Posts Tagged ‘HotelLockSecurity’
[DefCon32] Unsaflok: Hacking Millions of Hotel Locks
Lennert Wouters and Ian Carroll, security researchers from KU Leuven and application security experts, respectively, unveil critical vulnerabilities in dormakaba’s Saflok hotel lock system, affecting three million units worldwide. Their presentation details reverse-engineering efforts that enabled them to forge keycards, exposing flaws in the proprietary encryption and key derivation functions. Lennert and Ian also discuss their responsible disclosure process and offer practical advice for hotel guests to verify lock security.
Uncovering Saflok Vulnerabilities
Lennert begins by explaining the Saflok system’s reliance on MIFARE Classic cards, widely used in Las Vegas’s 150,000 hotel rooms. By reverse-engineering the proprietary key derivation and encryption algorithms, Lennert and Ian crafted two forged keycards from a single guest card, capable of unlocking any room and disabling deadbolts. Their findings reveal systemic weaknesses in a decades-old system never previously scrutinized by researchers.
Exploitation Techniques
Ian details the technical approach, which involved analyzing the Saflok’s software and hardware to bypass its protections. Using a low-privilege guest card, they exploited vulnerabilities to generate master keycards, granting unauthorized access. Their demonstration, inspired by prior work on Onity and Vingcard locks, underscores the ease of compromising unpatched systems, posing risks to guest safety and property security.
Responsible Disclosure and Mitigation
The duo responsibly disclosed their findings to dormakaba in September 2022, leading to mitigation efforts, including the adoption of Ultralight C cards and secure element encoders. Lennert discusses challenges in patching millions of locks, noting that legacy encoders may still support vulnerable MIFARE Classic cards. Their work has prompted dormakaba to enhance system security, though full deployment remains ongoing.
Empowering Guest Safety
Concluding, Ian offers practical guidance for hotel guests to check if their room’s lock is patched, such as verifying card types. Their presentation, lauded by peers like Iceman, calls for continued scrutiny of electronic lock systems. By sharing their methodologies, Lennert and Ian empower the cybersecurity community to strengthen hospitality security against emerging threats.