HomeRisk ManagementsUnsaflok vulnerability allows hackers to unlock millions of hotel doors - Source:...

Unsaflok vulnerability allows hackers to unlock millions of hotel doors – Source: www.bleepingcomputer.com

Published on

spot_img

Researchers have recently uncovered vulnerabilities in Saflok electronic RFID locks used in various hotels and homes worldwide, affecting approximately 3 million doors across 13,000 properties in 131 countries.

The team of researchers, including Lennert Wouters, Ian Carroll, rqu, BusesCanFly, Sam Curry, shell, and Will Caruana, discovered a series of security flaws in the Saflok locks, which they named “Unsaflok.” These vulnerabilities allow attackers to easily unlock any door in a hotel by forging a pair of keycards. The flaws were brought to light in September 2022 during a private hacking event in Las Vegas, where the researchers were tasked with finding vulnerabilities in a hotel room and its devices.

The researchers informed the manufacturer, Dormakaba, about the uncovered vulnerabilities in November 2022 to allow them to work on mitigations and inform affected hotels without causing widespread panic. However, the researchers cautioned that these vulnerabilities have been present for over three decades, increasing the likelihood of exploitation even though there have been no confirmed incidents of misuse thus far.

The Unsaflok vulnerabilities involve various Saflok models, such as the Saflok MT, the Quantum Series, the RT Series, the Saffire Series, and the Confidant Series, managed by the System 6000 or Ambiance software. These models are used in millions of doors worldwide, making the impact of the flaws widespread and significant.

To exploit the vulnerabilities, attackers only need to read one keycard from the property, allowing them to create forged keycards using MIFARE Classic cards and commercially available tools. The attackers can then rewrite the lock’s data with the first card and open the lock with the second card. The equipment required for this attack costs less than a few hundred USD.

While Dormakaba has been working on replacing and upgrading impacted locks since November 2023, the process is complex and time-consuming. As of March 2024, 64% of the locks remain vulnerable. The researchers have decided to disclose limited information about the vulnerability to ensure that hotel staff and guests are aware of the security risks posed by the Unsaflok flaws.

Hotel staff can potentially detect instances of active exploitation by reviewing the lock’s entry/exit logs, but this method may not be foolproof. Guests can use the NFC Taginfo app to check the type of keycard used in their room, with MIFARE Classic cards indicating a likely vulnerability.

The researchers have pledged to share more technical details about the Unsaflok attack once the remediation efforts are deemed satisfactory. In the meantime, it is essential for hotels and guests to remain vigilant and take necessary precautions to minimize the risk of unauthorized access through these security flaws.

Source link

Latest articles

Attackers Abuse Google Ad Feature to Target Slack, Notion Users

 Attackers are once again abusing Google Ads to target people with info-stealing malware, this time...

Hackers allege to have infiltrated computer network of Israeli nuclear facility

An Iran-linked hacking group has declared that they successfully breached the computer network of...

Hacker allegedly uses white-hat approach to exploit crypto game for $4.6M

In a surprising turn of events, the food-themed crypto game Super Sushi Samurai fell...

Reducing Threats from the IABs Market

As ransomware attacks continue to escalate in frequency and severity, one of the key...

More like this

Attackers Abuse Google Ad Feature to Target Slack, Notion Users

 Attackers are once again abusing Google Ads to target people with info-stealing malware, this time...

Hackers allege to have infiltrated computer network of Israeli nuclear facility

An Iran-linked hacking group has declared that they successfully breached the computer network of...

Hacker allegedly uses white-hat approach to exploit crypto game for $4.6M

In a surprising turn of events, the food-themed crypto game Super Sushi Samurai fell...
en_USEnglish