Worrying, for those who spend a lot of time in hotels...

[Phaedrus 209521]

[URL="http://www.forbes.com/sites/andygreenberg/2012/11/26/security-flaw-in-common-keycard-locks-exploited-in-string-of-hotel-room-break-ins/"][B]Security Flaw In Common Keycard Locks Exploited In String Of Hotel Room Break-Ins[/B][/URL]

Whoever robbed Janet Wolfâ??s hotel room did his work discreetly.

When Wolf returned to the Hyatt in Houstonâ??s Galleria district last September and found her Toshiba laptop stolen, there was no sign of a forced door or a picked lock. Suspicions about the housekeeping staff were soon ruled out, tooâ??-Wolf says the hotel management used a device to read the memory of the keycard lock and told her that none of the maidsâ?? keys had been used while she was away.

With the mystery unexplained, the Hyatt tried to give its guests a sense of security by posting a guard in its lobby. But Wolf couldnâ??t shake the notion that a thief could re-enter her room at any time. â??I had dreams about it for many nights,â? says Wolf, a 66-year-old Dell IT services consultant traveling in Houston for business. â??Iâ??d wake up and think I saw someone standing there at my desk.â?

Two days after the break-in, a letter from hotel management confirmed the answer: The roomâ??s lock hadnâ??t been picked, and hadnâ??t been opened with any key. Instead, it had been hacked with a digital tool that effortlessly triggered its opening mechanism in seconds. The burglary, one of a string of similar thefts that hit the Hyatt in September, was a real-world case of a theoretical intrusion technique researchers had warned about months earlierâ??one that may still be effective on hundreds of thousands or millions of locks protecting hotel rooms around the world.

Last month Houston police arrested 27-year-old Matthew Allen Cook and charged him with theft in a September 7th break-in at the Hyatt House Galleria. Police also listed Cook as a suspect in the theft from Wolfâ??s room four days later and that of another guest at the hotel. Cook, who has a prior history of arrests for thefts and burglary, was identified when an HP laptop stolen from one of the hotel rooms was found in a local pawn shop, where staff helped police to identify him.

A Houston police spokesperson offered no information about how Cook might have accessed the rooms he allegedly looted. But White Lodging, the Hyatt franchisee that manages the Houston hotel, believes that the rooms were opened using a device that takes advantage of a glaring security vulnerability in keycard locks built by the lock company Onity, specifically a model of lock that appears in at least four million hotel rooms worldwide.

That security flaw was first publicly demonstrated by Cody Brocious, a 24-year-old software developer for Mozilla, at the Black Hat hacker conference in July. Brocious reverse-engineered Onityâ??s locks and discovered he could spoof the â??portable programmerâ? device meant to be used for designating master keys and opening locks whose batteries had died.

On stage at Black Hat, Brocious showed it was possible to insert the plug of a small device he built with less than $50 in parts into the port at the bottom of any Onity keycard lock, read the digital key that provides access to the opening mechanism of the lock, and open it instantaneously.

In a statement sent to me, a White Lodging spokesperson says the company became aware of the vulnerability in its Onity locks in August, based on reading one of the stories I wrote about Brociousâ??s lock-hacking technique over the summer. But White Lodging says Onity only implemented a fix for that flaw in its locks after the September break-ins at the Houston Hyatt, around two months after I first alerted Onity to Brociousâ??s work.

Following those September incidents, White Lodging resorted to plugging the port at the bottom of its Onity locks with â??epoxy putty,â? according to the letter it sent to guests at its Houston location. The hotel company says itâ??s now working with Onity to put a more permanent solution in place, either plugging the locksâ?? ports or replacing their circuit board at every location it manages. â??We sincerely regret that these thefts occurred, and hope that measures we have taken satisfy your concerns,â? reads the letter to guests from White Lodging vice president Thomas Riegelman.

But even Onityâ??s official response, late as it may be, has left something to be desired. Rather than pay for the full fix itself, which requires a new circuit board for every affected lock, Onity has asked its hotel customers to cover the cost of those hardware replacements. Its free alternative involves merely blocking the port on the bottom of the lock instead with a plastic plug and changing the screws on the locks to a more obscure model to make it harder to open the locksâ?? cases and remove the plugs.

Forcing the customer to pay for anything beyond a band-aid-style fix may mean the flaw will remain unpatched in many cases, warns Brocious. â?Given that it wonâ??t be a low cost endeavour, itâ??s not hard to imagine that many hotels will choose not to properly fix the issues, leaving customers in danger,â? he wrote in a blog post in August. â??If such a significant issue were to exist in a car, customers would likely expect a complete recall at the expense of the manufacturerâ?¦I canâ??t help but feel that Onity has the same responsibility to their customers, and to customers staying in hotels protected by Onity locks.â?

Meanwhile, the Houston Hyatt may not be the only site hit with the Onity hack. An alert published by the insurance firm Petra Risk Solutions in October claimed that â??severalâ? hotels in Texas have had their locks opened with Brociousâ?? technique. Todd Seiders, a former Marriott security director who now works as director of risk management at Petra, says he spoke with the general manager of one of those hotels, who knew of at least three Texas hotels affected in total, though Seiders declined to name them.

Itâ??s not clear if suspects have been arrested in those cases. In a phone interview, Cookâ??s lawyer Charles Thompson declined to speak about the case or make Cook available for comment. â??We will vigorously defend these charges, and all the facts will be available after the trial,â? Thompson said.

When I first wrote about Brociousâ??s technique in July, his lock-hacking tool seemed to be unreliable: In tests we conducted at three New York hotels, he was only able to open one out of three rooms, and only after a few minutes of tweaking his device.

But after his Black Hat talk, Brociousâ??s work was soon refined by other hackers and researchers, who ironed out the bugs in his exploit and posted YouTube videos of the devices reliably opening hotel doors. One managed to fit the lock-hacking tool into an iPhone case. Another team of researchers squeezed it into the body of an inconspicuous dry-erase marker.

As the technique spreads, hotels with Onity locks need to either shell out for Onityâ??s circuit board fix or at least block access to their locksâ?? ports, says Todd Seiders of Petra Risk Solutionsâ??he estimates that more than 80% of his customers have implemented a fix since August, but says that many more hotels around the world may not have been so careful.

â??Weâ??re expecting incidents in which these devices are used to explode nationally,â? says Seiders. â??As crooks find success with it, theyâ??re going to go back to the Internet and say â??hey, it works. I was able to break into ten rooms.â?? And then others build it and try it. Weâ??re going to get hit hard over the next year.â?

All of which raises the question of whether Brocious should have ever brought his findings to light. Brocious, after all, didnâ??t alert Onity to its security flaw before his presentation at Black Hat (though I did) and even licensed his technique for $20,000 to the Locksmith Training Institute, which trains law enforcement and others, more than a year before he made it public.

Brocious has countered that Onityâ??s security bug is so simple it may have already been discovered by other hackers who used it in secret. And he says hotels needed to be made aware of the locksâ?? flaws so they could switch to a more secure model. â??I see no path to mitigate this from Onityâ??s side,â? he told me in July. â??Hotels need to come up with a plan to move to more secure locks.â?

As for Janet Wolf, an actual victim of the Houston hotel thefts, she blames the Hyatt, not Onity. â??If theyâ??re vulnerable to these hackers and they knew this was a problem, to me thatâ??s their fault,â? she says.

And would she rather that Onityâ??s security flaw had never been publicized in the first place?

â??No,â? she says. â??It should be made public so that the hotels can fix it. If people are vulnerable and thereâ??s a fix out there, they need to know.â?