Hotel Locks Have A Fatal Glitch

[billdeserthills]

Aaron Cashatt burgled dozens of hotel rooms using a homemade hacking device link www.newser.com/story/247899/meet-the-ma ... -room.html

[Squelchtone]

Ahh the Onity lock hack.

Here's some technical details: https://null-byte.wonderhowto.com/news/ ... s-0138312/

[billdeserthills]

I think it's sad and wrong that this kinda unsecure junk is sold to the public--
I'm sure the same thing is currently going on with sales of 'e locks' to unsuspecting folks

[Jacob Morgan]

There are no zero-day hacks of pin tumbler locks.

There was another recent article about e-locks popular with Airbnb houses being bricked by a wireless firmware update a couple of weeks ago. I posted a link to an article a couple of months ago about a high-class hotel where the door locks were hit with ransomeware. I work with computers a lot, and I have no interest in ever having an e-lock on my house.

[demux]

I work with computers a lot, and I have no interest in ever having an e-lock on my house.

+1. At least, not any of the commercially available pieces of junk. Something of my own design, perhaps. An electrically controlled actuator, connected to a computer on my network, such that to open it I have to first VPN into my house, then ssh to that system, then issue an open command...

Remember, if you have an electronic lock on your house, and don't run a server on your personal network connected to it, you don't really control that lock. The manufacturer or service provider does, and it's only their largesse that allows you to use it. Until they decide to shut that service off. Or get their system broken into and allow someone not authorized by you to unlock your house. Or... Frankly, knowing how the consumer-grade electronic stuff works, it scares me, and I can't believe anyone would ever buy one.

[Jacob Morgan]

Here is the article about e-locks that were killed by a bad firmware update pushed out by the manufacturer: https://techcrunch.com/2017/08/14/wifi-disabled/?ncid=rss/

[Tyler J. Thomas]

Security Showdown: Smart Locks vs. “Dumb” Locks

Verdict: Smart Locks Are Useful, But Not Ready For Primetime

And guess who's in the Smart Lock business now?

This trend (attacks and vulnerabilities for Smart Locks) is going nowhere but up. I'm the furthest thing from a hacker but even I figured out, and discussed on here, an easy flaw with Schlage's initial Z-Wave locks years ago. The big guys, the legit hackers, ethical or not, are going to continue doin their thang with Smart Locks.

I just hope the public stops buying this garbage.

[Moses057]

Dry erase marker opener
[youtube]http://www.youtube.com/watch?v/QyN-8CeNSZg[/youtube]

[Moses057]

I'd edit my post to try to fix the link but for some reason I can't any more
https://youtu.be/QyN-8CeNSZg

[Tyler J. Thomas]

Mods, Squelch:

Can we sticky this thread and rename it to "Smart Locks Flaws" or something similar? It'd be nice to keep a running list/compilation of news stories related to real world exploitation and vulnerabilities of "Smart Locks". Would be much easier to reference than a multiple threads all across the forum.

[Moses057]

Dry erase marker opener
[youtube]http://www.youtube.com/watch?v/QyN-8CeNSZg[/youtube]

I'd edit my post to try to fix the link but for some reason I can't any more
https://youtu.be/QyN-8CeNSZg

Ok I figured it out to get my vid to show up. Hurray for me


Removed link to specific details on a bypass method or tool.

https://www.wired.com/2017/08/the-hotel ... ge_article

Sorry for the multiple posts. When I try to do something and it doesn't come out right I can't put it down until it works. I can't help myself.

[GWiens2001]

Am going to watch the videos. If they are showing specific details on how to make/use something that can be used to bypass, they will be deleted, as don't really want this thread moved to advanced forums.

The original thread told that the flaw existed. But specifics of bypass belong in the advanced forums, guys.

Tyler - will discuss your idea with Squelchtone and the moderators, as it does have a lot of merit. We may need to have a thread in the public forum mentioning that there is a known exploit, and another in advanced that may discuss the specifics.

Gordon

[Tyler J. Thomas]

We may need to have a thread in the public forum mentioning that there is a known exploit, and another in advanced that may discuss the specifics.

Gordon

Ooo. That sounds like a good plan as well.

[Squelchtone]

I'd edit my post to try to fix the link but for some reason I can't any more
https://youtu.be/QyN-8CeNSZg

You have 30 mins to edit a post, this is plenty of time for link issues and spelling errors and oh I forgot to add this and that, but we lock them down automatically after a period of time so you cant tell someone to go F off and then edit your post and pretend it didnt happen.

[Ralph_Goodman]

We may need to have a thread in the public forum mentioning that there is a known exploit, and another in advanced that may discuss the specifics.

That would be an amazing resource. I would also like to suggest updating that same thread as companies fix the issue (or try to fix the issues).

Maybe one thread for commercial locks and another for residential locks would be good.

Just spitballing. Great idea though!