Category Archives: Hotels

Security Vulnerability in Saflok’s RFID-Based Keycard Locks

Posted on by

It’s pretty devastating:

Today, Ian Carroll, Lennert Wouters, and a team of other security researchers are revealing a hotel keycard hacking technique they call Unsaflok. The technique is a collection of security vulnerabilities that would allow a hacker to almost instantly open several models of Saflok-brand RFID-based keycard locks sold by the Swiss lock maker Dormakaba. The Saflok systems are installed on 3 million doors worldwide, inside 13,000 properties in 131 countries. By exploiting weaknesses in both Dormakaba’s encryption and the underlying RFID system Dormakaba uses, known as MIFARE Classic, Carroll and Wouters have demonstrated just how easily they can open a Saflok keycard lock. Their technique starts with obtaining any keycard from a target hotel—say, by booking a room there or grabbing a keycard out of a box of used ones—then reading a certain code from that card with a $300 RFID read-write device, and finally writing two keycards of their own. When they merely tap those two cards on a lock, the first rewrites a certain piece of the lock’s data, and the second opens it…

Continue reading Security Vulnerability in Saflok’s RFID-Based Keycard Locks→

Hotels Remain a Prime Target for Hackers

Posted on by

Although all industries have felt the strain from COVID-19, the hotel sector has been particularly hard hit. As hotels move to bring occupancy rates up, they should use this time to examine another pressing problem: protecting customer data, which has… Continue reading Hotels Remain a Prime Target for Hackers→

Marriott Was Hacked — Again

Posted on by

Marriott announced another data breach, this one affecting 5.2 million people: At this point, we believe that the following information may have been involved, although not all of this information was present for every guest involved: Contact Details (e.g., name, mailing address, email address, and phone number) Loyalty Account Information (e.g., account number and points balance, but not passwords) Additional… Continue reading Marriott Was Hacked — Again→

Details of an Airbnb Fraud

Posted on by

This is a fascinating article about a bait-and-switch Airbnb fraud. The article focuses on one particular group of scammers and how they operate, using the fact that Airbnb as a company doesn’t do much to combat fraud on its platform. But I am more interested in how the fraudsters essentially hacked the complex sociotechnical system that is Airbnb. The whole… Continue reading Details of an Airbnb Fraud→

Marriott Hack Reported as Chinese State-Sponsored

Posted on by

The New York Times and Reuters are reporting that China was behind the recent hack of Marriott Hotels. Note that this is still uncomfirmed, but interesting if it is true. Reuters: Private investigators looking into the breach have found hacking tools, techniques and procedures previously used in attacks attributed to Chinese hackers, said three sources who were not authorized to… Continue reading Marriott Hack Reported as Chinese State-Sponsored→

Security Vulnerabilities in VingCard Electronic Locks

Posted on by

Researchers have disclosed a massive vulnerability in the VingCard eletronic lock system, used in hotel rooms around the world: With a $300 Proxmark RFID card reading and writing tool, any expired keycard pulled from the trash of a target hotel, and a … Continue reading Security Vulnerabilities in VingCard Electronic Locks→

Security Vulnerabilities in VingCard Electronic Locks

Posted on by

Researchers have disclosed a massive vulnerability in the VingCard eletronic lock system, used in hotel rooms around the world: With a $300 Proxmark RFID card reading and writing tool, any expired keycard pulled from the trash of a target hotel, and a set of cryptographic tricks developed over close to 15 years of on-and-off analysis of the codes Vingcard electronically… Continue reading Security Vulnerabilities in VingCard Electronic Locks→