Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Maker of Hackable Hotel Locks Finally Agrees To Pay For Bug Fix

samzenpus posted about 2 years ago | from the cleaning-up-your-mess dept.

Privacy 66

Sparrowvsrevolution writes "Slashdot readers are no doubt familiar by now with the case of Onity, the company whose locks are found on 4 million hotel room doors worldwide and, as came to light over the summer, can be opened in seconds with a $50 Arduino device. Since that hacking technique was unveiled by Mozilla developer Cody Brocious at Black Hat, Onity first downplayed its security flaws and then tried to force its hotel customers to pay the cost of the necessary circuit board replacements to fix the bug. But now, after at least one series of burglaries exploiting the bug hit a series of hotel rooms in Texas, Onity has finally agreed to shoulder the cost of replacing the hardware itself — at least for its locks in major chain hotels in the U.S. installed after 2005. Score one point for full disclosure."

Sorry! There are no comments related to the filter you selected.

I dunno... (2, Insightful)

Anonymous Coward | about 2 years ago | (#42214303)

A bunch of people got their stuff stolen, a bunch of smaller hotels are out money, and Onity takes a huge hit? Seems like everyone would have been better off if everyone kept quiet and Onity just started shipping new units with the fix.

Re:I dunno... (5, Insightful)

Goaway (82658) | about 2 years ago | (#42214401)

They didn't want to ship them even after the knowledge was made public. It's not like there was any chance in hell they would have done it if nobody had known about the problem.

Re:I dunno... (4, Insightful)

mwvdlee (775178) | about 2 years ago | (#42214445)

They didn't want to ship them even after the knowledge was made public. It's not like there was any chance in hell they would have done it if nobody had known about the problem.

It's not like there was any need they should have done it if nobody had known about the problem.

Any lock is hackable. Just because Onity got targetted doesn't mean they are suddenly less secure than all the others.

Obviously, not wanting to fix a known security issue IS a problem.

Re:I dunno... (5, Insightful)

MartinSchou (1360093) | about 2 years ago | (#42214577)

Actually, the moment that lock was publicly compromised in this way, it DID become less secure than other non-compromised locks.

A regular mechanical lock is secure, but the moment it becomes public knowledge that it can be defeated with a pen [youtube.com] it becomes a lot less secure than other locks.

Locks are supposed to deter and delay. Deter regular people and delay thieves. When the lock is completely compromised like this one, it no longer delays thieves, thus making it useless.

Re:I dunno... (0)

Anonymous Coward | about 2 years ago | (#42215629)

Unless the lock is of deadbolt fashion then it is no less or more secure than any other door lock without a shim guard.

5 seconds with a plastic card inserted corner first and rotated down and the door is open.

Re:I dunno... (1)

Zadaz (950521) | about 2 years ago | (#42218947)

And here I was always told that security by obscurity was no security at all.

Re:I dunno... (0)

Anonymous Coward | about 2 years ago | (#42220417)

And here I was always told that security by obscurity was no security at all by idiots who see the world in black and white.

*fixed*

Re:I dunno... (2)

Capt.Albatross (1301561) | about 2 years ago | (#42214669)

Just because Onity got targetted doesn't mean they are suddenly less secure than all the others.

Right... for example, they could have been less secure than all the others from the start.

Your argument, quoted above, is not false, but it is useful only in pointing out that we cannot assume the alternatives are secure. To anyone for whom the security of hotel locks matter, Onity has been shown to have been incompetent in its design, and it is the degree of its incompetence that matters. The vulnerability exploited here was not a subtle mistake.

Re:I dunno... (1)

Anonymous Coward | about 2 years ago | (#42215619)

Just because Onity got targetted doesn't mean they are suddenly less secure than all the others.

Right... for example, they could have been less secure than all the others from the start.

Your argument, quoted above, is not false, but it is useful only in pointing out that we cannot assume the alternatives are secure. To anyone for whom the security of hotel locks matter, Onity has been shown to have been incompetent in its design, and it is the degree of its incompetence that matters. The vulnerability exploited here was not a subtle mistake.

We also now know that under no circumstance, will Onity quickly and effectively deal with situations where their locks have been compromised.

Re:I dunno... (4, Insightful)

dbIII (701233) | about 2 years ago | (#42214783)

Restricting the knowledge to thieves and a company that didn't want to fix their problem is not a solution.

Re:I dunno... (2, Insightful)

Anonymous Coward | about 2 years ago | (#42215115)

How do you know NOBODY knew about it? These hacks could have been going on for years in small scale in hotels but no one would blame a firmware or circuit board design if they did not know there was a flaw. Some cop in some city could have caught someone and confiscated the device and had no idea what it was or how it worked, booked the guy, he did his few days in jail and moved on. Its not like a majot hotel chain is going to publish the fact that they were robbed or hacked.

Re:I dunno... (0)

Anonymous Coward | about 2 years ago | (#42220467)

How do you know NOBODY knew about it? These hacks could have been going on for years in small scale in hotels but no one would blame a firmware or circuit board design if they did not know there was a flaw. Some cop in some city could have caught someone and confiscated the device and had no idea what it was or how it worked, booked the guy, he did his few days in jail and moved on. Its not like a majot hotel chain is going to publish the fact that they were robbed or hacked.

Gosh, what if the hotel staff have been swiping shit from people's rooms for years?

Why do you morons keep looking at this like it's a technology problem?

Re:I dunno... (1)

Goaway (82658) | about 2 years ago | (#42220371)

Any lock is hackable. Just because Onity got targetted doesn't mean they are suddenly less secure than all the others.

"Any lock" doesn't have a connector on the outside which you can plug into to open it. They were less secure than other locks.

Re:I dunno... (0)

Anonymous Coward | about 2 years ago | (#42230367)

What the fuck?

This head in sand(or is it head in ass?) mentality is insightful?

You are assuming that no one knew about this before or every will discover it by tech-savvy burglars.

Re:I dunno... (2)

Capt.Albatross (1301561) | about 2 years ago | (#42214413)

Seems like everyone would have been better off if everyone kept quiet and Onity just started shipping new units with the fix.

One group that would be worse off are hotel operators seeking a lock-system supplier. With this information out, they can make a slightly more informed choice.

Re:I dunno... (0)

Anonymous Coward | about 2 years ago | (#42215009)

If your business is selling security products you better make sure your products are secure!

Re:I dunno... (2)

morgauxo (974071) | about 2 years ago | (#42216897)

That assumes that nobody else would have figured out the same thing and used it. For that matter, who says nobody else did figure it out and use it. Are there no unsolved cases of things going missing from hotel rooms since these locks first started getting used until now?

HOW MANY RAPES DURING THIS WHILE ?? (-1)

Anonymous Coward | about 2 years ago | (#42214307)

Too many !!

Re:HOW MANY RAPES DURING THIS WHILE ?? (4, Funny)

causality (777677) | about 2 years ago | (#42214335)

Too many !!

I think you could have a career in politics.

Re:HOW MANY RAPES DURING THIS WHILE ?? (4, Funny)

kelemvor4 (1980226) | about 2 years ago | (#42215055)

Too many !!

But were they "legitimate?"

That is to say, (4, Interesting)

Black Parrot (19622) | about 2 years ago | (#42214309)

Full disclosure by a third party.

A month (5, Informative)

ledow (319597) | about 2 years ago | (#42214325)

I give it a month before the new firmware is discovered vulnerable to a very similar attack, or a way to bypass the plug is found.

That said, if I were Marriot, of course I'd have negotiated just this kind of deal. It would be quite simple, and any number of electronic lock-makers would fall over themselves to install reduced costs locks (or even compatible boards) and just live off the future support for them.

What bothers me is not the replacement policy (which looks like you need to argue lots to get something quite reasonable, like a free firmware fix), or the security (we all know that lots of modern products have security flaws and to be honest, this one requires quite some skills / balls to exploit), but the denials and brushing-under-the-carpet.

Your locks have one purpose. To stay shut against an intruder. That's all. Sure, we don't expect the room to be impenetrable or them to be crowbar-proof, but we do expect you to not be able to walk up to them with just a device and start changing their settings without that device being authenticated, revokable and protocol-protected. And certainly not to the point that you can work out what to do to make it accept any card from just a lock alone without some serious reverse-engineering.

Damn right, you'd replace my locks. Or your insurance would have one huge hefty claim on it by now from chains like Marriott. Hell, I'd even let you off if I could fit them myself on my own schedule so as to not disturb guests or interfere with business operations, and even let you charge me for delivery.

But what I wouldn't accept would be it taking MONTHS to get to the position that a fix was available after a successful public demonstration. You should have been calling me up and shipping the updated boards/firmware the next day, at least, and worrying about the cost later.

If there's a repeat of this incident with the new board, I would need to KNOW that you were going to do something timely about it BEFORE burglaries start hitting my hotel insurance, which may not even pay out if the locks are that bad.

Re:A month (5, Insightful)

camperdave (969942) | about 2 years ago | (#42214691)

Your locks have one purpose. To stay shut against an intruder. That's all. Sure, we don't expect the room to be impenetrable or them to be crowbar-proof, but we do expect you to not be able to walk up to them with just a device and start changing their settings without that device being authenticated, revokable and protocol-protected. And certainly not to the point that you can work out what to do to make it accept any card from just a lock alone without some serious reverse-engineering.

Well, it's not as if you can just stick in an unbent paper clip or the barrel of a stick pen. And it's not as if you can connect a quickly hacked together "pick" out of an old wall wart and a 9 Volt battery. You have to stick in a specifically crafted piece of sophisticated electronics, The manufacturer thought that would be enough of a barrier.

But what I wouldn't accept would be it taking MONTHS to get to the position that a fix was available after a successful public demonstration. You should have been calling me up and shipping the updated boards/firmware the next day, at least, and worrying about the cost later.

You want to go from zero to having authenticated, revokable and protocol-protected lock programmers in a day? Dream on, chum, dream on.

Re:A month (1)

dbIII (701233) | about 2 years ago | (#42214801)

Sophisticated electronics? I don't think so.

Re:A month (3, Insightful)

Zontar_Thing_From_Ve (949321) | about 2 years ago | (#42215021)

Well, it's not as if you can just stick in an unbent paper clip or the barrel of a stick pen. And it's not as if you can connect a quickly hacked together "pick" out of an old wall wart and a 9 Volt battery. You have to stick in a specifically crafted piece of sophisticated electronics, The manufacturer thought that would be enough of a barrier.

Actually, I think the manufacturer thought that it would be more like something you'd see on TV in CSI where only the super-duper elite criminals would be able to pick the locks, not "some dude who watched a video on YouTube or found a web page on how to do it". It's kind of like car alarms. Car alarms don't exist to stop the elite thieves because they won't. They exist to stop Joe Crackhead from trying to steal your car. What happened basically is somewhat equivalent to finding a way to turn off the car alarm so Joe Crackhead is now a serious threat to steal your car with impunity.

Re:A month (2)

ledow (319597) | about 2 years ago | (#42215263)

"You want to go from zero to having authenticated, revokable and protocol-protected lock programmers in a day? Dream on, chum, dream on."

When you're paying probably $100+ per lock (the internal circuit boards are $11 replacement-cost if you don't send them back, for a start) * 50 locks per floor * 5 floors per hotel * 3700 franchisee hotels? Plus any number of other clients?

No. I expect it to already be in place, especially if it means that you have to produce several thousand such devices for your field engineers to program the locks in the first place (and thus such field engineers and anyone who knows them could have complete access before you even start).

We're not talking Diffie-Hellman, here, we're talking about having some kind of protection on the programming interface. Like having to program them from inside the door, or remove the lock, first, for instance. Like just about anything with some kind of programming interface requires already (I can't program a key for my car without a very expensive, controlled, licensed device monitored and authorised only by the original manufacturer, or access to the internals of my exact car with at least two of my keys to it, one of which is capable of programming and one of which can already start the car, or a LOT of hacking - not just sticking a plug into a socket exposed to the driver's door handle and telling it what key to accept, which is what this is)

Re:A month (1)

AmiMoJo (196126) | about 2 years ago | (#42217263)

You have to stick in a specifically crafted piece of sophisticated electronics, The manufacturer thought that would be enough of a barrier.

Clearly it wasn't because criminals started to exploit it very quickly. And the "specifically crafted piece of sophisticated electronics" is actually a low cost dev board designed specifically to be easy to use by non-technical people like artists. No programming and only very basic soldering skills required.

You want to go from zero to having authenticated, revokable and protocol-protected lock programmers in a day? Dream on, chum, dream on.

I don't think the GP was implying that they should implement all those fixes, merely the one that they have used - to remove the debug header from the PCB.

Re:A month (0)

Anonymous Coward | about 2 years ago | (#42215109)

The bottom line is: Locks only keep honest people honest.

"Score one for bad publicity" (3, Insightful)

Chatterton (228704) | about 2 years ago | (#42214337)

"Score one point for full disclosure". I don't think so. "Score one for bad publicity" yes. With the previous customer looking somewhere else to provide new lock as Onity wheren't caring about them and their promise of high security electronic locks...

Re:"Score one for bad publicity" (2)

AmiMoJo (196126) | about 2 years ago | (#42217305)

What about the people who were robbed, and the hotels they were staying in? If they had not known about this vulnerability it would have made investigation and getting compensated very difficult. The cops are hardly going to do a teardown of the lock to see if it is hackable.

Onity probably wouldn't have told anyone about the problem anyway. Often vendors just ignore the problem or quietly fix it and then release a new "even more secure" version of the product and charge you for it.

Attempt to Limit Future Liability (4, Informative)

Capt.Albatross (1301561) | about 2 years ago | (#42214357)

The leaked agreement contains this paragraph:

"Onity’s proposal for franchisees is conditioned on the franchisee’s acknowledgement that Onity does not guarantee a lock’s invulnerability to hacking."

While this is a reasonable statement on its own, the real issue here is competence. Onity's design was in such blatant and avoidable violation of basic security principles (e.g. a small keyspace and a lack of real cryptography) that it might be be called negligent.

Re:Attempt to Limit Future Liability (2, Interesting)

Rockoon (1252108) | about 2 years ago | (#42214393)

Meanwhile, most of the non-electronic locks manufactured in the world can be "hacked" by a pair of paper clips.

I'm calling bullshit here. Looks to me like their locks were fit for purpose, where its purpose is to keep honest people honest.

Re:Attempt to Limit Future Liability (1)

Maximum Prophet (716608) | about 2 years ago | (#42214689)

Physical lock makers will tell you that their cheap locks are pickable. But they'll sell you "security" locks that cost much, much more, and are much more resistant to lockpicks. Several manufacturers have offered bounties for anyone that can pick their locks.

Did Onity offer customers the choice of good and better locks and the customers cheaped out, or was this the best they had?

Re:Attempt to Limit Future Liability (1)

Rockoon (1252108) | about 2 years ago | (#42214757)

Physical lock makers will tell you that their cheap locks are pickable. But they'll sell you "security" locks that cost much, much more, and are much more resistant to lockpicks.

Are you suggesting that every physical lock maker also offers the advanced tumblers? Are you also suggesting that offering such tumblers is a prerequisite to not getting sued into oblivion on your cheap tumblers? Finally, are you suggesting that this electronic lock company claimed that its locks were unpickable?

Re:Attempt to Limit Future Liability (1)

Capt.Albatross (1301561) | about 2 years ago | (#42216911)

Meanwhile, most of the non-electronic locks manufactured in the world can be "hacked" by a pair of paper clips.

Onity's locks should be judged not only by their physical counterparts, but also by what can reasonably be achieved electronically. This problem was entirely avoidable, at little or no extra original expense (and much less overall) if Onity had just employed one or two competent, security-aware developer/designers. I don't expect perfection, and is reasonable competence too much to ask?

I'm calling bullshit here. Looks to me like their locks were fit for purpose, where its purpose is to keep honest people honest.

The larger issue that concerns me here is that this cavalier attitude to electronic security seems to be unjustifiably common, and it seems that someone needs to get slapped around a bit before businesses see this as something they need to pay attention to. If Onity is that someone, we are making progress.

Re:Attempt to Limit Future Liability (2)

Arthur B. (806360) | about 2 years ago | (#42214415)

The reasonable statement would be that while Onity cannot guarantee the lock won't be hacked, it will offer a free replacement if such a hack were to be found. This puts the incentive in the right place. Onity could even have a third party insurer cover the risk if they don't want this exposure on their balance sheet.

Re:Attempt to Limit Future Liability (1)

erroneus (253617) | about 2 years ago | (#42214425)

See? They should spin off into two businesses.

1. A Hardware company
2. A Software company

In the case of the hardware, they are not liable because the problem would be in the software. In the case of the software, they would be indemnified by the EULA. Game over right?

Re:Attempt to Limit Future Liability (0)

Anonymous Coward | about 2 years ago | (#42214491)

I was just thinking how that statement applies in the movie world. On one side, you have high tech thieves with some almost sci-fi tools, that would probably be worth more to build and research than the actual loot, and on the other, we have the low tech, social engineering, just a few dollars and some basic electronics skills to get past, even the most advanced systems. I'm just saying, that a lot of companies practice this security through obscurity, and any professional probably knows or has a list of tools and hacks they can use.

Sure, "in seconds" (4, Insightful)

Rogerborg (306625) | about 2 years ago | (#42214439)

If by that you mean disassembling the face of the lock, plugging the widget in shoving the magic electrons in.

You know what else works "in seconds"? A $10 crowbar, 100% of the time.

It's a ridiculous nerd-rage non-issue, given that to work the hack you'd have to be on site for an extended period, cool as a cucumber, looking and acting like a member of staff. You might as well be staff, and that's where the real vulnerability is, and always will be.

Re:Sure, "in seconds" (-1)

Anonymous Coward | about 2 years ago | (#42214475)

Staff would never steal from their guests. I demand that you apologize and retract your statement immediately, or I will file a lawsuit against you.

Also, it is unreasonable to expect Onity to replace their locks for free due to this "defect", as it is not truly a defect in the true sense of the word. This incident has the potential to ruin Onity, and it is unfair when it has done nothing wrong. This is like when Sandusky got blamed for allegedly raping all those liars without any proof except their filthy lies. They just wanted to ruin Penn State's football team, and they did it because they were a bunch of malicious little monsters. Someone should have murdered them before they could testify.

Re:Sure, "in seconds" (1)

Anonymous Coward | about 2 years ago | (#42214535)

If by that you mean disassembling the face of the lock, plugging the widget in shoving the magic electrons in.

You know what else works "in seconds"? A $10 crowbar, 100% of the time.

It's a ridiculous nerd-rage non-issue, given that to work the hack you'd have to be on site for an extended period, cool as a cucumber, looking and acting like a member of staff. You might as well be staff, and that's where the real vulnerability is, and always will be.

In seconds means in seconds. Know the facts before you call someones legitimate concerns rediculous.

http://todaynews.today.com/_news/2012/12/06/15703318-rossen-reports-new-device-lets-crooks-crack-many-hotel-locks?lite

Re:Sure, "in seconds" (0)

Anonymous Coward | about 2 years ago | (#42214653)

You know what also works in seconds? This hack. What doesn't leave marks or other signs of intrusion? This hack.

Re:Sure, "in seconds" (0)

Anonymous Coward | about 2 years ago | (#42219289)

You know what doesnt make even a sound? This hack. You know what would look like you are using a regular key? This hack.

Re:Sure, "in seconds" (1)

ATMAvatar (648864) | about 2 years ago | (#42214675)

The subterfuge fails when you are carrying around a crowbar. You would have to be pretty creative to pass yourself off as hotel staff or a guest while carrying one.

Re:Sure, "in seconds" (1)

greg1104 (461138) | about 2 years ago | (#42214815)

Hotels have engineering or maintenance staff who carry tools around all the time (the "engineering" term is used at the more expensive hotels). You just need to dress like a working class guy in a uniform--your name on a badge helps--and no one will question why you're wandering around with a crowbar. At a nice place it's a cheaper look to pull off than the suit you'd need to look like a concierge.

Re:Sure, "in seconds" (1)

beerdragoon (1142579) | about 2 years ago | (#42216187)

...you could, or you could use your $10 crowbar to threaten a cleaning lady or bellhop and get a room card that will open any guest room in the hotel.

Re:Sure, "in seconds" (2)

greg1104 (461138) | about 2 years ago | (#42216865)

...followed by security being called by the person you just threatened. Memorably harassing a member of the hotel staff is a pretty stupid plan.

Re:Sure, "in seconds" (1)

Man On Pink Corner (1089867) | about 2 years ago | (#42221419)

Just dress up like a physicist. Problem? [themis-media.com]

Re:Sure, "in seconds" (2)

gl4ss (559668) | about 2 years ago | (#42214687)

go opening doors with a crowbar and you'll be doing time in no time.

open them with no traces and the hotel staff gets blamed for the burglary. there was no need to be there for "extended period", it's not like he was disassembling the lock from it's place.

Re:Sure, "in seconds" (2)

Black Parrot (19622) | about 2 years ago | (#42214987)

open them with no traces and the hotel staff gets blamed for the burglary

What I want to know is, will Q get his bypass-kit updates for free, or will Her Majesty have to shell out for them?

Re:Sure, "in seconds" (1)

Sockatume (732728) | about 2 years ago | (#42215389)

As opposed to using a crowbar, where you can have a flop sweat, be dressed like a sumo wrestler, and be opening a door with a crowbar, and nobody will bat an eyelid.

Re:Sure, "in seconds" (2)

Megane (129182) | about 2 years ago | (#42215643)

disassembling the face of the lock

Are you talking about the hack?

Nope. There's an exposed barrel jack on the bottom of the lock. You can make the hack device into the shell of a whiteboard marker, then just push it up the hole.

Also, no marks or splinters like a crowbar would leave behind.

Re:Sure, "in seconds" (0)

Anonymous Coward | about 2 years ago | (#42223545)

then just push it up the hole.

That's what she said!

Re:Sure, "in seconds" (1)

Anonymous Coward | about 2 years ago | (#42215825)

sure a crowbar works, but leaves a lot of evidence. With a digital lock pick, you can get in, get out, leave no trace, and the hotel employees take the blame.

Re:Sure, "in seconds" (0)

Anonymous Coward | about 2 years ago | (#42216795)

Try filing an insurance claim for theft when the burglar uses a key and gloves. Now try when they use a crowbar and gloves.

Re:Sure, "in seconds" (0)

Anonymous Coward | about 2 years ago | (#42219781)

You know what else works "in seconds"? A $10 crowbar, 100% of the time.

The hack leaves no (?) evidence; a crowbar does.

So from a certain point of view it makes no difference (someone got in), in others it does: police and insurance companies have reasonably evidence that fraudulent reporting is not being done and an actual theft has occurred. While it's little consolation if your stuff is gone, in the latter case you can at least can be reimbursed. Depending on the value of what's been taken, that can be a big deal.

Re:Sure, "in seconds" (0)

Anonymous Coward | about 2 years ago | (#42221691)

the plug for the magic electrons is on the bottom of the lock you dumb fuck

Hotel Safes Problematic Too (2)

eric2hill (33085) | about 2 years ago | (#42214705)

I was just in a hotel last week and had put my laptop in the room safe. I entered my 6 digit code and locked the safe. Two days later, I tried to open it and it wouldn't take my pin. I called the hotel staff and a maintenance guy came to my room with a small 10-key pad that had an LCD display. He plugged an RJ45 cable into a port on the bottom of the locking device, entered 2468#, then 1357#, and the safe opened. After it was open, it flashed LO-BAT, so that explains why it lost my combination.

If it's as easy as having one of those pin pads, why even have the safe in the room?

Re:Hotel Safes Problematic Too (0)

Anonymous Coward | about 2 years ago | (#42215953)

many of them are 000000 or 123456 for the combination too...

Re:Hotel Safes Problematic Too (1)

SydShamino (547793) | about 2 years ago | (#42216335)

When we checked into the Bellagio in Vegas a long time ago, we found our room safe already locked. We called down to the desk, and they sent up three guys: a technician, a security dude to stand behind the technician, and a security guy at the door.

The technician had to plug something in and manipulate the lock. When it opened, the security guy behind him looking over his shoulder confirmed it was empty, said so out loud, and the guy at the door radioed the information down to someone.

So while it might have been just as easily hackable, the hotel's policies at least made it look like it was a much bigger deal.

Re:Hotel Safes Problematic Too (1)

bWareiWare.co.uk (660144) | about 2 years ago | (#42217597)

It is entity possible that actual authentication happened before he even came to your room.

They obviously know the serial number of the safe in your room. It may have required physical keys, codes, and biometrics from multiple high-ranking employees to download a single use time-limited code onto that key-pad.

-- probably not though.

The reason this was such a big deal.... (1)

mark-t (151149) | about 2 years ago | (#42215475)

One, the vulnerability is such that after the fact there is no indication that the lock was ever hacked. If somebody has used this hack on a lock, there is no way for the owner or anyone else to tell that somebody has bypassed it (as there would be with a physically broken lock, for instance).

Two the hack did not require access to abnormally sophisticated skills or tools (arduino's can be purchased, retail, by anybody, and used by anybody, even if they do not know how to how to program, any more than it requires unusually specific skills or tools to... say, use a word processor, or build ikea furniture).

Three, the port did not require any special tools to access. It was accessible from the outside of the unit, and was common port type, so the type of plug that fits it are cheap and easily to find.

In a nutshell, once the means of bypassing this vulnerability became widely known, Onity locks became about as practical a means of security as those which might put its assembly hardware (of common type) access on the the same side of the door as that which is supposed to need some sort of key or pass code to enter.

You 7a1l it.. (-1)

Anonymous Coward | about 2 years ago | (#42216109)

Is the group that volume of NetBSD posts on Usenet are isn't a lemonade

Onity was totally insane. (2)

140Mandak262Jamuna (970587) | about 2 years ago | (#42217801)

When the news about the hack got out, the company came out with "two levels of fixes".

The first level is basically making the DC charging port more difficult access. Replace plastic with metal etc. It was willing to ship that thing for free.

Then, it had the second second level fix, flashing new firmware. It wanted some 40$ per lock for the locks that were capable of accepting the patch! This is basically daylight robbery. There is simply no justification for charging that much for a security upgrade in software! If the locks were not capable of being upgraded, then the entire board has to be changed, costing even more money.

I think Onnity does not seem to get one striking fact. 90% of the motels and economy hotels are owned by Indian immigrants. It is very much possible they have a cousin back home who might hack out a patch.

Check for New Comments
Slashdot Login

Need an Account?

Forgot your password?