[prev in list] [next in list] [prev in thread] [next in thread]
List: isn
Subject: [ISN] Hacker Will Expose Potential Security Flaw In Four Million Hotel Room Keycard Locks
From: InfoSec News <alerts () infosecnews ! org>
Date: 2012-07-24 9:03:33
Message-ID: alpine.DEB.2.02.1207240403180.17455 () infosecnews ! org
[Download RAW message or body]
http://www.forbes.com/sites/andygreenberg/2012/07/23/hacker-will-expose-potential-security-flaw-in-more-than-four-million-hotel-room-keycard-locks/
By Andy Greenberg
Forbes.com
7/23/2012
The next time you stay in a hotel room, run your fingers under the
keycard lock outside your door. If you find a DC power port there, take
note: With a few hacker tricks and a handful of cheap hardware, that
tiny round hole might offer access to your room just as completely as
your keycard.
At the Black Hat security conference Tuesday evening, a Mozilla software
developer and 24-year old security researcher named Cody Brocious plans
to present a pair of vulnerabilities he's discovered in hotel room locks
from the manufacturer Onity, whose devices are installed on the doors of
between four and five million hotel rooms around the world according to
the company's figures. Using an open-source hardware gadget Brocious
built for less than $50, he can insert a plug into that DC port and
sometimes, albeit unreliably, open the lock in a matter of seconds. "I
plug it in, power it up, and the lock opens," he says simply.
In fact, Brocious's break-in trick isn't quite so straightforward.
Testing a standard Onity lock he ordered online, he's able to easily
bypass the card reader and trigger the opening mechanism every time. But
on three Onity locks installed on real hotel doors he and I tested at
well-known independent and franchise hotels in New York, results were
much more mixed: Only one of the three opened, and even that one only
worked on the second try, with Brocious taking a break to tweak his
software between tests.
Even with an unreliable method, however, Brocious's work–and his ability
to open one out of the three doors we tested without a key–suggests real
flaws in Onity's security architecture. And Brocious says he plans to
release all his research in a paper as well as source code through his
website following his talk, potentially enabling others to perfect his
methods.
[...]
--
Learn how to be a Pen Tester, CISSP, ISSMP, or ISSAP with Expanding Security online.
Come to a free class and see how good and fun the program really is.
http://www.expandingsecurity.com/PainPill
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic