Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hilton Hotel Guests Will Be Able to Use Smartphones as Keys or to Choose Rooms

online.wsj.com

Post reply on HN
Print view View original

11–17 of 17 posts

Re: Hilton Hotel Guests Will Be Able to Use Smartphones as Keys or to Choose Rooms

#11

Post by superuser2 »

wwwwwwwwww wrote: post #6

I look forward to reading the breakdown on how bad the security for this system ends up being. I can see it now - each lock would be connected to the hotel's wpa-wps network (shared with the guests of course) and use a dhcp server without static routes to assign IP addresses. Maybe if we're really lucky they'll be using some consumer-grade cisco switch with last year's firmware update. Snark aside, they have to be _r…

My favorite attack on hotel security is much simpler: the front desk will willingly print you a key for any room.

Hold out your keycard and ask for a duplicate. Do they take your card and swipe it? No. They ask for your room number, type it into the magstripe machine, and print you a key for whatever room number you just gave.

No electronics, skill, or even malicious intent necessary (you just "forgot" your actual room number). Look and act like you belong, and make a run-of-the-mill request. Discovered this by accident when I was ~12 and wanted to go to the pool by myself. Never actually tried to get a card for another room, but never had the desk actually verify my rights to the room when requesting an extra keycard either.

Re: Hilton Hotel Guests Will Be Able to Use Smartphones as Keys or to Choose Rooms

#12

Post by crdoconnor »

wwwwwwwwww wrote: post #6

I look forward to reading the breakdown on how bad the security for this system ends up being. I can see it now - each lock would be connected to the hotel's wpa-wps network (shared with the guests of course) and use a dhcp server without static routes to assign IP addresses. Maybe if we're really lucky they'll be using some consumer-grade cisco switch with last year's firmware update. Snark aside, they have to be _r…

I imagine they'll use NFC not wifi. I don't think it would be hard at all to make it more secure than existing key cards.

Re: Hilton Hotel Guests Will Be Able to Use Smartphones as Keys or to Choose Rooms

#13

Post by ben1040 »

crdoconnor wrote: post #12
wwwwwwwwww wrote: post #6

I look forward to reading the breakdown on how bad the security for this system ends up being. I can see it now - each lock would be connected to the hotel's wpa-wps network (shared with the guests of course) and use a dhcp server without static routes to assign IP addresses. Maybe if we're really lucky they'll be using some consumer-grade cisco switch with last year's firmware update. Snark aside, they have to be _r…

I imagine they'll use NFC not wifi. I don't think it would be hard at all to make it more secure than existing key cards.

I stayed at a Hilton property maybe a month or two ago and they already had converted the door locks over to use NFC. The room keys were your typical keycard size, except they had no magstripe and there was an NFC tag embedded within the card.

I assume the next step would be for them to deploy a phone app which emulated the NFC tag.

Re: Hilton Hotel Guests Will Be Able to Use Smartphones as Keys or to Choose Rooms

#15

Post by Chronic29 »

superuser2 wrote: post #11
wwwwwwwwww wrote: post #6

I look forward to reading the breakdown on how bad the security for this system ends up being. I can see it now - each lock would be connected to the hotel's wpa-wps network (shared with the guests of course) and use a dhcp server without static routes to assign IP addresses. Maybe if we're really lucky they'll be using some consumer-grade cisco switch with last year's firmware update. Snark aside, they have to be _r…

My favorite attack on hotel security is much simpler: the front desk will willingly print you a key for any room. Hold out your keycard and ask for a duplicate. Do they take your card and swipe it? No. They ask for your room number, type it into the magstripe machine, and print you a key for whatever room number you just gave. No electronics, skill, or even malicious intent necessary (you just "forgot" your actual ro…

Now a days they ask for the last name on the room.

Re: Hilton Hotel Guests Will Be Able to Use Smartphones as Keys or to Choose Rooms

#16

Post by cafard »

superuser2 wrote: post #11
wwwwwwwwww wrote: post #6

I look forward to reading the breakdown on how bad the security for this system ends up being. I can see it now - each lock would be connected to the hotel's wpa-wps network (shared with the guests of course) and use a dhcp server without static routes to assign IP addresses. Maybe if we're really lucky they'll be using some consumer-grade cisco switch with last year's firmware update. Snark aside, they have to be _r…

My favorite attack on hotel security is much simpler: the front desk will willingly print you a key for any room. Hold out your keycard and ask for a duplicate. Do they take your card and swipe it? No. They ask for your room number, type it into the magstripe machine, and print you a key for whatever room number you just gave. No electronics, skill, or even malicious intent necessary (you just "forgot" your actual ro…

Maybe if you're 12. This spring I had to present my ID to get a replacement for a dead key in Philadelphia.

Re: Hilton Hotel Guests Will Be Able to Use Smartphones as Keys or to Choose Rooms

#17

Post by superuser2 »

cafard wrote: post #16
superuser2 wrote: post #11

Earlier quoted context omitted.

My favorite attack on hotel security is much simpler: the front desk will willingly print you a key for any room. Hold out your keycard and ask for a duplicate. Do they take your card and swipe it? No. They ask for your room number, type it into the magstripe machine, and print you a key for whatever room number you just gave. No electronics, skill, or even malicious intent necessary (you just "forgot" your actual ro…

Maybe if you're 12. This spring I had to present my ID to get a replacement for a dead key in Philadelphia.

No it still works. I mostly travel in the Midwest, though, so maybe security standards are just a little lower in Lawrence, KS than the big cities.
Post reply on HN