5 ms·

The New Hotel Key: Your Smartphone

35 points by ghosh 13y ago

Piskvorrr 13y ago
I can imagine that. "App permissions required: EVERYTHING, plus your firstborn." Why is everyone so intent on messing around with my smartphone? Oh wait, my data.
blueskin_ 13y ago
If this happens, I will hide my phone and insist I don't have one until they give me a real key. This is a complete privacy and security nightmare both from the potential of cracking it and from installing an app that will probably grab every permission it can. It's also going to be entertaining seeing people with dead batteries begging a charge from people in the lobby.
- VLM 13y ago
  Just place a "special" charger in the lobby that charges, but also powns the phone and gathers not just all their precious data but gains access to their room. They might not have much to steal, but you'll know there's at least a phone to take. My guess is because none of they crypto is mentioned, its probably some self developed snakeoil, so you might not even need to own their phone. Could be as simple as "bluetooth address whatever, which happens to be in the central DB whitelist, says open sesame" and the door opens. Amusingly I have a moto-X and my BT addrs is 1 less than my wifi MAC so if the security protocol is weak enough to depend on BT addrs, you could sniff the wireless for awhile and then just subtract 1 from each sniffed wifi MAC and have some fun with known good BT addrs. Or perhaps on other phones BT addrs = wifi + 1 instead of minus 1. Whatever.
  - blueskin_ 13y ago
    >Just place a "special" charger in the lobby Now this idea, I like. http://krebsonsecurity.com/2011/08/beware-of-juice-jacking/ http://krebsonsecurity.com/2011/08/beware-of-juice-jacking/ >My guess is because none of they crypto is mentioned, its probably some self developed snakeoil, so you might not even need to own their phone. Could be as simple as "bluetooth address whatever, which happens to be in the central DB whitelist, says open sesame" and the door opens. I would seriously hope for this not to be true, but I've seen too many security fails to think it won't. Access is amazingly rubbish with security, especially when some RFID chip makers actually put a proprietary encryption algorithm as a selling point, when many of those (e.g. mifare) are provably broken.
- k-mcgrady 13y ago
  >> This is a complete privacy and security nightmare both from the potential of cracking it and from installing an app that will probably grab every permission it can. Aren't hotel room locks already easily cracked? I remember seeing it on HN last year. As for permissions - if you don't like them don't install the app, they aren't going to deny you a key. >> It's also going to be entertaining seeing people with dead batteries begging a charge from people in the lobby. Presumably in this case they would give you a key.
  - blueskin_ 13y ago
    >Aren't hotel room locks already easily cracked? They are, but this will only make them worse.
    - lordCarbonFiber 13y ago
      There is no reason to believe that an nfc controled lock is any less secure than a traditional physical tumbler lock. In fact, if set up correctly (well sealed pannel, sound generation of keys, etc), it could be significantly more secure since well set up cryptography is a hell of a lot harder than simple lock picking.
      - Piskvorrr 13y ago
        That's a big "if". Big enough to be implausible - even nuclear missiles were sitting in the silos for years with launch code set to "000000"; what makes you think that hotels will care more about their security? See e.g. this: https://www.schneier.com/blog/archives/2012/08/hotel_door_lock.html https://www.schneier.com/blog/archives/2012/08/hotel_door_lo... Moreover, the electronic mechanism pretty much never opens the lock: it activates a relay, which opens ... drum roll ... the physical lock. So the old, mechanical lock vulnerabilities are preserved, and new electronic ones added on top. What could posibly go wrong?
        QSIITurbo 13y ago
        "mechanical lock vulnerabilities are preserved" I've never been to a hotel that uses an ordinary key since those can be easily replicated, so that point is moot: all the electronic locks (most common these days) already have this "vulnerability" ("so why put a lock there in the first place?"). Second, since this system is being developed to use a smartphone, the security is easier to manage than a PIN code (such as 000000...). One can use centralised key-servers, etc. Third, the company making these locks (the physical part) is ASSA Abloy, which is an extremely reputable lock company instead of the one in your link.
xexers 13y ago
why cant they just send an old fashioned text message with a pin code... then use that pin code to open the door. messing around with bluetooth sounds complicated
- smackfu 13y ago
  A pin code is observable by someone else.
  - Kliment 13y ago
    So send a new one on every unlock? Have a button on the door that sends a code to the phone, invalid after timeout or after first use. Invalid codes can generate a new code so if someone tries to access your room you get notified as well.
- wikyd 13y ago
  It looks like it uses Bluetooth LE, which is significantly less complicated than pairing with "classic" bluetooth. Once you have downloaded the app, it should just unlock the door based on proximity. Entering a PIN code would be much less convenient.
fvox13 13y ago
I smell a DEF CON talk coming...
privong 13y ago
I was able to read the RFID card at an Aloft hotel (they were mentioned in the article) using NFC on my phone. In principle, it should have been possible to clone that room card to my phone so I could have just used my phone, but I didn't pursue that.
- walshemj 13y ago
  I can see this (cloning a hotel key) being used in Person of interest.
- onion2k 13y ago
  I always assumed hotel keycards are writable[1], so they just change the code on the card and associate the new one with the room whenever a new guest checks in. Knowing what the code was when you were staying there wouldn't be any help at all in the future. [1] This sort of thing: http://proto-pic.co.uk/mifare-one-rfid-card-13-56mhz/?gclid=CPK_gbaGobwCFeXKtAodsnoAVg http://proto-pic.co.uk/mifare-one-rfid-card-13-56mhz/?gclid=...
  - QSIITurbo 13y ago
    Some keycards are even completely disposable (paper / cardboard), though most of them are reprogrammable (plastic). I've seen hotel personnel swipe the card to grant me access to my room (with a new and/or unique key, etc.)
  - maxerickson 13y ago
    Often, the lock reads a time stamp from the keys and the lock only opens for fresh keys.
  - privong 13y ago
    Definitely. I was more thinking about cloning the card so I could just use my phone to unlock the door instead, rather than trying to use it at some future date.
- veb 13y ago
  I had absolutely no idea my NFC reader on my Nexus could read my credit-card details, or other RFID stuff with NFC enabled -- rather scary! To anyone who is interested, enable NFC on your 'droid, then on Google Play, download "Card Test" and voila...
k-mcgrady 13y ago
If it works I like this idea. At least it'll solve the problem of phones deactivating keycards.
smackfu 13y ago
A side effect of this is that your room security is only as good as your SPG account password. Since someone else can just install the app on their phone, log in as you, and unlock your door.
post_break 13y ago
I just installed a bluetooth deadbolt at my apartment the other day. It's actually pretty nice. And no it's not a Lockitron since apparently they don't know how to ship a product on time. The app requests the key from a server and if it's correct it allows you to send the commands to the deadbolt. Now it's just time to start fuzzing for those commands. The only problem is that I can manipulate wifi pretty easy, but have no clue how to put bluetooth into monitor mode.
gmurphy 13y ago
Smart locks are awesome, I have a z-wave lock in my house, hooked up to a home automation system I wrote so that my front door unlocks whenever I walk up to it. I love that I've reduced the "wallet/phone/keys" patdown to "wallet/phone". Unfortunately, many of the smart locks that use your phone as an unlock mechanism don't have a good solution for what to do when your phone battery runs out. Usually the answer is "use a key", but the new problem is that once enough of your locks are smart, you stop carrying keys. In the home, keypads work well (and they can easily be set up for guests, etc), but that seems prone to memory error in hotel situations.
- agumonkey 13y ago
  These smart-locks are powered ? they could fit a usb plug just in case right ?
  - potatolicious 13y ago
    Not that my home is Fort Knox or anything, but allowing a direct electronic connection between your lock and an unknown external device seems like a bad idea.
    - agumonkey 13y ago
      Understood but it doesn't need to be a full power plug, just enough for usb 2.0 devices, maybe with a timeout to avoid leakage. Also really just the power wires, no data, like usb condoms http://int3.cc/products/usbcondoms http://int3.cc/products/usbcondoms .
      - maxerickson 13y ago
        A lot of the locks are powered by AA batteries. I'd rather have a keypad than the cascading inconvenience of having to swap those batteries more often.
- dangrossman 13y ago
  > Unfortunately, many of the smart locks that use your phone as an unlock mechanism don't have a good solution for what to do when your phone battery runs out. The only z-wave smart locks I've seen carried in national retail stores also have keypads [1,2,3]. Isn't that the solution to the battery problem? What lock do you use? I could never rely on z-wave to open mine; I only use that to automate locking up the house at night in case I forgot. It can take up to 30 seconds for my lock to respond to a z-wave command if it hasn't already been woken by some other event, which is a long time to stand outside your door waiting for it to open for you. 1: http://www.homedepot.com/p/Schlage-Camelot-Aged-Bronze-Touchscreen-Deadbolt-with-Alarm-BE469NX-CAM-716/203814066 http://www.homedepot.com/p/Schlage-Camelot-Aged-Bronze-Touch... 2: http://www.homedepot.com/p/Schlage-Aged-Bronze-Home-Keypad-Deadbolt-with-Nexia-Home-Intelligence-BE369NX-CAM-716/203397806 http://www.homedepot.com/p/Schlage-Aged-Bronze-Home-Keypad-D... 3: http://www.lowes.com/pd_497751-350-910+TRL+ZW+15+SMT+CP_0__?productId=4755138&Ntt=kwikset+910&pl=1&currentURL=%3FNtt%3Dkwikset%2B910&facetInfo= http://www.lowes.com/pd_497751-350-910+TRL+ZW+15+SMT+CP_0__?...
dbot 13y ago
I always thought you should be able to open the room with the credit card you used to book it.
- stonemetal 13y ago
  Sounds a little scary to me. Trying to secure it against skimmers seems like it would be impossible. All you would have to do is rent the room, put out the do not disturb sign, then you would have unfettered, unmonitored access to the lock for as long as you like.
evandena 13y ago
This seems like a solution looking for a problem. Lost your key? Go to the front desk. Not that big of a deal.

35 points by ghosh 13y ago

I can imagine that. "App permissions required: EVERYTHING, plus your firstborn." Why is everyone so intent on messing around with my smartphone? Oh wait, my data.

blueskin_ 13y ago

If this happens, I will hide my phone and insist I don't have one until they give me a real key. This is a complete privacy and security nightmare both from the potential of cracking it and from installing an app that will probably grab every permission it can. It's also going to be entertaining seeing people with dead batteries begging a charge from people in the lobby.

VLM 13y ago
Just place a "special" charger in the lobby that charges, but also powns the phone and gathers not just all their precious data but gains access to their room. They might not have much to steal, but you'll know there's at least a phone to take. My guess is because none of they crypto is mentioned, its probably some self developed snakeoil, so you might not even need to own their phone. Could be as simple as "bluetooth address whatever, which happens to be in the central DB whitelist, says open sesame" and the door opens. Amusingly I have a moto-X and my BT addrs is 1 less than my wifi MAC so if the security protocol is weak enough to depend on BT addrs, you could sniff the wireless for awhile and then just subtract 1 from each sniffed wifi MAC and have some fun with known good BT addrs. Or perhaps on other phones BT addrs = wifi + 1 instead of minus 1. Whatever.
- blueskin_ 13y ago
  >Just place a "special" charger in the lobby Now this idea, I like. http://krebsonsecurity.com/2011/08/beware-of-juice-jacking/ http://krebsonsecurity.com/2011/08/beware-of-juice-jacking/ >My guess is because none of they crypto is mentioned, its probably some self developed snakeoil, so you might not even need to own their phone. Could be as simple as "bluetooth address whatever, which happens to be in the central DB whitelist, says open sesame" and the door opens. I would seriously hope for this not to be true, but I've seen too many security fails to think it won't. Access is amazingly rubbish with security, especially when some RFID chip makers actually put a proprietary encryption algorithm as a selling point, when many of those (e.g. mifare) are provably broken.
k-mcgrady 13y ago
>> This is a complete privacy and security nightmare both from the potential of cracking it and from installing an app that will probably grab every permission it can. Aren't hotel room locks already easily cracked? I remember seeing it on HN last year. As for permissions - if you don't like them don't install the app, they aren't going to deny you a key. >> It's also going to be entertaining seeing people with dead batteries begging a charge from people in the lobby. Presumably in this case they would give you a key.
- blueskin_ 13y ago
  >Aren't hotel room locks already easily cracked? They are, but this will only make them worse.
  - lordCarbonFiber 13y ago
    There is no reason to believe that an nfc controled lock is any less secure than a traditional physical tumbler lock. In fact, if set up correctly (well sealed pannel, sound generation of keys, etc), it could be significantly more secure since well set up cryptography is a hell of a lot harder than simple lock picking.
    - Piskvorrr 13y ago
      That's a big "if". Big enough to be implausible - even nuclear missiles were sitting in the silos for years with launch code set to "000000"; what makes you think that hotels will care more about their security? See e.g. this: https://www.schneier.com/blog/archives/2012/08/hotel_door_lock.html https://www.schneier.com/blog/archives/2012/08/hotel_door_lo... Moreover, the electronic mechanism pretty much never opens the lock: it activates a relay, which opens ... drum roll ... the physical lock. So the old, mechanical lock vulnerabilities are preserved, and new electronic ones added on top. What could posibly go wrong?
      - QSIITurbo 13y ago
        "mechanical lock vulnerabilities are preserved" I've never been to a hotel that uses an ordinary key since those can be easily replicated, so that point is moot: all the electronic locks (most common these days) already have this "vulnerability" ("so why put a lock there in the first place?"). Second, since this system is being developed to use a smartphone, the security is easier to manage than a PIN code (such as 000000...). One can use centralised key-servers, etc. Third, the company making these locks (the physical part) is ASSA Abloy, which is an extremely reputable lock company instead of the one in your link.

xexers 13y ago

why cant they just send an old fashioned text message with a pin code... then use that pin code to open the door. messing around with bluetooth sounds complicated

smackfu 13y ago
A pin code is observable by someone else.
- Kliment 13y ago
  So send a new one on every unlock? Have a button on the door that sends a code to the phone, invalid after timeout or after first use. Invalid codes can generate a new code so if someone tries to access your room you get notified as well.
wikyd 13y ago
It looks like it uses Bluetooth LE, which is significantly less complicated than pairing with "classic" bluetooth. Once you have downloaded the app, it should just unlock the door based on proximity. Entering a PIN code would be much less convenient.

fvox13 13y ago

I smell a DEF CON talk coming...

privong 13y ago

I was able to read the RFID card at an Aloft hotel (they were mentioned in the article) using NFC on my phone. In principle, it should have been possible to clone that room card to my phone so I could have just used my phone, but I didn't pursue that.

walshemj 13y ago
I can see this (cloning a hotel key) being used in Person of interest.
onion2k 13y ago
I always assumed hotel keycards are writable[1], so they just change the code on the card and associate the new one with the room whenever a new guest checks in. Knowing what the code was when you were staying there wouldn't be any help at all in the future. [1] This sort of thing: http://proto-pic.co.uk/mifare-one-rfid-card-13-56mhz/?gclid=CPK_gbaGobwCFeXKtAodsnoAVg http://proto-pic.co.uk/mifare-one-rfid-card-13-56mhz/?gclid=...
- QSIITurbo 13y ago
  Some keycards are even completely disposable (paper / cardboard), though most of them are reprogrammable (plastic). I've seen hotel personnel swipe the card to grant me access to my room (with a new and/or unique key, etc.)
- maxerickson 13y ago
  Often, the lock reads a time stamp from the keys and the lock only opens for fresh keys.
- privong 13y ago
  Definitely. I was more thinking about cloning the card so I could just use my phone to unlock the door instead, rather than trying to use it at some future date.
veb 13y ago
I had absolutely no idea my NFC reader on my Nexus could read my credit-card details, or other RFID stuff with NFC enabled -- rather scary! To anyone who is interested, enable NFC on your 'droid, then on Google Play, download "Card Test" and voila...

k-mcgrady 13y ago

If it works I like this idea. At least it'll solve the problem of phones deactivating keycards.

smackfu 13y ago

A side effect of this is that your room security is only as good as your SPG account password. Since someone else can just install the app on their phone, log in as you, and unlock your door.

post_break 13y ago

I just installed a bluetooth deadbolt at my apartment the other day. It's actually pretty nice. And no it's not a Lockitron since apparently they don't know how to ship a product on time. The app requests the key from a server and if it's correct it allows you to send the commands to the deadbolt. Now it's just time to start fuzzing for those commands. The only problem is that I can manipulate wifi pretty easy, but have no clue how to put bluetooth into monitor mode.

gmurphy 13y ago

Smart locks are awesome, I have a z-wave lock in my house, hooked up to a home automation system I wrote so that my front door unlocks whenever I walk up to it. I love that I've reduced the "wallet/phone/keys" patdown to "wallet/phone". Unfortunately, many of the smart locks that use your phone as an unlock mechanism don't have a good solution for what to do when your phone battery runs out. Usually the answer is "use a key", but the new problem is that once enough of your locks are smart, you stop carrying keys. In the home, keypads work well (and they can easily be set up for guests, etc), but that seems prone to memory error in hotel situations.

agumonkey 13y ago
These smart-locks are powered ? they could fit a usb plug just in case right ?
- potatolicious 13y ago
  Not that my home is Fort Knox or anything, but allowing a direct electronic connection between your lock and an unknown external device seems like a bad idea.
  - agumonkey 13y ago
    Understood but it doesn't need to be a full power plug, just enough for usb 2.0 devices, maybe with a timeout to avoid leakage. Also really just the power wires, no data, like usb condoms http://int3.cc/products/usbcondoms http://int3.cc/products/usbcondoms .
    - maxerickson 13y ago
      A lot of the locks are powered by AA batteries. I'd rather have a keypad than the cascading inconvenience of having to swap those batteries more often.
dangrossman 13y ago
> Unfortunately, many of the smart locks that use your phone as an unlock mechanism don't have a good solution for what to do when your phone battery runs out. The only z-wave smart locks I've seen carried in national retail stores also have keypads [1,2,3]. Isn't that the solution to the battery problem? What lock do you use? I could never rely on z-wave to open mine; I only use that to automate locking up the house at night in case I forgot. It can take up to 30 seconds for my lock to respond to a z-wave command if it hasn't already been woken by some other event, which is a long time to stand outside your door waiting for it to open for you. 1: http://www.homedepot.com/p/Schlage-Camelot-Aged-Bronze-Touchscreen-Deadbolt-with-Alarm-BE469NX-CAM-716/203814066 http://www.homedepot.com/p/Schlage-Camelot-Aged-Bronze-Touch... 2: http://www.homedepot.com/p/Schlage-Aged-Bronze-Home-Keypad-Deadbolt-with-Nexia-Home-Intelligence-BE369NX-CAM-716/203397806 http://www.homedepot.com/p/Schlage-Aged-Bronze-Home-Keypad-D... 3: http://www.lowes.com/pd_497751-350-910+TRL+ZW+15+SMT+CP_0__?productId=4755138&Ntt=kwikset+910&pl=1&currentURL=%3FNtt%3Dkwikset%2B910&facetInfo= http://www.lowes.com/pd_497751-350-910+TRL+ZW+15+SMT+CP_0__?...

dbot 13y ago

I always thought you should be able to open the room with the credit card you used to book it.

stonemetal 13y ago
Sounds a little scary to me. Trying to secure it against skimmers seems like it would be impossible. All you would have to do is rent the room, put out the do not disturb sign, then you would have unfettered, unmonitored access to the lock for as long as you like.

evandena 13y ago

This seems like a solution looking for a problem. Lost your key? Go to the front desk. Not that big of a deal.