Certain Android phones can be used to open 3 million hotel rooms in 161 countries،
The process works like this. Hackers obtain a key card for any room in the target hotel. This can be done by reserving a room or swiping a used room. Using an RFID writer-reader (which can cost $300), a code is read from the card and two key cards are created. When both cards are tapped on the lock, the first one rewrites part of the lock's data and the second one opens the door.
From left to right, the Saflok MT and Saflok RT Plus locks are the two most impacted locks
However, if you have a android phone which supports near field communication (NFC), both key cards can be replaced with the android phone. Download a signal-emitting app and the phone can be used to emit a signal that will be used in place of the two key cards to unlock the door.
In 2012, at the Black Hat conference in Vegas, a hacker described a hack that could exploit a vulnerability found in 10 million locks made by a company called Onity. The latter refused to pay for updating the locks, leaving it to the hotels to make any possible modifications. This was a bad decision, as criminals began using this exploit to break into hotel rooms and steal from guests.
This time, the Unsaflok team decided not to reveal their entire hack to the public. Hacker Ian Carroll said: “We're trying to strike a balance by helping Dormakaba resolve the issue quickly, but also informing guests about it. If someone else reverse engineers it today and starts exploiting it before people realize it, it could be an even bigger problem.
Dormakaba told Wired: “We have worked closely with our partners to identify and implement an immediate mitigation of this vulnerability, as well as a longer-term solution. Our customers and partners all take security very seriously and we are confident that all reasonable measures will be taken. taken to address this issue responsibly.