Hacker gains access to 4 million hotel rooms with Arduino microcontroller

[Newsjock]

http://www.extremetech.com/computing/133448-black-hat-hacker-gains-access-to-4-million-hotel-rooms-with-arduino-microcontroller

Bad news: With less than $50 of off-the-shelf hardware and a little bit of programming, it’s possible for a hacker to gain instant, untraceable access to millions of key card-protected hotel rooms.

This hack was demonstrated by Cody Brocious, a Mozilla software developer, at the Black Hat security conference in Las Vegas. At risk are four million hotel rooms secured by Onity programmable key card locks. According to Brocious, who should be scolded for not disclosing the hack to Onity before going public, there is no easy fix: There isn’t a firmware upgrade — if hotels want to secure their guests, every single lock will have to be changed.

The hack in its entirety is detailed on Brocious’s website, but in short: At the base of every Onity lock is a small barrel-type DC power socket (just like on your old-school Nokia phone). This socket is used to charge up the lock’s battery, and to program the lock with a the hotel’s “sitecode” — a 32-bit key that identifies the hotel. By plugging an Arduino microcontroller into the DC socket, Brocious found that he could simply read this 32-bit key out of the lock’s memory. No authentication is required — and the key is stored in the same memory location on every Onity lock.

The best bit: By playing this 32-bit code back to the lock… it opens. According to Brocious, it takes just 200 milliseconds to read the sitecode and open the lock. “I plug it in, power it up, and the lock opens,” Brocious says. His current implementation doesn’t work with every lock, and he doesn’t intend to take his work any further, but his slides and research paper make it very clear that Onity locks, rather ironically, lack even the most basic security.

[dballance]

1. Let the mass robbery of hotel rooms begin /eom

[Junkdrawer]

2. Lock on a lock....

Cover the port.

[backscatter712]

4. For four million hotel rooms?

And most of those hotel rooms are owned by big chains - Holiday Inn, Mariott, etc. who'd have to fix those locks en masse anyways.

At that scale, it'd probably be cheaper just to replace all those locks.

[Junkdrawer]

7. Temp fix until the locks are replaced....

Charge the lock one last time and epoxy the port.

The manufacturer - AT THEIR COST - then replaces the lock.

[backscatter712]

8. That's a short-term fix.

Though if the batteries peter out and the hotel doesn't get a replacement door lock in time, they're gonna have a problem...

[Robb]

3. Locks can be picked. Also: water wet.

[Zalatix]

6. Secret Assassin Man says

there is no such thing as a locked door.

[tawadi]

5. Well that's unsettling. eom