New Emphasis on Keycard Lock Security

Revelations that the security of hotels and travellers might easily be compromised have been a considerable shock to the accommodation industry and has put a new emphasis on the need for a foolproof doorlocking system.

The revelation was that Onity, whose keycard locks can be found on at least four million rooms around the world, had a security flaw that could allow hackers to insert a homemade device into its keycard locks and open them in seconds.

This was exposed in July this year at the Black Hat USA Security Conference in Las Vegas by Cody Brocious, a Mozilla developer who showed that he was able to insert a device he built for less than $50 into the data port on the underside of Onity's locks, read their memory to find a decryption key, and then use that to gain access to the lock's firmware and trigger its open command in a matter of seconds.

"With how stupidly simple this is, it wouldn't surprise me if a thousand other people have found this same vulnerability and sold it to other governments," Brocious was quoted as saying. "An intern at the NSA could find this in five minutes."

Now hackers have refined Brocious' technique to improve the success rate and have succeeded in building an unlocker into a dry erase marker. In its original implementation, the code reader had a prominent wire running between the Arduino and the lock.

Nothing comes out of the marker, the tip looks normal, and there's no wire. Touch the tip of the marker to the door port, and voila, it unlocks.

Expensive solutions - The process was backed up by two other hackers who claimed that they had developed an even more failsafe system of breaching the Onity locks.

Although Onity offered two solutions – one a quick fix and the second more rigorous, the fix required hardware changes to every affected lock. And for those hotels that wanted more than a bandaid-style repair, Onity was requiring its customers to pay for it.

While fixing the locks would be expensive and disruptive enough, the repercussions of not doing so would almost certainly have been appalling as guests' property could be targeted and their safety put at risk. No longer could hotel and motel managers that had Onity locks, assume that everything was impenetrable with their property's security. They needed to ensure that they had a doorlocking system that was absolutely failsafe. This type of electronic lock is still available in the marketplace, particularly with Ilco and Saflok locks by Kaba Lodging Systems.

Technological improvement - When contact smart chips were introduced in the early 1990s, they allowed the retention of data within the card itself. This gives hotel staff greater ease and flexibility of information management than with the previous magnetic stripe technology.

A further step towards technological sophistication was taken with the introduction of RFID (radio frequency identification) contactless proximity locks and cards in the last few years. The benefits of this far surpasses those of traditional magnetic stripe, which explains why these are the most popular locks sold nowadays.

RFID proximity cards are capable of retaining the audit trail within the cards themselves, not only within the lock as was the case in the past, thus allowing accommodation management to effectively track the movements of the card user, and not only the activity of a single lock as in the past.

Cost-effective RFID - The biggest advantage of the MiFare RFID proximity card is that it is designed to carry information that can be used on multiple applications. For property owners and engineers, the cost effective benefit of RFID electronic locks is that there is no mechanical movement and interaction between the card and lock reader other than the mere presentation, and not physical insertion, of card to reader.

Because of this, the manufacturers of Saflok and Ilco can completely seal the reader heads, ensuring total integrity, longevity and protection from harsh elements such as excessive dirt and dust, salt water environments, and moisture which would otherwise build up between air-conditioned rooms and high humidity environments outside. Labour intensive cleaning of the reader head is no longer an issue.

Wireless locking systems -Taking technology up a step further, in 2007 Saflok was the first to release a stand-alone electronic locking system operating on a wireless on-line platform known as the Messenger System – a powerful tool capable of communicating directly with each and every door lock, delivering real date and time back to a central server through a network of wireless communication, using radio frequency.

Source: AccomNews, 22 November 2012