Hacker News Reader

Comment by iancarroll | Hacker News Reader

I worked on this research along with many others, happy to answer any questions! Our disclosure is also available at https://unsaflok.com.

View on HN

When do you plan to release technical details on the attack? Surely the long tail of door locks will not be replaced for a decade or more.

How did Saflok respond? Were they collaborative or did they try to threaten you / suppress the information?

They have been taking it seriously although they didn’t have any sort of formal bug bounty / security disclosure method at the time. The disclosure timeline is in our article as well!

Did you set out to find a vulnerability or just stumble on it?

If setting out to find a vulnerability, how do you get started?

What is the “open ide, write print(“hello world”)” for this kind of work?

The article explains that they were at a hackathon of sorts, where these 2 were specifically targeting the locks/passes.

I would assume reading the cards with a reader would be a great start.

This part caught my eye:

"Note that this information only applies to dormakaba Saflok systems; several other lock manufacturers use MIFARE Classic keycards and are not affected by the Unsaflok vulnerability"

So it is likely they way that Saflok implemented MIFARE Classic. Will start to read about this protocol more.

At this point, MIFARE Classic can pretty much be considered plaintext.

There are very fast card-only cloning attacks against even the newest "hardened" cards, and in many of these lock systems (no idea about Saflok in particular though), MIFARE is the only layer of cryptography, and the card only contains a bitmask of locks/doors that it should be able to open.

I have an original London Underground Oyster Card which still works fine! It's MIFARE Classic according to Wikipedia, and do often wonder when TfL will cancel them.

They'll probably keep it around either indefinitely, or will replace it with a fully account-based scheme where there's nothing stored on the card itself (i.e. no stored-value balance) other than an authentication key for the card number.

That's the model they already use for bank (credit and debit) cards too, so they need the backend to manage a deferred account-based system anyway. That's also what the MTA in New York does: They've never supported stored-value cards, and their new physical OMNY cards are effectively just a weird type of closed-loop EMV payment card.

>There are very fast card-only cloning attacks against even the newest "hardened" cards

Do you mean for MIFARE Classic or for all RFID cards? I was not aware of any cloning attacks for types such as HID Seos.

If I stay at a hotel with such a lock how can I tell it's affected? If the hotel hasn't patched it can I patch my rooms door myself without causing issues to the hotel?

I think it's in the bottom of the article

You can generally assume at any hotel with keycards, that any other guest who wants to can get into your room.

The only question is whether they do some hacker shit, or whether they just go to reception and say "My keycard isn't working, I'm in room 123" and reception gives them a new keycard for room 123, with no ID check and no questions asked.

Luckily thieves are relatively rare and 97% of hotel rooms just contain a suitcase of second-hand clothes.

I locked myself out of the room on several occastions, and at the very least they ask for your name and double check in the system. It's not as easy as you describe.

A little social engineering would sort that out

Perhaps you're staying at better hotels than I am?

In my experience, keycards fail so often that the hotel workers don't bat an eyelid when you say your card has failed, they just make you a new one.

I have often either locked myself out of a hotel room or demagnetized my key. I have never been asked my name or been verified in any way (different clerk than the one I checked in with, etc).

While I'm sure some hotels (maybe more upscale ones?) do verification, it is far from universal in the USA.

I was traveling a lot for work at one point, and I decided to test this out. I would ask for a new key at every hotel I stayed at, and make a point to not tell them my name unless they asked. They almost never did.

Names are not generally considered secret. It will be relatively easy for someone to social engineer the name for a room either with the desk or with you (calling the room).

Similar to the wrench principle. [1]

[1] https://xkcd.com/538/

Our disclosure mentions how to try and detect a vulnerable hotel, but it’s not possible to patch the lock yourself.

As an owner, these companies are scumbags. You have to deal with salesmen whose only job is to sell these at maximum price.

Thanks for doing this. Hopefully, you guys expose all other lock companies.

Reply on news.ycombinator.com