[ISN] Hacker Will Expose Potential Security Flaw In Four Million Hotel Room Keycard Locks

http://www.forbes.com/sites/andygreenberg/2012/07/23/hacker-will-expose-potential-security-flaw-in-more-than-four-million-hotel-room-keycard-locks/

By Andy Greenberg
Forbes.com
7/23/2012

The next time you stay in a hotel room, run your fingers under the 
keycard lock outside your door. If you find a DC power port there, take 
note: With a few hacker tricks and a handful of cheap hardware, that 
tiny round hole might offer access to your room just as completely as 
your keycard.

At the Black Hat security conference Tuesday evening, a Mozilla software 
developer and 24-year old security researcher named Cody Brocious plans 
to present a pair of vulnerabilities he’s discovered in hotel room locks 
from the manufacturer Onity, whose devices are installed on the doors of 
between four and five million hotel rooms around the world according to 
the company’s figures. Using an open-source hardware gadget Brocious 
built for less than $50, he can insert a plug into that DC port and 
sometimes, albeit unreliably, open the lock in a matter of seconds. “I 
plug it in, power it up, and the lock opens,” he says simply.

In fact, Brocious’s break-in trick isn’t quite so straightforward. 
Testing a standard Onity lock he ordered online, he’s able to easily 
bypass the card reader and trigger the opening mechanism every time. But 
on three Onity locks installed on real hotel doors he and I tested at 
well-known independent and franchise hotels in New York, results were 
much more mixed: Only one of the three opened, and even that one only 
worked on the second try, with Brocious taking a break to tweak his 
software between tests.

Even with an unreliable method, however, Brocious’s work–and his ability 
to open one out of the three doors we tested without a key–suggests real 
flaws in Onity’s security architecture. And Brocious says he plans to 
release all his research in a paper as well as source code through his 
website following his talk, potentially enabling others to perfect his 
methods.

[...]


--
Learn how to be a Pen Tester, CISSP, ISSMP, or ISSAP with Expanding Security online.
Come to a free class and see how good and fun the program really is.
http://www.expandingsecurity.com/PainPill