#unsaflok — Public Fediverse posts

Imagine walking into a hotel… with two forged cards that open every door. That’s #Unsaflok, explained by Lennert Wouters (COSIC) at the Cybersecurity Industry Day: https://www.youtube.com/watch?v=4hnrGBum_ws
A cascade of flaws put 3M+ Saflok hotel locks in 131 countries at risk.

Imagine walking into a hotel… with two forged cards that open every door. That’s #Unsaflok, explained by Lennert Wouters (COSIC) at the Cybersecurity Industry Day:
https://www.youtube.com/watch?v=4hnrGBum_ws
A cascade of flaws put 3M+ Saflok hotel locks in 131 countries at risk.

Quelques mois avant les #jo2024 , une vulnérabilité majeure a été découverte dans Saflok, une techno utilisée partout dans le monde (surtout dans les hôtels) pour l'accès à des chambres via carte #RFID. Ça a été baptisé #Unsaflok et c'est décrit en détail sur https://unsaflok.com/

Le processus de patch a débuté dès Novembre 2023, le site parle de 36% des serrures qui ne sont plus vulnérables. Pour celles qui le sont toujours, par contre, la faille est assez dramatique :

> An attacker only needs to read one keycard from the property to perform the attack against any door in the property. This keycard can be from their own room, or even an expired keycard taken from the express checkout collection box.

Les chercheurs n'ont pas publié plus d'infos sur les vulnérabilités (i.e. pas de PoC). Un article de WIRED sur le sujet : https://www.wired.com/story/saflok-hotel-lock-unsaflok-hack-technique/

l+f: "#Unsaflok" – unsichere Hotel-Türschlösser | Security https://www.heise.de/news/l-f-Unsaflok-unsichere-Hotel-Tuerschloesser-9666299.html

"Unsaflok is a series of vulnerabilities that, when chained together, enable an attacker to unlock any room in a property using a pair of forged keycards."

This vulnerability can also unlock deadbolts.

My wife found a device like this to bring to hotel rooms to prevent unauthorized entry: https://www.amazon.com/dp/B0BTTPTPVW?starsLeft=1&ref_=cm_sw_r_cso_sms_apin_dp_144K0NRXC04GA6VW5VFH&th=1.

https://www.bleepingcomputer.com/news/security/unsaflok-flaw-can-let-hackers-unlock-millions-of-hotel-doors/

#infosec #security #doors #locks #safety #Unsaflok

#Unsaflok flaw can let hackers unlock millions of hotel doors

https://www.bleepingcomputer.com/news/security/unsaflok-flaw-can-let-hackers-unlock-millions-of-hotel-doors/

#Hacker haben Schwachstellen in einem der verbreitetsten Schlüsselkarten-Systeme gefunden und können in Millionen Hotel-Zimmer in aller Welt gelangen. #Unsaflok https://winfuture.de/news,141863.html?utm_source=Mastodon&utm_medium=ManualStatus&utm_campaign=SocialMedia

The use of MIFARE Classic already made it possible to clone the #Saflok keys at will, assuming you had even passing access to the key to clone. This was possible since you've been able to obtain UID programmable cards/fobs from china for over a decade, and thus produce 100% clones of MIFARE Classic cards/fobs. The actual key #Unsaflok finding is the generation of Skeleton keys that open all doors.

Classic example of #securitybyobscurity ending badly: "To clone the cards, they had to crack #dormakaba's key derivation function. ... Forged keycards can be created using any #MIFAREClassic card."
https://www.bleepingcomputer.com/news/security/unsaflok-flaw-can-let-hackers-unlock-millions-of-hotel-doors/ #Unsaflok #vulnerability #infosec #cybersecurity #Saflok