6 ms·

I'm planning on doing a Reddit AMA for reversing in general -- as well as this work -- in the next hour or two, but if anyone has any questions I'll do my best

• shimon_e 14y ago
  Do you kindly mind only leaking the information on Friday? Thanks from all us who spend our weekdays living in hotels.
  • daeken 14y ago
    Regardless of which hotel you're in and what locks they use, always use the physical security mechanisms provides, e.g. door chains. Deadbolts are engaged by the lock mechanism and will be retracted by, say, maintenance key cards. While this definitely opens up new bad things, the message is the same: don't trust the software, trust the physical. Then again, after doing this for a few years, I may be a bit on the paranoid side.
    • shimon_e 14y ago
      Little hard to lock the door with door chains while you're not in the room. Hotel occupancy is a lot lower on the weekend. I'm sure many people living in hotel rooms with more belonging than can fit in the safe will appreciated this information being released on a weekend.
      • DanBC 14y ago
        Hotel safes in rooms are notoriously insecure.
        • gameshot911 14y ago
          How so? Does it tend to stem from poor physical design, or the locking software?
          • Terry_B 14y ago
            I always figure that the maintenance guy and probably half the staff know the master code.
          • beedogs 14y ago
            Many have backdoor passwords. Most can simply be unbolted and removed from the room. http://gizmodo.com/5837561/can-000000-secretly-open-your-hotel-safe http://gizmodo.com/5837561/can-000000-secretly-open-your-hot...
        • sadga 14y ago
          Hotel safes are there to secure insurance protection for your belongings.
      • tripzilch 14y ago
        > Little hard to lock the door with door chains while you're not in the room. A little hard, maybe, but I've seen a vid of some guy unlocking a door chain using a rubber band, coat hanger wire and a stick. So I guess that with a little effort locking the door from outside is possible.
    • polshaw 14y ago
      >trust the physical A lock-picker might say different, no?
      • KirinDave 14y ago
        Probably not. Wait until you see the flaws, man. Not being robbed is sort of a matter of being slightly more tedious to pick than the next guy. The stuff Daeken has worked makes it ludicrously easy.
    • mrb 14y ago
      "always use the physical security mechanisms provides, e.g. door chains" Sliding chain locks which can be defeated with a rubber band... :-) http://www.youtube.com/watch?v=7INIRLe7x0Y&t=60s http://www.youtube.com/watch?v=7INIRLe7x0Y&t=60s
      • greyboy 14y ago
        That seems like an implementation problem. (warning: anecdote ahead:) All sliding chain locks I've used are up at eye level, which would make this much more complicated, if not impossible. That, or they have the hard-bar-over-ball lock, also at eye-level. Plus, my large hands wouldn't have been able to do that trick. :/
    • tripzilch 14y ago
      Now I wonder, how big is this then? 4M hotels in the US, what slice of the pie is that compared to the whole number of hotels in the US? And how many in Europe/Australia/Asia, do they use completely different locks? Also, just because you leaked the details today (yesterday?), how realistic is his worry that evil parties might copy the tech before the weekend? :) And indeed, doesn't every hotel room have a small safe, I don't just keep my passport there, but also my laptop, camera and phone if I don't take them with me. And indeed indeed, I never even considered whether the door to my hotel room would be "secure", if maintenance and cleaning have a universal key, it's mostly a privacy measure, rating somewhat above a bathroom stall lock. It might be different if they wouldn't all have a small safe, though. Now I do wonder how secure those safes are, in general :) Any idea? (edit: whoops I should've read the thread further, this has already been discussed--great discussion though, keep it up!)
  • tedunangst 14y ago
    Do you think all the locks are going to be fixed by Monday?
• stfu 14y ago
  Random question: His former employer [..], sold the intellectual property behind Brocious’s hack to the locksmith training company the Locksmith Institute (LSI) for $20,000 last year. Are these guys "buying up" security flaws in locks similar to others who sell these kinds of things for software?
  • daeken 14y ago
    Don't know what they're doing, quite honestly. Though I should mention that they didn't buy it from us, they got a non-exclusive license to use the technology. Just wanted to clarify.
  • Heinleinian 14y ago
    It's the Locksmith Institute. Locksmiths are who you call to get into a door to something own, but to which you lost the key. So presumably there's situations where a hotel can't get their keys working, and they'd like to have locksmiths in their city who are trained in this. Don't think it's any more complicated than that...
• ars 14y ago
  The article mentions Onity - what about other companies?
  • daeken 14y ago
    Everything I'm releasing is specific to Onity. I can't speak to the security of any of the others, as I haven't looked at them yet, but I'm planning on doing so in the near future. Next up is most likely Ving, though Timelox is a really clever system, so that could be fun.
    • shimon_e 14y ago
      The room I'm in has a Ving lock. I witnessed it being reprogrammed by hotel staff when I was having problems opening my door. Ving may have security flaws but I'm assuming it will be a bit more expensive to exploit.
      • daeken 14y ago
        I can't speak to the actual security, but I know that it requires a contact card inside the slot to actually program the lock. That's not something you can likely build for a couple bucks in parts at Radioshack, so at least the barrier to entry is higher.
        • dkersten 14y ago
          At least, higher. If you were in the business of robbing hotel rooms, I'm sure a onetime fee wouldn't be much of a barrier. Keep the small-time thieves at bay though.
          • shimon_e 14y ago
            I wonder if you could legally squad empty hotel rooms like this?
        • shimon_e 14y ago
          Exactly my point. :)
• deleted 14y ago
  [deleted]
• mpakes 14y ago
  Was it necessary to wear a t-shirt that reads "It's fun to use learning for evil!" in the photo shoot for a Forbes spread? This doesn't help the negative perception of the word "hacker". :-/ All due respect to the work you're doing – I'm a former member of the security industry myself (worked on the IPS engine at TippingPoint).
  • tptacek 14y ago
    You don't think this is a little nitpicky? He's at the "Black Hat Briefings".
    • mpakes 14y ago
      Fair enough, and that's why I attempted to tone down the message with my statement of respect. I've followed Cody's work with interest for years. I do stand by my general point, though. I think it's worth thinking about how we represent ourselves to the general public. The word "Hacker" has an unfortunate negative reputation, and I don't think messages like this help. It really jumped out at me when I opened the article (otherwise I would have kept this nit to myself).
      • guscost 14y ago
        I can see a reasonable point that it feeds into the stereotype of the programmer-misanthrope.
    • larrys 14y ago
      It's fairly easy to change a T-shirt. Whether or not anyone agrees with his appearance or not being relevant, he wasn't photographed in the audience at the conference or up on stage. He posed for a photograph in a hotel. Even if he didn't have a spare shirt, the gift shop in a hotel generally does. That's if he had thought of that issue. No problem with telling the photographer you had to change. Even if they noted that in the story it's the picture that's worth 1000 words. I had a story done a number of years ago and they sent a photographer to the office. I took several hours to arrange everything to get a good setup for the photo. It paid off. The photo was good and the photo editor liked and made it the centerpoint of a story where many people were quoted. It ran all over in syndication. My point is simply it's important to think ahead when the media comes knocking. (Along those lines hmm, maybe he did the right thing with that t-shirt publicity wise). In any case people can now learn from the "nitpick" and decide for themselves if they are ever in the spotlight what they want to do.
• paulgb 14y ago
  > But on three Onity locks installed on real hotel doors he and I tested at well-known independent and franchise hotels in New York, results were much more mixed This is a long shot, but I was in a chain hotel in midtown recently and heard someone tampering with the lock, and found the door ajar in the morning. I realize you probably can't name specific hotels, but was one by any chance a chain hotel in midtown around the 11th?
  • daeken 14y ago
    Nope, I was in Europe at the time; we did the photoshoot late last month, though I can't recall when.
  • michaelbuckbee 14y ago
    I used to travel fairly extensively for work, on at least 3 separate occasions I had Marriott check me into an already occupied room.
  • brown9-2 14y ago
    You don't lock the bolt or the chain mechanism when you stay in a hotel room? Or are you saying they bypassed those also?
    • Zak 14y ago
      I think the primary threat in this situation is burglary of an unoccupied hotel room. Security chains are fairly easy to defeat; a bent clothes hanger will do. Deadbolts are probably pretty hard if there's no external key hole. Someone intending harm to the occupants of a hotel room might just break a window.
      • superuser2 14y ago
        Not necessarily. Sometimes the master key card opens the deadbolt as well.
• nja 14y ago
  My university uses Onity locks for universal access with ID cards. This means our campus (and residences) are vulnerable, too, right? Are you aware of many universities that use similar systems?
  • daeken 14y ago
    So, those locks are the CT (commercial, Integra) locks. I strongly suspect that they're vulnerable to roughly the same thing, but I haven't tested them to see for sure. There are two reasons I believe this to be the case: the only difference between the PP20 (portable programmer used in the Onity HT system for hotels) and the CT PP is a swapped out EPROM. Given the similarity of the systems from a high-level perspective and the PP differences, I'd be very surprised if they weren't similarly vulnerable. At some point I'd love to test the CT side, but 1) the hardware is tough to get hold of, and 2) it's not a very popular system, so it's not that interesting. I think it'd be pretty straightforward, though.
    • nja 14y ago
      Neat. I've often wondered about the port on the bottom of the lock. Thanks for clarifying.