Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HN's Daeken will expose security flaw in 4m hotel room keycard locks

forbes.com

Post reply on HN
Print view View original

91–100 of 144 posts

Re: HN's Daeken will expose security flaw in 4m hotel room keycard locks

#91

Post by st3fan »

m0nastic wrote: post #88
st3fan wrote: post #69

I think that making this public is not a very good example of responsible disclosure and I hope there will be a lawsuit before the presentation to prevent the details from being exposed. I am all about exposing vulnerabilities but I honestly think there needs to be a dialog with the vendor first. Specially for exploits like this where there is a lot at stake. I find the excuse of 'there is nothing they can do anyway'…

This argument has been going around for as long as I can remember, and I think it's incredibly harmful to researchers (whether they be security or other). Upon discovering the vulnerability, the only real action he could take which would be universally considered unacceptable would be to use that research to go around breaking into hotel rooms (which is illegal). If he decided to go into business selling devices to b…

I'm not saying he should not publish this at all. I just think it will be more responsible to try to work with the vendor. Right now he has not even made that effort.

Re: HN's Daeken will expose security flaw in 4m hotel room keycard locks

#93

Post by davidw »

daeken wrote: post #66
larrys wrote: post #65

Earlier quoted context omitted.

"did plan" The most important thing was that you gave it thought in advance! That is good. You had your reason for wearing the shirt it might not be the same decisions others would have made but the decision is yours to make based on what you were trying to achieve. By "scary" did you mean the media attention?

I mean the vulnerabilities. While my exploit has issues (which, as far as I can tell, are issues with timing when reading data from the lock; I lose the first bit of every byte) it's only a matter of time before someone fixes that and has these rolling off the assembly line. All you need is a microcontroller, a resistor, and a connector; that scares me.

http://xkcd.com/538/ is sort of relevant, no?

Re: HN's Daeken will expose security flaw in 4m hotel room keycard locks

#94

Post by nowarninglabel »

akamaka wrote: post #16
daeken wrote: post #12

Earlier quoted context omitted.

Given the simplicity of the vulnerabilities (as mentioned in the article, you have full and unauthenticated memory access) and the length of time -- over a decade -- that these locks have been on the market, there is absolutely no doubt that they knew about this. Given that, I felt that they would delay, delay, delay, and delay some more before finally going silent, at which point I would be forced to do this anyway.…

That's a completly bogus excuse. The question wasn't why you're releasing it publicly, but why you haven't made any attempt to contact the company beforehand, which you seem to have had a year to do. Edit: The only reasons I can think of are laziness or just plain not giving a shit about responsible disclosure.

There is the possibility of being dragged through a lawsuit, and/or the company one works through being dragged through a lawsuit. I don't know if that is applicable here, but I have been involved in a responsible disclosure where I gave the information to a colleague, who then disclosed to the company, and the company then sent a letter threatening a lawsuit, whereas my colleague nearly got fired (the fact that he didn't was the one time I can remember the union stepping up to do something useful by defending him). Whether or not such lawsuits would hold merit, they'd be expensive for all involved, and lots of listed companies are more than happy to put the lawyers on you for invalid reasons.

Re: HN's Daeken will expose security flaw in 4m hotel room keycard locks

#96

Post by peterwwillis »

tptacek wrote: post #42
huhtenberg wrote: post #38

Earlier quoted context omitted.

C'mon. It's well under a dollar. And that's a 10 second idea, I'm sure there are other options. (edit) That's not even considering that this cost can be carried by the hotels. I'm sure they can cough up $500 to secure their facilities. -- Please don't tell me that you, of all people on HN, think that there's no need for a private disclosure on this guy's part?

It's way more than a dollar. How many locks could one technician replace/fix in an hour, and what's their hourly rate? "Me of all people"? Am I a spokesperson for "Responsible disclosure" now? I would have notified the vendor ASAP, and I might not have put the vendor name into the talk at all. But that's me, and I am super conservative about this stuff. Lots of very reputable security people would do exactly what Cod…

For clarification: lots of "very reputable security people" can also be total dicks. Hacker elitism does not encourage thoughtfulness.

Re: HN's Daeken will expose security flaw in 4m hotel room keycard locks

#98

Post by cjy »

ChuckMcM wrote: post #61
daeken wrote: post #54

Earlier quoted context omitted.

I did plan to wear the shirt; I felt it injected a bit of fun into something that, frankly, is scary as hell.

Forgive me if I'm just naive but I don't get the 'scary' part. Locks have always been 'advisory' and people who have wanted to circumvent them for both good and evil rate them by their 'time to disable'. Hotel locks with hard keys had their issues as well, and were pretty trivially picked with simple tools. But the key is always that you need to bring the 'simple tools' which is to say that they aren't vulnerable in…

It should be noted that [some] hotel doors with electronic key cards also have physical key holes (as a backup) that are hidden, but are still susceptible to being picked.

This just supports your point that hotel doors are not 100% secure for anyone who really wants to get through.

Edit: Replaced all with some. The doors at the hotels I worked had backup physical keys in case the battery failed. It's cool that Onity locks can be powered externally if the battery fails. Thanks for the correction.

Re: HN's Daeken will expose security flaw in 4m hotel room keycard locks

#99

Post by guscost »

mpakes wrote: post #48
tptacek wrote: post #29

Earlier quoted context omitted.

You don't think this is a little nitpicky? He's at the "Black Hat Briefings".

Fair enough, and that's why I attempted to tone down the message with my statement of respect. I've followed Cody's work with interest for years. I do stand by my general point, though. I think it's worth thinking about how we represent ourselves to the general public. The word "Hacker" has an unfortunate negative reputation, and I don't think messages like this help. It really jumped out at me when I opened the arti…

I can see a reasonable point that it feeds into the stereotype of the programmer-misanthrope.

Re: HN's Daeken will expose security flaw in 4m hotel room keycard locks

#100

Post by javajosh »

daeken wrote: post #84
javajosh wrote: post #80

Earlier quoted context omitted.

I'm surprised that's how they are designed. How often do the batteries need replacement? (I realize that this isn't exactly related to your hack, but I'm finding myself fascinated by the economics of maintaining lots of locks. It reminds me of the problem of early computers having to replace vacuum tubes at a certain rate, limiting the size of the machine). Also, is it the housekeeping staff that reprograms the lock…

The battery lifetime depends on how much traffic the door gets, but generally I believe it's 4-6 months, which is pretty impressive for 4 AAs. As for reprogramming the doors, that only happens very rarely. The cards have an expiration date and a code that cycles, meaning that when a new card is introduced, the old ones won't work anymore. So really it only needs to be reprogrammed when the clock gets out of sync or t…

>The cards have an expiration date and a code that cycles, meaning that when a new card is introduced, the old ones won't work anymore.

How interesting. Does that mean that you could theoretically have access to an empty room if there's no new occupant? It seems like you need some sort of expiry to prevent that from happening, but I can't imagine how that would work without some signal passing between the front desk and the lock.

Post reply on HN