Hackers create hotel master keys that can access millions of rooms
Security researchers say it takes an average of 60 seconds to gain access to any hotel room using the hacking technique
Your support helps us to tell the story
From reproductive rights to climate change to Big Tech, The Independent is on the ground when the story is developing. Whether it's investigating the financials of Elon Musk's pro-Trump PAC or producing our latest documentary, 'The A Word', which shines a light on the American women fighting for reproductive rights, we know how important it is to parse out the facts from the messaging.
At such a critical moment in US history, we need reporters on the ground. Your donation allows us to keep sending journalists to speak to both sides of the story.
The Independent is trusted by Americans across the entire political spectrum. And unlike many other quality news outlets, we choose not to lock Americans out of our reporting and analysis with paywalls. We believe quality journalism should be available to everyone, paid for by those who can afford it.
Your support makes all the difference.Millions of hotel rooms are vulnerable to hackers after researchers found a technique to create master keys that can open rooms.
Researchers from the cybersecurity firm F-Secure discovered the flaw with key cards used by some of the world’s biggest hotel chains, including Intercontinental, Radisson and Sheraton Hotels and Resorts.
Tomi Tuominen and Timo Hirvonen from F-Secure began investigating the vulnerability 15 years ago after a laptop belonging to one of their colleagues mysteriously went missing from a hotel room.
The flaws they discovered with key cards made by the world’s largest lock manufacturer, Assa Abloy, allowed them to create a master key using any key card from a hotel, even one that was long-since expired.
“The hack consists of three steps,” Mr Tuominen explains to The Independent. “Firstly, get access to a key card, it doesn’t matter which. Secondly, use a relatively-cheap piece of hardware, combined with our custom software, to read the card and search for the master key code.
“Thirdly, write the master key onto the key card, or any other key card, to gain access to any room in the facility.”
Mr Tuominen and Mr Hirvonen say that it takes an average of 60 seconds to gain access to a room using this technique.
The researchers, who are set to present their findings at the Infiltrate conference later this week, informed Assa Abloy of the vulnerability and offered a patch to fix it. It is expected to take a long time to roll out the fix across all hotels affected.
“We appreciate F-Secure’s ethical approach in bringing these issues to our attention,” a spokesperson for Assa Abloy said.
“We strive for the utmost security and quality in our products, so we are glad to have the opportunity to ensure our products pass the most rigorous evaluations. With these updates, we have elevated hospitality security to the next level.”
Join our commenting forum
Join thought-provoking conversations, follow other Independent readers and see their replies
Comments