Quelques mois avant les #jo2024 , une vulnérabilité majeure a été découverte dans Saflok, une techno utilisée partout dans le monde (surtout dans les hôtels) pour l'accès à des chambres via carte #RFID. Ça a été baptisé #Unsaflok et c'est décrit en détail sur https://unsaflok.com/

Le processus de patch a débuté dès Novembre 2023, le site parle de 36% des serrures qui ne sont plus vulnérables. Pour celles qui le sont toujours, par contre, la faille est assez dramatique :

> An attacker only needs to read one keycard from the property to perform the attack against any door in the property. This keycard can be from their own room, or even an expired keycard taken from the express checkout collection box.

Les chercheurs n'ont pas publié plus d'infos sur les vulnérabilités (i.e. pas de PoC). Un article de WIRED sur le sujet : https://www.wired.com/story/saflok-hotel-lock-unsaflok-hack-technique/

https://www.schneier.com/blog/archives/2024/03/security-vulnerability-in-safloks-rfid-based-keycard-locks.html

„A team of […] security researchers are revealing a #hotel #keycard hacking technique they call #Unsaflok. The technique is a collection of #security vulnerabilities that would allow a hacker to almost instantly open several models of #Saflok-brand #RFID-based keycard locks sold by the Swiss lock maker Dormakaba. The Saflok systems are installed on 3 million doors worldwide, inside 13,000 properties in 131 countries.“

"Unsaflok is a series of vulnerabilities that, when chained together, enable an attacker to unlock any room in a property using a pair of forged keycards."

This vulnerability can also unlock deadbolts.

My wife found a device like this to bring to hotel rooms to prevent unauthorized entry: https://www.amazon.com/dp/B0BTTPTPVW?starsLeft=1&ref_=cm_sw_r_cso_sms_apin_dp_144K0NRXC04GA6VW5VFH&th=1.

https://www.bleepingcomputer.com/news/security/unsaflok-flaw-can-let-hackers-unlock-millions-of-hotel-doors/

#infosec #security #doors #locks #safety #Unsaflok

#Unsaflok flaw can let hackers unlock millions of hotel doors

https://www.bleepingcomputer.com/news/security/unsaflok-flaw-can-let-hackers-unlock-millions-of-hotel-doors/

[en] Serious security vulnerabilities in electronic RFID locks from dormakaba

"... identified weaknesses allow an attacker to unlock all rooms in a hotel using a single pair of forged keycards. Over [3m] hotel locks in 131 countries are affected."

"As of 03/2024, ... 36% of the impacted locks have been updated or replaced."

https://unsaflok.com/

#ResearchHighlights #dormakaba #kaba #saflok #unsaflok #privacy #rfid #rfidlock #cybersecurity #ictsecurity #itsecurity #infosec #security