily universally agreed on though (as there are a lot of people who argue that providing access to tools isn't criminal) But he didn't do that either. He decided that this was a pretty severe vulnerability (made worse by the fact that remediating it isn't trivial), and that he wanted people to know about it. Hoping that the vendor will sue him to prevent that information from being disseminated is about the worst possible outcome from research of any kind; ignoring the fact that you don't seem to posit any rationale for what exactly they'd be suing about (protected trade secrets? violation of a license agreement?) The thing about "responsible disclosure" is that it isn't something that exists by fiat. It's an intentional reframing of disclosure policies by vendors to attempt to steer the research community towards doing what's in the vendors best interests. I understand their desire to reframe that policy, but that doesn't make it "the only ethically responsible way to conduct vulnerability disclosures". Recently, there's been a lot of news about BMW's being able to be stolen trivially through access to the OBD port on certain models. There's an OSVDB entry for it and everything‡. That's another example where providing information to the public was considered to be very important (like the issue Cody discovered, it's also not something that can be easily fixed. It's also been ignored by the vendor). In virtually all other regards, making research public is considered the responsible thing to do. While I'm not a card-carrying member of the full-disclosure sentiment, I strongly disagree that releasing research publicly is boolean irresponsible. ‡ http://osvdb.org/83707 http://osvdb.org/83707

kylebrown 14y ago

What tools do you use for reversing hardware? Did you have to open up the lock and tap into it with something like a logic analyzer? Or was it as simple as creating a DC port adapter so you could read the data from the portable programmer?

daeken 14y ago
So, reversing it was sort of all over the place. I first had to reverse the front desk system and all that; that was primarily done by sitting between the equipment with a serial proxy and working from there. Once I had a good bit of data captured, I'd write software to emulate being one side or the other. Everything is RS232 and RS485, pretty straightforward. In terms of reversing the actual lock protocol, that was a bit more tricky. First step was tapping the line between the portable programmer and lock with an o-scope (a 70s-era HP scope; only thing I could afford at the time, haha) to figure out the voltage levels involved and the basic properties of the communication. From there, I hit it with the Saleae Logic to see what the communication actually looked like. From there, I wrote some Python scripts to walk over the data from the logic analyzer and attempt to decode the data. With some tweaking, I managed to finally see some data that I knew, specifically the site code (which I knew from other parts of the system). After I knew all that, it was a matter of figuring out the actual hardware level. Given that I have effectively no experience with this level of things, this was a lot of asking questions, googling, and experimenting. I knew that it was a one-wire protocol, so by reading up on other one-wire protocols I managed to figure out a lot. Once that was done, everything just fell into place; making the opening device work initially took maybe a day given all the info I had.

stcredzero 14y ago

> HN's Daeken will expose You have my attention... > security flaw in 4m sounding really interesting... > hotel room keycard locks. Oh. Well, still pretty cool. EDIT: Actually, this kid of thing needs to get a lot more attention and awareness. I could suggest a certification of some kind, but there's often a reaction against that. But a certification that just indicated: - No passwords in plaintext - Not vulnerable to replay attacks - No "toy" encryption Would be of great benefit in today's world.

thornofmight 14y ago

How did you practice this and discover it? I can't imagine just wondering around hotel rooms playing around with the doors...

daeken 14y ago
I was working on a replacement of the Onity front-desk system at the time, and I suspected it existed for a while. In another comment I detail how I reversed everything, but everything was done on my own hardware, not just random hotels.

bugmenot 14y ago

How about a little super glue in/on the DC power port?

mark_g 14y ago

The poor hacker's alternative: http://www.youtube.com/watch?v=WAkJRpKeyYg&has_verified=1 http://www.youtube.com/watch?v=WAkJRpKeyYg&has_verified=...

rdl 14y ago

Any idea what locks Caesars and the Rio use?

tmpaccount 14y ago

I'm not certain, but in the picture from the Forbes article the lock looks exactly like the kind used on many doors in my university - the shape is exactly the same, and ours had the same type of electrical connector in the same place at the bottom of the lock. I remember because I considered attacking this interface before noticing the torx security screw next to the connector; removing this screw allows the panel covering the bottom part of the lock to be removed (the edge of this panel is visible in the Forbes photo), exposing the bolt mechanism of the lock. Turning this mechanism one way opened the lock, turning it the other double-locked it so it couldn't be opened with the proper keycard. I wonder if any HN readers have access to an Onity lock to check whether this method works on them?

daeken 14y ago
I'm looking at my test lock (which doesn't have panels on it) and it looks to me that there's no way you could access the lock mechanism from the battery panel. With the HT locks I've played with, the locking mechanism sits inside the door, between the lock itself (with the circuit board, card reader, batteries, etc) and the back plate containing the deadbolt and such. Don't think it's vulnerable to what you're describing. However, it should be noted that if it's used in the university, it's almost definitely the Integra/CT line from Onity, which is different.
- tmpaccount 14y ago
  Ah I see, no doubt a cheaper, lower-security line. Thanks for the info and congratulations on your hack.