Infrastructure // PC & Servers
01:00 PM
Connect Directly
Repost This

Can Some Code, $40 Arduino Unlock Millions Of Hotel Rooms?

After re-engineering how card keys are coded, Cody Brocious figured out a simple hack that can unlock millions of hotel rooms. Now he's sharing it with the world.

Cody Brocious took a rather aggressive way of announcing his research on stage at BlackHat in Las Vegas. Instead of telling Onity about a potential vulnerability with its hotel door locks, Brocious decided to publish code that took him three years to figure out and demonstrated it during his talk.

With Brocious's code, anyone with an Arduino, the popular open-source single-board microcontroller, and some other accessories can unlock potentially millions of hotel locks made by Onity.

Forbes reporter Andy Greenberg got the exclusive, revealing that when he and Brocioius tried out the hack in real hotel rooms, it worked only one out of three times. However, Brocious blames the one-for-three on a time bug, which he says he will fix this week, with some tweaks to the code.

Brocious' day job is a Mozilla software developer. The 24-year-old programmer originally discovered the vulnerability in Onity's system when he worked at a startup that was trying to make a better hotel lock. However, when faced with the choice of telling the vendor or releasing the code that would turn any key into a master key--he chose the latter.

The reason, he says, is that Onity's locks can't be fixed--and too many people already know how to pick them. According to the Forbes article, the startup, Unified Platform Management Corporation, in fact sold Brocious' hack to a locksmith training company last year. In his paper, Brocious wrote "... after much consideration it was decided that the potential short-term effects of this disclosure are outweighed by the long-term damage that could be done to hotels and the general public if the information was held by a select few."

Millions of Onity locks are installed in hotels, so the implications of these findings might be significant if it means hotels have to replace the locks.

When Brocious holds the Adruino up to a lock, it blinks green and mimics a card swipe. There was a lot of reverse engineering done in the protocols. The Arduino connects to the lock, determines the unique code for that lock, and issues the open command. It opens within 200 milliseconds.

He used an Arduino Mega 128, 5.6k resistor, and DC (coaxial) barrel connector that is 5 mm outer diameter and 2.1 mm inner diameter.

"There is a bug with the implementation of this device which prevents it working on some locks. At the moment this is believed to be a timing bug, which leads to the first bit of each byte being corrupted, but this is not certain," Brocious wrote.

"It's too easy to shimmy a coat hanger and open it - ignoring the software aspect. There's too much easy access there. I think it will happen, give it a week before people start picking locks. People will use the information for good and evil and there's nothing I can do about that," Brocious said.

So, how does Brocious get a good night's sleep at a hotel? He feels pretty safe with door chains. He also shoves a towel inside the handle.

Comment  | 
Print  | 
More Insights
Server Market Splitsville
Server Market Splitsville
Just because the server market's in the doldrums doesn't mean innovation has ceased. Far from it -- server technology is enjoying the biggest renaissance since the dawn of x86 systems. But the primary driver is now service providers, not enterprises.
Register for InformationWeek Newsletters
White Papers
Current Issue
InformationWeek Elite 100 - 2014
Our InformationWeek Elite 100 issue -- our 26th ranking of technology innovators -- shines a spotlight on businesses that are succeeding because of their digital strategies. We take a close at look at the top five companies in this year's ranking and the eight winners of our Business Innovation awards, and offer 20 great ideas that you can use in your company. We also provide a ranked list of our Elite 100 innovators.
Twitter Feed
Audio Interviews
Archived Audio Interviews
GE is a leader in combining connected devices and advanced analytics in pursuit of practical goals like less downtime, lower operating costs, and higher throughput. At GIO Power & Water, CIO Jim Fowler is part of the team exploring how to apply these techniques to some of the world's essential infrastructure, from power plants to water treatment systems. Join us, and bring your questions, as we talk about what's ahead.