Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HN's Daeken will expose security flaw in 4m hotel room keycard locks

forbes.com

Post reply on HN
Print view View original

31–40 of 144 posts

Re: HN's Daeken will expose security flaw in 4m hotel room keycard locks

#31

Post by dos1 »

Kadin wrote: post #21
akamaka wrote: post #16

Earlier quoted context omitted.

That's a completly bogus excuse. The question wasn't why you're releasing it publicly, but why you haven't made any attempt to contact the company beforehand, which you seem to have had a year to do. Edit: The only reasons I can think of are laziness or just plain not giving a shit about responsible disclosure.

In order so that they could do ... what, exactly? It doesn't sound like there's any mitigation that they could perform. At the very least, the guts of every lock has to be replaced. Given that, the rational, profit-maximizing thing for them to do is to stonewall, misdirect, bring out the lawyers, shoot the messenger, and generally continue to sell as many flawed locks as possible. We've all seen vendors do that in th…

But imagine, if he had told them a year ago, perhaps the locks would be mostly replaced with a fixed version by now! I think it's unbelievable that he wouldn't disclose this information because he "just knows" they wouldn't do anything. He's not a damn mind reader. Hell, he might even be right, but you've still got to give the company the chance.

Re: HN's Daeken will expose security flaw in 4m hotel room keycard locks

#32

Post by daeken »

endianswap wrote: post #30
webjprgm wrote: post #22

Is the obvious fix to make the programming port available only from the inside of the room? That's where the screws for physical bolt locks go. And you can still have a DC power port on the outside in case of a powered-down door, just no programming access. Why have they not done it that way???

Probably because if the system glitches out and they can't into the room anymore (even with maintenance keys) then they wouldn't ever be able to fix it?

Well, you can always drill the lock cylinder out, but that's a destructive process. It is possible to do this sort of thing in the right way, they just didn't.

Re: HN's Daeken will expose security flaw in 4m hotel room keycard locks

#33

Post by tptacek »

huhtenberg wrote: post #27
Kadin wrote: post #21

Earlier quoted context omitted.

In order so that they could do ... what, exactly? It doesn't sound like there's any mitigation that they could perform. At the very least, the guts of every lock has to be replaced. Given that, the rational, profit-maximizing thing for them to do is to stonewall, misdirect, bring out the lawyers, shoot the messenger, and generally continue to sell as many flawed locks as possible. We've all seen vendors do that in th…

> what, exactly? They could plug the access holes, with custom pentalobe screws. That's an under a dollar per lock fix.

So, that's more than a million dollars more than NYSE:UTX's gross profits for the last quarter, and ~1/4 of their gross revenue over the same quarter. No, I don't think they were going to do that.

Re: HN's Daeken will expose security flaw in 4m hotel room keycard locks

#34

Post by rcfox »

daeken wrote: post #32
endianswap wrote: post #30

Earlier quoted context omitted.

Probably because if the system glitches out and they can't into the room anymore (even with maintenance keys) then they wouldn't ever be able to fix it?

Well, you can always drill the lock cylinder out, but that's a destructive process. It is possible to do this sort of thing in the right way, they just didn't.

What happens to the lock when the battery dies/the power goes out?

Re: HN's Daeken will expose security flaw in 4m hotel room keycard locks

#35

Post by paulgb »

daeken wrote: post #4

I'm planning on doing a Reddit AMA for reversing in general -- as well as this work -- in the next hour or two, but if anyone has any questions I'll do my best to answer here. All I ask is no protocol details (paper and full code will be out tomorrow immediately following my talk) and no legal questions. Go wild. Edit: Since this thread has blown up a bit, we may as well just do it here for real. If you have any reve…

> But on three Onity locks installed on real hotel doors he and I tested at well-known independent and franchise hotels in New York, results were much more mixed

This is a long shot, but I was in a chain hotel in midtown recently and heard someone tampering with the lock, and found the door ajar in the morning. I realize you probably can't name specific hotels, but was one by any chance a chain hotel in midtown around the 11th?

Re: HN's Daeken will expose security flaw in 4m hotel room keycard locks

#36

Post by ulope »

Interesting, but it's not as if hotels in general have been high security installations.

Very easy experiment: Just go to the front desk an thell them that you sadly seem to have lost your room card. 90% of the time they will just ask for your room number without requiring any kind of proof that it's actually your room.

Re: HN's Daeken will expose security flaw in 4m hotel room keycard locks

#37

Post by daeken »

rcfox wrote: post #34
daeken wrote: post #32

Earlier quoted context omitted.

Well, you can always drill the lock cylinder out, but that's a destructive process. It is possible to do this sort of thing in the right way, they just didn't.

What happens to the lock when the battery dies/the power goes out?

Once the batteries go out (they're not powered on guest room doors), the lock won't open to keycards anymore. The batteries, though, are on the front of the door just below the handle (see the panel at the bottom, in the story photo) and can be replaced from the outside. Otherwise, it's possible to use the portable programmer's open function to open the lock, if the batteries in the PP are full enough; that's really iffy and has a tendency to not work, though.

Re: HN's Daeken will expose security flaw in 4m hotel room keycard locks

#38

Post by huhtenberg »

tptacek wrote: post #33
huhtenberg wrote: post #27

Earlier quoted context omitted.

> what, exactly? They could plug the access holes, with custom pentalobe screws. That's an under a dollar per lock fix.

So, that's more than a million dollars more than NYSE:UTX's gross profits for the last quarter, and ~1/4 of their gross revenue over the same quarter. No, I don't think they were going to do that.

C'mon. It's well under a dollar. And that's a 10 second idea, I'm sure there are other options.

(edit) That's not even considering that this cost can be carried by the hotels. I'm sure they can cough up $500 to secure their facilities.

--

Please don't tell me that you, of all people on HN, think that there's no need for a private disclosure on this guy's part?

Re: HN's Daeken will expose security flaw in 4m hotel room keycard locks

#39

Post by DanBC »

shimon_e wrote: post #13
daeken wrote: post #9

Earlier quoted context omitted.

Regardless of which hotel you're in and what locks they use, always use the physical security mechanisms provides, e.g. door chains. Deadbolts are engaged by the lock mechanism and will be retracted by, say, maintenance key cards. While this definitely opens up new bad things, the message is the same: don't trust the software, trust the physical. Then again, after doing this for a few years, I may be a bit on the par…

Little hard to lock the door with door chains while you're not in the room. Hotel occupancy is a lot lower on the weekend. I'm sure many people living in hotel rooms with more belonging than can fit in the safe will appreciated this information being released on a weekend.

Hotel safes in rooms are notoriously insecure.

Re: HN's Daeken will expose security flaw in 4m hotel room keycard locks

#40

Post by daeken »

paulgb wrote: post #35
daeken wrote: post #4

I'm planning on doing a Reddit AMA for reversing in general -- as well as this work -- in the next hour or two, but if anyone has any questions I'll do my best to answer here. All I ask is no protocol details (paper and full code will be out tomorrow immediately following my talk) and no legal questions. Go wild. Edit: Since this thread has blown up a bit, we may as well just do it here for real. If you have any reve…

> But on three Onity locks installed on real hotel doors he and I tested at well-known independent and franchise hotels in New York, results were much more mixed This is a long shot, but I was in a chain hotel in midtown recently and heard someone tampering with the lock, and found the door ajar in the morning. I realize you probably can't name specific hotels, but was one by any chance a chain hotel in midtown aroun…

Nope, I was in Europe at the time; we did the photoshoot late last month, though I can't recall when.
Post reply on HN