Certain Android phones can be used to open 3 million hotel rooms in 161 countries

Certain Android phones can be used to open 3 million hotel rooms in 161 countries،

In 2022 Las Vegas, during a private event, researchers were invited to hack into a Las Vegas hotel room and, in addition to seeing if they could bypass the digital lock, they attempted to find vulnerabilities in other gadgets present in the room. A group of researchers focused on opening the hotel room door. Now, in 2024, it turns out that a method has been discovered that would allow people with an Android phone to open millions of hotel rooms around the world in just a few seconds.

According to Wireda team of security researchers reveals a hotel card hack they call Unsaflok. This vulnerability affects Saflok RFID electronic locks manufactured by a company called Dormakaba. The hack can be used to unlock over three million hotel rooms found in over 13,000 properties located in 161 countries. The researchers took advantage of flaws in Dormakaba's encryption and its RFID system.

The process works like this. Hackers obtain a key card for any room in the target hotel. This can be done by reserving a room or swiping a used room. Using an RFID writer-reader (which can cost $300), a code is read from the card and two key cards are created. When both cards are tapped on the lock, the first one rewrites part of the lock's data and the second one opens the door.

From left to right, the Saflok MT and Saflok RT Plus are the two most impacted locks. Some Android phones can be used to open 3 million hotel rooms in 161 countries.

From left to right, the Saflok MT and Saflok RT Plus locks are the two most impacted locks

However, if you have a android phone which supports near field communication (NFC), both key cards can be replaced with the android phone. Download a signal-emitting app and the phone can be used to emit a signal that will be used in place of the two key cards to unlock the door.

In 2012, at the Black Hat conference in Vegas, a hacker described a hack that could exploit a vulnerability found in 10 million locks made by a company called Onity. The latter refused to pay for updating the locks, leaving it to the hotels to make any possible modifications. This was a bad decision, as criminals began using this exploit to break into hotel rooms and steal from guests.

This time, the Unsaflok team decided not to reveal their entire hack to the public. Hacker Ian Carroll said: “We're trying to strike a balance by helping Dormakaba resolve the issue quickly, but also informing guests about it. If someone else reverse engineers it today and starts exploiting it before people realize it, it could be an even bigger problem.

Dormakaba told Wired: “We have worked closely with our partners to identify and implement an immediate mitigation of this vulnerability, as well as a longer-term solution. Our customers and partners all take security very seriously and we are confident that all reasonable measures will be taken. taken to address this issue responsibly.