The obsession of a researcher who has found a method of forging a hotel card key in one minute over 15 years

However, when the WIRED US version contacted ASSA Abloy, the company replied that the number of vulnerabilities was 500,000 to 1 million, which was smaller than the number of researchers mentioned.In fact, it is difficult to determine this number.I don't know exactly how much of the old rock was replaced with a new lock.

Tuominen and Hilvonen have collected more than 1,000 key cards over the last decade with the cooperation of friends.After examining them, about 30 percent was a vision rock that was fragile against their attack method.

Manually update security programs in all rooms one by one

A year ago, Tuominen and his colleagues reported their investigations to the ASSA Abloy and warned.The company released a security update program on the site in February 2018.However, since Vingcard locks do not have an Internet connection function, each engineer must manually install the update program on each rock.Thus, "There is a good chance that some hotels that do not apply this correction program will come out," said Twoominen.

Researchers have released a demo video of this attack method.It shows the way to stop the elevator on the floor of a hotel where outsiders are prohibited using Proxmark.

Video Courtesy of F-Secure

Christoph Sut, director of the Hospitality Division at the ASSA ABLOY, argued that the risks of guests were not so large for WIRED US telephone interviews.Even a specialized knowledge of Fusecure had to perform Reverse Engineering for more than a few years to develop this attack method.

However, Sut has requested that the hotel using the Vision lock to install an update program."This is the new common sense now. Software must be updated. You need to update the lock, just like updating your smartphone or computer."

Invasion cases occurred due to the presentation of researchers

Tuominen and Hilvonen have not disclosed detailed information about the vulnerability in the Vingcard lock.There is a risk that theft and spies will enter the hotel room using that information.

In fact, a problem occurred six years ago.A security researcher discovered a serious vulnerability [Japanese version] on a frequently used key card lock, and published a codes that could be abused on the web.As a result, theft invading a hotel room in 100 rooms around the world.

However, according to Tuominen and Hilvonen, it was shortly after the investigation in 2003 that Vingcard code systems may be vulnerable.At that time, the Vingcard system used magnetic stripes technology instead of non -contact RFID technology.It was a mechanism to encode a unique encryption key and record it on each key card, and record another encryption key in the master key of each hotel.