What’s more, the key need not be currently active: even an expired key from a stay five years ago will work.Īn attacker will read the key and use a small hardware device to derive more keys to the facility. Literally any key will suffice, be it a room key or a key to a storage closet or garage. He worked side by side with F-Secure’s Timo Hirvonen, Senior Security Consultant, to devise a way to exploit the software system, known as Vision by VingCard.įirst an attacker needs to get access to an electronic key to the target facility. “You can imagine what a malicious person could do with the power to enter any hotel room, with a master key created basically out of thin air,” says Tomi Tuominen, Practice Leader at F-Secure Cyber Security Services. Their target: a high caliber brand of lock known for quality and security. Finally, after more than a decade and thousands of hours of on-and-off research as a side project, they’ve figured out how to do exactly that. They decided to investigate whether it’s possible to enter a locked hotel room without the key…and completely without a trace. But without a single indication of unauthorized room access (nothing physical and nothing in the software logs), the staff dismissed the complaint. Intriguingly, there were no signs of forced entry. The laptop of a fellow researcher was stolen from a locked hotel room while they were out. Years ago, two of our ethical hackers attended an infosec conference in Berlin. Ghost in the locks, Tomi Tuominen, Timo Hirvonen, INFILTRATE 2018 from Immunity Videos on Vimeo. The discovery affects millions of locks in tens of thousands of hotels around the world, including locations run by well-known international chains. It sounds scary, but that’s the scenario F-Secure researchers discovered when they investigated a widely deployed hospitality lock system made by the world’s largest lock manufacturer, Assa Abloy. The more reputable the hotel brand and the better the location, the more secure we feel.īut what if you found out the lock system that secures your $400-a-night hotel room is vulnerable and can be hacked? What if an attacker could not only access your room, but every room in the building? Along with knowing whether the hotel has room service, air conditioning, or free Wi-Fi, we want to know that we – and our belongings – will be safe for the duration of our stay. When most people rent a hotel room, security is one of the factors they take into consideration.

Timo hirvonen f secure