HN's Daeken will expose security flaw in 4m hotel room keycard locks • Hacker News Board

Re: HN's Daeken will expose security flaw in 4m hotel room keycard locks

#71

Post by otoburb » Mon, Jul 23, 2012, 7:18 PM UTC

ulope wrote: post #36

Interesting, but it's not as if hotels in general have been high security installations. Very easy experiment: Just go to the front desk an thell them that you sadly seem to have lost your room card. 90% of the time they will just ask for your room number without requiring any kind of proof that it's actually your room.

90%?

Anecdotally, I was asked for ID each time my wife or I lost hotel room cards on 4 occasions (3 for me, once for my wife).

I believe they were 2 Courtyard Marriotts, 1 Residence Inn (Marriott), and a Sheraton (don't remember the hotel class).

EDIT: Grammar

Re: HN's Daeken will expose security flaw in 4m hotel room keycard locks

#72

Post by otoburb » Mon, Jul 23, 2012, 7:19 PM UTC

daeken wrote: post #51

jcfrei wrote: post #50

let's do this AMA thing right here, because my questions might get lost in the reddit noise. You seem like the prototype hacker to me - what's your personal stack? like OS, text editor, the computer you use daily? thanks for answering those 3 little questions.

Haha, it seems we already are doing the AMA here. My stack now is a Lenovo W520 running Ubuntu and KDE, and Sublime Text as my editor. Over the years when I did this, I was running everything from a cheapo, hacked-together box to a 13" Macbook Pro, all running Windows Vista/7.

Do you use Backtrack at all, or do you simply craft/download/build-from-source your own tools as you need them?

Also, did you switch from Windows to Linux because of the available tools and development environment, or because the Linux desktop had matured enough you could get sh*t done without worrying about driver compatibility issues or other common complaints about Linux [lap|desk]tops?

Re: HN's Daeken will expose security flaw in 4m hotel room keycard locks

#73

Post by daeken » Mon, Jul 23, 2012, 7:20 PM UTC

wheelerwj wrote: post #70

so reverse engineering seems cool. What skills do you find most useful/versatile/neat/groovy or otherwise necessary for your reverse engineering projects?

I can't really narrow it down to a single specific skill. When I'm reversing, my steps are generally: figure out how I would design the system, come up with a set of assumptions based on that, check the assumptions as quickly as possible, then refactor your model of the system based on what you find. It's really all about making educated guesses and then checking those; as you gain experience, you start making better guesses.

Re: HN's Daeken will expose security flaw in 4m hotel room keycard locks

#74

Post by daeken » Mon, Jul 23, 2012, 7:23 PM UTC

otoburb wrote: post #72

daeken wrote: post #51

Earlier quoted context omitted.

Haha, it seems we already are doing the AMA here. My stack now is a Lenovo W520 running Ubuntu and KDE, and Sublime Text as my editor. Over the years when I did this, I was running everything from a cheapo, hacked-together box to a 13" Macbook Pro, all running Windows Vista/7.

Do you use Backtrack at all, or do you simply craft/download/build-from-source your own tools as you need them? Also, did you switch from Windows to Linux because of the available tools and development environment, or because the Linux desktop had matured enough you could get sh*t done without worrying about driver compatibility issues or other common complaints about Linux [lap|desk]tops?

I don't use Backtrack or similar tools; the only tools I use that I didn't write myself are IDA Pro and Burp Proxy (if I'm doing websec work).

As for switching OSes, the primary reason I did so is that my work for my day job all requires Linux. In terms of reversing, Windows is really the only way to fly; the tools just aren't there otherwise.

Re: HN's Daeken will expose security flaw in 4m hotel room keycard locks

#75

Post by kylebrown » Mon, Jul 23, 2012, 7:23 PM UTC

What tools do you use for reversing hardware? Did you have to open up the lock and tap into it with something like a logic analyzer? Or was it as simple as creating a DC port adapter so you could read the data from the portable programmer?

Re: HN's Daeken will expose security flaw in 4m hotel room keycard locks

#76

Post by daeken » Mon, Jul 23, 2012, 7:32 PM UTC

kylebrown wrote: post #75

What tools do you use for reversing hardware? Did you have to open up the lock and tap into it with something like a logic analyzer? Or was it as simple as creating a DC port adapter so you could read the data from the portable programmer?

So, reversing it was sort of all over the place. I first had to reverse the front desk system and all that; that was primarily done by sitting between the equipment with a serial proxy and working from there. Once I had a good bit of data captured, I'd write software to emulate being one side or the other. Everything is RS232 and RS485, pretty straightforward.

In terms of reversing the actual lock protocol, that was a bit more tricky. First step was tapping the line between the portable programmer and lock with an o-scope (a 70s-era HP scope; only thing I could afford at the time, haha) to figure out the voltage levels involved and the basic properties of the communication. From there, I hit it with the Saleae Logic to see what the communication actually looked like.

From there, I wrote some Python scripts to walk over the data from the logic analyzer and attempt to decode the data. With some tweaking, I managed to finally see some data that I knew, specifically the site code (which I knew from other parts of the system).

After I knew all that, it was a matter of figuring out the actual hardware level. Given that I have effectively no experience with this level of things, this was a lot of asking questions, googling, and experimenting. I knew that it was a one-wire protocol, so by reading up on other one-wire protocols I managed to figure out a lot. Once that was done, everything just fell into place; making the opening device work initially took maybe a day given all the info I had.

Re: HN's Daeken will expose security flaw in 4m hotel room keycard locks

#77

Post by apawloski » Mon, Jul 23, 2012, 7:33 PM UTC

daeken wrote: post #54

larrys wrote: post #53

Earlier quoted context omitted.

It's fairly easy to change a T-shirt. Whether or not anyone agrees with his appearance or not being relevant, he wasn't photographed in the audience at the conference or up on stage. He posed for a photograph in a hotel. Even if he didn't have a spare shirt, the gift shop in a hotel generally does. That's if he had thought of that issue. No problem with telling the photographer you had to change. Even if they noted t…

I did plan to wear the shirt; I felt it injected a bit of fun into something that, frankly, is scary as hell.

And also, you don't have to be our ambassador. You can wear whatever you'd like -- you don't owe us anything.

Re: HN's Daeken will expose security flaw in 4m hotel room keycard locks

#78

Post by stcredzero » Mon, Jul 23, 2012, 7:36 PM UTC

> HN's Daeken will expose

You have my attention...

> security flaw in 4m

sounding really interesting...

> hotel room keycard locks.

Oh. Well, still pretty cool.

EDIT: Actually, this kid of thing needs to get a lot more attention and awareness. I could suggest a certification of some kind, but there's often a reaction against that. But a certification that just indicated:

    - No passwords in plaintext
    - Not vulnerable to replay attacks
    - No "toy" encryption

Would be of great benefit in today's world.

Re: HN's Daeken will expose security flaw in 4m hotel room keycard locks

#79

Post by cchurch » Mon, Jul 23, 2012, 7:41 PM UTC

mpakes wrote: post #24

daeken wrote: post #4

I'm planning on doing a Reddit AMA for reversing in general -- as well as this work -- in the next hour or two, but if anyone has any questions I'll do my best to answer here. All I ask is no protocol details (paper and full code will be out tomorrow immediately following my talk) and no legal questions. Go wild. Edit: Since this thread has blown up a bit, we may as well just do it here for real. If you have any reve…

Was it necessary to wear a t-shirt that reads "It's fun to use learning for evil!" in the photo shoot for a Forbes spread? This doesn't help the negative perception of the word "hacker". :-/ All due respect to the work you're doing – I'm a former member of the security industry myself (worked on the IPS engine at TippingPoint).

I didn't even notice the text on the shirt underneath his greasy, unwashed hair.

Re: HN's Daeken will expose security flaw in 4m hotel room keycard locks

#80

Post by javajosh » Mon, Jul 23, 2012, 7:41 PM UTC

daeken wrote: post #44

javajosh wrote: post #41

I was always curious about elock systems, particularly about how they are reprogrammed. Presumably they are reprogrammed by the front desk, centrally, but how does the signal reach the lock? Presumably there must be wires attached (at least for power). So why is there an external port on the lock at all? Also, what is the possibility that a lock exploit could affect the central reprogramming system? Edit: just read b…

The locks are programmed by the front desk, but then the data is transferred to the Portable Programmer which then is used to update the doors. The doors themselves are not connected to power, but are rather completely battery-driven. The likelihood of anything impacting the front desk equipment is effectively nil. (Note: This is all specific to Onity locks)

I'm surprised that's how they are designed. How often do the batteries need replacement? (I realize that this isn't exactly related to your hack, but I'm finding myself fascinated by the economics of maintaining lots of locks. It reminds me of the problem of early computers having to replace vacuum tubes at a certain rate, limiting the size of the machine).

Also, is it the housekeeping staff that reprograms the lock after they clean the room? It seems like it would be very inefficient to send a special person around to reprogram the lock after every check out.