2024-03-25 19:46:47
A security flaw in key cards with RFID chips could allow unauthorized persons to gain access to millions of hotel rooms. What is known.
New technologies and advancing digitalization are now replacing many things – even keys. There is hardly a car that still needs to be opened with a key. And especially in hotels, it’s hard to imagine using a key instead of a so-called keycard.
But unfortunately there are dangers lurking wherever digital technology is involved. In September 2022, a group of security researchers discovered a security vulnerability in key cards with RFID chips, which they have now published on their website.
Specifically, this involves cards from the manufacturer Dormakaba with the “Saflok” system, which is used in both hotels and apartment buildings. According to the researchers, around three million RFID locks in 131 countries worldwide are affected by the security flaw called “Unsaflok”. The “Saflok” system has been in use since 1988.
Fake key cards allow unauthorized access
Using counterfeit key cards, people could gain unauthorized access to millions of hotel rooms and homes. To do this, hackers only have to read a card – it can also be expired. According to security researchers, no case is known yet, but it cannot be ruled out. Even the safety lock would no longer work.
After the problem was identified, the vulnerabilities were reported to the manufacturer in September 2022. So far, however, only around 36 percent of the locks at risk have been updated or replaced, according to the website. This process only began in November 2023 – over a year after the report was made to the manufacturer.
However, the upgrade can take a long time and is very difficult. Locks need to be replaced or receive a software update. In addition, all keycards must be reissued. The reception software and card encoders also need to be updated. The integration of third-party providers, for example for elevators, parking garages and payment systems, may require additional upgrades, as the researchers explain.