HN's Daeken will expose security flaw in 4m hotel room keycard locks

Re:HN's Daeken will expose security flaw in 4m hotel room ke... by daeken on Monday July 23, 2012 @01:45PM (#4282135)

The locks are programmed by the front desk, but then the data is transferred to the Portable Programmer which then is used to update the doors. The doors themselves are not connected to power, but are rather completely battery-driven. The likelihood of anything impacting the front desk equipment is effectively nil.

(Note: This is all specific to Onity locks)

[ Parent | on HN ]

Re:HN's Daeken will expose security flaw in 4m hotel room ke... by javajosh on Monday July 23, 2012 @03:41PM (#4282691)

I'm surprised that's how they are designed. How often do the batteries need replacement? (I realize that this isn't exactly related to your hack, but I'm finding myself fascinated by the economics of maintaining lots of locks. It reminds me of the problem of early computers having to replace vacuum tubes at a certain rate, limiting the size of the machine).

Also, is it the housekeeping staff that reprograms the lock after they clean the room? It seems like it would be very inefficient to send a special person around to reprogram the lock after every check out.

[ Parent | on HN ]

Re:HN's Daeken will expose security flaw in 4m hotel room ke... by daeken on Monday July 23, 2012 @03:45PM (#4282708)

The battery lifetime depends on how much traffic the door gets, but generally I believe it's 4-6 months, which is pretty impressive for 4 AAs.

As for reprogramming the doors, that only happens very rarely. The cards have an expiration date and a code that cycles, meaning that when a new card is introduced, the old ones won't work anymore. So really it only needs to be reprogrammed when the clock gets out of sync or the batteries die (there's no non-volatile storage, just RAM).

[ Parent | on HN ]

Re:HN's Daeken will expose security flaw in 4m hotel room ke... by mr1976 on Monday July 23, 2012 @04:04PM (#4282805)

hotel IT here: they last for between a year and 18 months and are generally replaced as part of a fixed maintenance cycle (floor by floor over a period of 2 or three months).

[ Parent | on HN ]

Re:HN's Daeken will expose security flaw in 4m hotel room ke... by javajosh on Monday July 23, 2012 @05:07PM (#4283071)

>The cards have an expiration date and a code that cycles, meaning that when a new card is introduced, the old ones won't work anymore.

How interesting. Does that mean that you could theoretically have access to an empty room if there's no new occupant? It seems like you need some sort of expiry to prevent that from happening, but I can't imagine how that would work without some signal passing between the front desk and the lock.

[ Parent | on HN ]

Re:HN's Daeken will expose security flaw in 4m hotel room ke... by daeken on Monday July 23, 2012 @05:12PM (#4283091)

There is an expiration date on the card (the lock keeps time). However, with the crypto vulnerabilities I'm going to be announcing, it's possible to manipulate cards to change the expiration date or increment the code key value (which is what gets cycles); this would allow you to continue using a card indefinitely.

You can't make cards out of nothing, though, so that helps mitigate it.

[ Parent | on HN ]

Re:HN's Daeken will expose security flaw in 4m hotel room ke... by javajosh on Monday July 23, 2012 @08:43PM (#4283767)

Thanks for your (patient) answering of my questions. It's funny how just asking how things work sort of naturally leads to thinking about vulnerabilities, eh? :)

[ Parent | on HN ]

Re:HN's Daeken will expose security flaw in 4m hotel room ke... by javajosh on Monday July 23, 2012 @08:13PM (#4283687)

So they set the card to expire when you plan to check out. But I've extended my stay (and done late check out) and I didn't have to get a new card. Why did my room lock let me back in without getting a new or rewritten card?

[ Parent | on HN ]

Re:HN's Daeken will expose security flaw in 4m hotel room ke... by daeken on Monday July 23, 2012 @08:34PM (#4283738)

I don't know about other systems, but with Onity systems you have to get a new card to extend the expiration date. Of course, it's possible they gave you a card with the incorrect expiration in the first place; happens all the time.

[ Parent | on HN ]