Hackers Found a Way to Open Any of 3 Million Hotel Keycard Locks in Seconds

Paywall

When thousands of security researchers descend on Las Vegas every August for what's come to be known as “hacker summer camp,” the back-to-back Black Hat and Defcon hacker conferences, it's a given that some of them will experiment with hacking the infrastructure of Vegas itself, the city's elaborate array of casino and hospitality technology. But at one private event in 2022, a select group of researchers were actually invited to hack a Vegas hotel room, competing in a suite crowded with their laptops and cans of Red Bull to find digital vulnerabilities in every one of the room's gadgets, from its TV to its bedside VoIP phone.

One team of hackers spent those days focused on the lock on the room's door, perhaps its most sensitive piece of technology of all. Now, more than a year and a half later, they're finally bringing to light the results of that work: a technique they discovered that would allow an intruder to open any of millions of hotel rooms worldwide in seconds, with just two taps.

Today, Ian Carroll, Lennert Wouters, and a team of other security researchers are revealing a hotel keycard hacking technique they call Unsaflok. The technique is a collection of security vulnerabilities that would allow a hacker to almost instantly open several models of Saflok-brand RFID-based keycard locks sold by the Swiss lock maker Dormakaba. The Saflok systems are installed on 3 million doors worldwide, inside 13,000 properties in 131 countries.

By exploiting weaknesses in both Dormakaba's encryption and the underlying RFID system Dormakaba uses, known as MIFARE Classic, Carroll and Wouters have demonstrated just how easily they can open a Saflok keycard lock. Their technique starts with obtaining any keycard from a target hotel—say, by booking a room there or grabbing a keycard out of a box of used ones—then reading a certain code from that card with a $300 RFID read-write device, and finally writing two keycards of their own. When they merely tap those two cards on a lock, the first rewrites a certain piece of the lock's data, and the second opens it.

“Two quick taps and we open the door,” says Wouters, a researcher in the Computer Security and Industrial Cryptography group at the KU Leuven University in Belgium. “And that works on every door in the hotel.”

A video of the researchers demonstrating their lock-hacking technique. (The pattern of lights shown on the lock is redacted at one point at the researchers’ request to avoid revealing a detail of their technique they agreed with Dormakaba not to make public.)Video: Ian Carroll

Wouters and Carroll, an independent security researcher and founder of travel website Seats.aero, shared the full technical details of their hacking technique with Dormakaba in November 2022. Dormakaba says that it's been working since early last year to make hotels that use Saflok aware of their security flaws and to help them fix or replace the vulnerable locks. For many of the Saflok systems sold in the last eight years, there's no hardware replacement necessary for each individual lock. Instead, hotels will only need to update or replace the front desk management system and have a technician carry out a relatively quick reprogramming of each lock, door by door.

Wouters and Carroll say they were nonetheless told by Dormakaba that, as of this month, only 36 percent of installed Safloks have been updated. Given that the locks aren't connected to the internet and some older locks will still need a hardware upgrade, they say the full fix will still likely take months longer to roll out, at the very least. Some older installations may take years.

“We have worked closely with our partners to identify and implement an immediate mitigation for this vulnerability, along with a longer-term solution,” Dormakaba wrote to WIRED in a statement, though it declined to detail what that “immediate mitigation” might be. “Our customers and partners all take security very seriously, and we are confident all reasonable steps will be taken to address this matter in a responsible way.”

The technique to hack Dormakaba's locks that Wouters and Carroll's research group discovered involves two distinct kinds of vulnerabilities: One that allows them to write to its keycards, and one that allows them to know what data to write to the cards to successfully trick a Saflok lock into opening. When they analyzed Saflok keycards, they saw that they use the MIFARE Classic RFID system, which has been known for more than a decade to have vulnerabilities that allow hackers to write to keycards, though the brute-force process can take as long as 20 seconds. They then cracked a part of Dormakaba's own encryption system, its so-called key derivation function, which allowed them to write to its cards far faster. With either of those tricks, the researchers could then copy a Saflok keycard at will, but still not generate one for a different room.

The researchers' more crucial step required them to obtain one of the lock programming devices that Dormakaba distributes to hotels, as well as a copy of its front desk software for managing keycards. By reverse engineering that software, they were able to understand all the data stored on the cards, pulling out a hotel property code as well as a code for each individual room, then create their own values and encrypt them just as Dormakaba's system would, allowing them to spoof a working master key that opens any room on the property. “You can make a card that really looks as if it was created by the software from Dormakaba, essentially,” says Wouters.

And how did Carroll and Wouters obtain Dormakaba's front desk software? “We nicely asked a few people,” Wouters says. “Manufacturers assume that no one will sell their equipment on eBay, and that no one will make a copy of their software, and those assumptions, I think everyone knows, are not really valid.”

Once they'd managed all that reverse engineering work, the final version of their attack could be pulled off with little more than a $300 Proxmark RFID read-write device and a couple of blank RFID cards, an Android phone, or a Flipper Zero radio hacking tool.

The biggest caveat to the hackers' Unsaflok technique is that it still requires that they have a keycard—even an expired one—for a room somewhere in the same hotel as the room they're targeting. That's because each card has a property-specific code they need to read and then duplicate on their spoofed card, as well as a room-specific one.

Once they have that property code, the technique also requires using an RFID read-write device to write two cards—one card that reprograms a target lock as well as the second spoofed card that unlocks it. (An Android phone or a Flipper Zero could also be used to emit one signal after another instead of the two cards, the researchers say.) The researchers hint that the first card allows them to open a target room without guessing its unique identifier in the hotel's system, but declined to say exactly what that first card does. They're holding that element of the technique in confidence to avoid giving too clear a set of instructions to would-be intruders or thieves.

By contrast, one security researcher presented a similar hotel keycard hack that opened locks sold by the firm Onity at the Black Hat conference in 2012 with no such obfuscation, and allowed any hacker to build a device that opened any of Onity's 10 million locks worldwide. When Onity refused to pay for the hardware upgrades necessary to solve the problem and instead put the onus on its customers, the issue remained unfixed in many hotels—and eventually was exploited in at least one hacker's cross-country burglary spree.

Carroll and Wouters say that they're trying to avoid that scenario by taking a more cautious approach, while still warning the public about their technique, given that hundreds of properties will likely remain vulnerable to it even now that Dormakaba has offered its fix. “We're trying to find the middle ground of helping Dormakaba to fix it quickly, but also telling the guests about it," says Carroll. “If someone else reverse engineers this today and starts exploiting it before people are aware, that might be an even bigger problem.”

To that end, Carroll and Wouters point out that hotel guests can recognize the vulnerable locks most often—but not always—by their distinct design: a round RFID reader with a wavy line cutting through it. They suggest that if hotel guests do have a Saflok on their door, they can determine if it's been updated by checking their keycard with the NFC Taginfo app by NXP, available for iOS or Android. If the lock is manufactured by Dormakaba, and that app shows that the keycard is still a MIFARE Classic card, it's likely still vulnerable.

If that's the case, the two researchers say, there's not much to do other than avoid leaving valuables in the room and, when you're inside, bolt the chain on the door. They warn that the deadbolt on the room is also controlled by the keycard lock, so it doesn't provide an extra safeguard. “If someone locks the deadbolt, they’re still not protected,” says Carroll.

Even without a perfect or fully implemented fix, Wouters and Carroll argue, it's better for hotel guests to know the risks than to have a false sense of security. After all, they point out, the Saflok brand has been sold for more than three decades, and may have been vulnerable for much or all of those years. Though Dormakaba says it's not aware of any past use of Wouters and Carroll's technique, the researchers point out that doesn't mean it never happened in secret.

“We think the vulnerability has been there for a long time,” says Wouters. “It's unlikely that we are the first to find this.”

13 comments

Paywall
When thousands of security researchers descend on Las Vegas every August for what's come to be known as “hacker summer camp,” the back-to-back Black Hat and Defcon hacker conferences, it's a given that some of them will experiment with hacking the infrastructure of Vegas itself, the city's elaborate array of casino and hospitality technology. But at one private event in 2022, a select group of researchers were actually invited to hack a Vegas hotel room, competing in a suite crowded with their laptops and cans of Red Bull to find digital vulnerabilities in every one of the room's gadgets, from its TV to its bedside VoIP phone.
One team of hackers spent those days focused on the lock on the room's door, perhaps its most sensitive piece of technology of all. Now, more than a year and a half later, they're finally bringing to light the results of that work: a technique they discovered that would allow an intruder to open any of millions of hotel rooms worldwide in seconds, with just two taps.
Today, Ian Carroll, Lennert Wouters, and a team of other security researchers are revealing a hotel keycard hacking technique they call Unsaflok. The technique is a collection of security vulnerabilities that would allow a hacker to almost instantly open several models of Saflok-brand RFID-based keycard locks sold by the Swiss lock maker Dormakaba. The Saflok systems are installed on 3 million doors worldwide, inside 13,000 properties in 131 countries.
By exploiting weaknesses in both Dormakaba's encryption and the underlying RFID system Dormakaba uses, known as MIFARE Classic, Carroll and Wouters have demonstrated just how easily they can open a Saflok keycard lock. Their technique starts with obtaining any keycard from a target hotel—say, by booking a room there or grabbing a keycard out of a box of used ones—then reading a certain code from that card with a $300 RFID read-write device, and finally writing two keycards of their own. When they merely tap those two cards on a lock, the first rewrites a certain piece of the lock's data, and the second opens it.
“Two quick taps and we open the door,” says Wouters, a researcher in the Computer Security and Industrial Cryptography group at the KU Leuven University in Belgium. “And that works on every door in the hotel.”
A video of the researchers demonstrating their lock-hacking technique. (The pattern of lights shown on the lock is redacted at one point at the researchers’ request to avoid revealing a detail of their technique they agreed with Dormakaba not to make public.)Video: Ian Carroll
Wouters and Carroll, an independent security researcher and founder of travel website Seats.aero, shared the full technical details of their hacking technique with Dormakaba in November 2022. Dormakaba says that it's been working since early last year to make hotels that use Saflok aware of their security flaws and to help them fix or replace the vulnerable locks. For many of the Saflok systems sold in the last eight years, there's no hardware replacement necessary for each individual lock. Instead, hotels will only need to update or replace the front desk management system and have a technician carry out a relatively quick reprogramming of each lock, door by door.
Wouters and Carroll say they were nonetheless told by Dormakaba that, as of this month, only 36 percent of installed Safloks have been updated. Given that the locks aren't connected to the internet and some older locks will still need a hardware upgrade, they say the full fix will still likely take months longer to roll out, at the very least. Some older installations may take years.
“We have worked closely with our partners to identify and implement an immediate mitigation for this vulnerability, along with a longer-term solution,” Dormakaba wrote to WIRED in a statement, though it declined to detail what that “immediate mitigation” might be. “Our customers and partners all take security very seriously, and we are confident all reasonable steps will be taken to address this matter in a responsible way.”
The technique to hack Dormakaba's locks that Wouters and Carroll's research group discovered involves two distinct kinds of vulnerabilities: One that allows them to write to its keycards, and one that allows them to know what data to write to the cards to successfully trick a Saflok lock into opening. When they analyzed Saflok keycards, they saw that they use the MIFARE Classic RFID system, which has been known for more than a decade to have vulnerabilities that allow hackers to write to keycards, though the brute-force process can take as long as 20 seconds. They then cracked a part of Dormakaba's own encryption system, its so-called key derivation function, which allowed them to write to its cards far faster. With either of those tricks, the researchers could then copy a Saflok keycard at will, but still not generate one for a different room.
The researchers' more crucial step required them to obtain one of the lock programming devices that Dormakaba distributes to hotels, as well as a copy of its front desk software for managing keycards. By reverse engineering that software, they were able to understand all the data stored on the cards, pulling out a hotel property code as well as a code for each individual room, then create their own values and encrypt them just as Dormakaba's system would, allowing them to spoof a working master key that opens any room on the property. “You can make a card that really looks as if it was created by the software from Dormakaba, essentially,” says Wouters.
And how did Carroll and Wouters obtain Dormakaba's front desk software? “We nicely asked a few people,” Wouters says. “Manufacturers assume that no one will sell their equipment on eBay, and that no one will make a copy of their software, and those assumptions, I think everyone knows, are not really valid.”
Once they'd managed all that reverse engineering work, the final version of their attack could be pulled off with little more than a $300 Proxmark RFID read-write device and a couple of blank RFID cards, an Android phone, or a Flipper Zero radio hacking tool.
The biggest caveat to the hackers' Unsaflok technique is that it still requires that they have a keycard—even an expired one—for a room somewhere in the same hotel as the room they're targeting. That's because each card has a property-specific code they need to read and then duplicate on their spoofed card, as well as a room-specific one.
Once they have that property code, the technique also requires using an RFID read-write device to write two cards—one card that reprograms a target lock as well as the second spoofed card that unlocks it. (An Android phone or a Flipper Zero could also be used to emit one signal after another instead of the two cards, the researchers say.) The researchers hint that the first card allows them to open a target room without guessing its unique identifier in the hotel's system, but declined to say exactly what that first card does. They're holding that element of the technique in confidence to avoid giving too clear a set of instructions to would-be intruders or thieves.
By contrast, one security researcher presented a similar hotel keycard hack that opened locks sold by the firm Onity at the Black Hat conference in 2012 with no such obfuscation, and allowed any hacker to build a device that opened any of Onity's 10 million locks worldwide. When Onity refused to pay for the hardware upgrades necessary to solve the problem and instead put the onus on its customers, the issue remained unfixed in many hotels—and eventually was exploited in at least one hacker's cross-country burglary spree.
Carroll and Wouters say that they're trying to avoid that scenario by taking a more cautious approach, while still warning the public about their technique, given that hundreds of properties will likely remain vulnerable to it even now that Dormakaba has offered its fix. “We're trying to find the middle ground of helping Dormakaba to fix it quickly, but also telling the guests about it," says Carroll. “If someone else reverse engineers this today and starts exploiting it before people are aware, that might be an even bigger problem.”
To that end, Carroll and Wouters point out that hotel guests can recognize the vulnerable locks most often—but not always—by their distinct design: a round RFID reader with a wavy line cutting through it. They suggest that if hotel guests do have a Saflok on their door, they can determine if it's been updated by checking their keycard with the NFC Taginfo app by NXP, available for iOS or Android. If the lock is manufactured by Dormakaba, and that app shows that the keycard is still a MIFARE Classic card, it's likely still vulnerable.
If that's the case, the two researchers say, there's not much to do other than avoid leaving valuables in the room and, when you're inside, bolt the chain on the door. They warn that the deadbolt on the room is also controlled by the keycard lock, so it doesn't provide an extra safeguard. “If someone locks the deadbolt, they’re still not protected,” says Carroll.
Even without a perfect or fully implemented fix, Wouters and Carroll argue, it's better for hotel guests to know the risks than to have a false sense of security. After all, they point out, the Saflok brand has been sold for more than three decades, and may have been vulnerable for much or all of those years. Though Dormakaba says it's not aware of any past use of Wouters and Carroll's technique, the researchers point out that doesn't mean it never happened in secret.
“We think the vulnerability has been there for a long time,” says Wouters. “It's unlikely that we are the first to find this.”
- RedBull? I can tell the journalist wasn't in the room, everybody knows Club Mate and Jolt Cola are the drinks of hackers ;)
- A $300 RFID read/writer? Seems way too expensive, I remember buying one for under $10 for my Arduino a while back.
  
  They're probably talking about a Proxmark.
- I attended a talk on this at Defcon in… 2009 maybe?
  Are we still talking about this?
From the unsaflok.com site:
Dormakaba uses a Key Derivation Function (KDF) to derive the keys for some of the Saflok MIFARE Classic sectors. This proprietary KDF only uses the card’s Unique IDentifier (UID) as an input.
Knowledge of the KDF allows an attacker to easily read and clone a Saflok MIFARE Classic card. However, the KDF by itself is not sufficient for an attacker to create arbitrary Saflok keycards.
Security is hard. Cryptography is even harder. Don't roll your own algorithms, it's just asking for a problem. And given that "oversight", I'd bet that the rest of the kill chain involves equally bad encryption or hashing being used on the cards.
- I’m curious, for a non-network connected lock, how could you ensure that it’s secured with time bound parameters like they list?
  Now that I’m thinking about it I guess each lock would have a private key and a CMOS of sorts to keep time. The writer could then write have the public key of each room and that could have a timestamp as part of the encrypted payload. I guess to take it further you could reverse it too with that payload having a private key of the writer and the locks could verify the private key against a public key of the writer. At that point each writer would have to have the public key of all locks, and each lock would have the public key of each writer.
  At that point your payload to encode would be a timestamp of expiration and any sort of “checksum” or PSK to verify it was made by a valid writer?
  
  Look up JSON Web Tokens, they work how this would need to work.
In 2011 I was aghast when I learned a popular keycard / biometric system used FTP to pull down its cleartext list of acceptable keys from the server.
The username was something like ADMIN and the password was PASS.
And no, that wasn’t the FTP command; that was the password.
So I’m not surprised that there are still problems with these devices.
edit: more complete thought
- To be fair to manufacturers for once here, this kind of this is usually due to users not properly securing these systems. The industry is still way behind on proper infosec but they've come a long way the last 10 years or so.
Corporate shareholders: is it cheap? Yes? Do I ever stay there? No? tfw I don’t give a fuck lol
Without paywall.
Sick! Would a Chameleon Ultra also work?