Tag Archive for: seconds.

Hackers Found a Way to Open Any of 3 Million Hotel Keycard Locks in Seconds (Video)

/in


https://www.vecteezy.com/photo/24543747-hand-using-keycard-for-smart-digital-door-lock-while-open-or-close-the-door-at-home-or-apartment-nfc-technology-fingerprint-scan-pin-number-smartphone-and-contactless-lifestyle-conceptshttps://www.vecteezy.com/photo/24543747-hand-using-keycard-for-smart-digital-door-lock-while-open-or-close-the-door-at-home-or-apartment-nfc-technology-fingerprint-scan-pin-number-smartphone-and-contactless-lifestyle-concepts

When thousands of security researchers descend on Las Vegas every August for what’s come to be known as “hacker summer camp,” the back-to-back Black Hat and Defcon hacker conferences, it’s a given that some of them will experiment with hacking the infrastructure of Vegas itself, the city’s elaborate array of casino and hospitality technology.

But at one private event in 2022, a select group of researchers were actually invited to hack a Vegas hotel room, competing in a suite crowded with their laptops and cans of Red Bull to find digital vulnerabilities in every one of the room’s gadgets, from its TV to its bedside VoIP phone.

One team of hackers spent those days focused on the lock on the room’s door, perhaps its most sensitive piece of technology of all. Now, more than a year and a half later, they’re finally bringing to light the results of that work: a technique they discovered that would allow an intruder to open any of millions of hotel rooms worldwide in seconds, with just two taps.

Today, Ian Carroll, Lennert Wouters, and a team of other security researchers are revealing a hotel keycard hacking technique they call Unsaflok. The technique is a collection of security vulnerabilities that would allow a hacker to almost instantly open several models of Saflok-brand RFID-based keycard locks sold by the Swiss lock maker Dormakaba. The Saflok systems are installed on 3 million doors worldwide, inside 13,000 properties in 131 countries.

By exploiting weaknesses in both Dormakaba’s encryption and the underlying RFID system Dormakaba uses, known as MIFARE Classic, Carroll and Wouters have demonstrated just how easily they can open a Saflok keycard lock. Their technique starts with obtaining any keycard from a target hotel—say, by booking a room there or grabbing a keycard out of a box of used ones—then reading a certain code from that card with a $300 RFID read-write device, and finally writing two keycards of their own. When they merely tap those two cards on a lock, the first rewrites a certain piece of the lock’s data, and the second opens it.

“Two quick taps and we open the door,” says Wouters, a researcher in the…

Source…

Hackers Found a Way to Open Any of 3 Million Hotel Keycard Locks in Seconds

/in


When thousands of security researchers descend on Las Vegas every August for what’s come to be known as “hacker summer camp,” the back-to-back Black Hat and Defcon hacker conferences, it’s a given that some of them will experiment with hacking the infrastructure of Vegas itself, the city’s elaborate array of casino and hospitality technology. But at one private event in 2022, a select group of researchers were actually invited to hack a Vegas hotel room, competing in a suite crowded with their laptops and cans of Red Bull to find digital vulnerabilities in every one of the room’s gadgets, from its TV to its bedside VoIP phone.

One team of hackers spent those days focused on the lock on the room’s door, perhaps its most sensitive piece of technology of all. Now, more than a year and a half later, they’re finally bringing to light the results of that work: a technique they discovered that would allow an intruder to open any of millions of hotel rooms worldwide in seconds, with just two taps.

Today, Ian Carroll, Lennert Wouters, and a team of other security researchers are revealing a hotel keycard hacking technique they call Unsaflok. The technique is a collection of security vulnerabilities that would allow a hacker to almost instantly open several models of Saflok-brand RFID-based keycard locks sold by the Swiss lock maker Dormakaba. The Saflok systems are installed on 3 million doors worldwide, inside 13,000 properties in 131 countries.

By exploiting weaknesses in both Dormakaba’s encryption and the underlying RFID system Dormakaba uses, known as MIFARE Classic, Carroll and Wouters have demonstrated just how easily they can open a Saflok keycard lock. Their technique starts with obtaining any keycard from a target hotel—say, by booking a room there or grabbing a keycard out of a box of used ones—then reading a certain code from that card with a $300 RFID read-write device, and finally writing two keycards of their own. When they merely tap those two cards on a lock, the first rewrites a certain piece of the lock’s data, and the second opens it.

“Two quick taps and we open the door,” says Wouters, a researcher in the Computer Security and Industrial Cryptography group at…

Source…

Google security check — 60 seconds to kick out snoops and hackers

/in


I’ll never forget the caller on my national radio show asking me for guidance because her brother was scammed out of $450,000.

He trusted the wrong person, and he’s far from alone. People simply don’t realize they’re being taken for a ride until it’s too late.

Then clues pop up. Maybe you sent a bunch of gift card codes, or there are emails you didn’t write in your outbox. Or worse, you get a notice about a loan in your name.

It’s the reason to check your Google account’s security. It only takes a minute and will reveal who has access to your account. Fingers crossed, it’s just you.

60-second safety check

I’m going to show you how to find digital clues a hacker got into your account, but that’s not all. This tip also works for spotting snoops. Is a friend or family member poking around your Google or Gmail account? Let’s sniff them out.

People are also reading…

Go to google.com/devices. Sign in if you aren’t already.

Here, you’ll see a list of devices — the computers, smartphones and tablets you’re signed into or have been signed into within the last 28 days.

You can click each one to see which browser was used. That might be a tip-off someone else has logged in, say you see Chrome, but you only use Safari.

Don’t panic if you see the same device multiple times. Each session (or instance you logged in) is recorded.

You may also see devices that have been inactive for a long time, like an old phone or computer you don’t use anymore. It’s wise to sign these devices out remotely.

Click the one you want, then Sign out. This will remove access to your Google account from the device entirely.

You should also take that step for any devices you once used to access your account, like a friend’s tablet or a work computer.

Here’s the red flag

What happens if you see a computer, phone, tablet, or device you don’t recognize? That might be a…

Source…