Image copyright F-Secure Image caption The hack could be used to access restricted floors as well as locked rooms

Millions of electronic door locks fitted to hotel rooms worldwide have been found to be vulnerable to a hack.

Researchers say flaws they found in the equipment's software meant they could create "master keys" that opened the rooms without leaving an activity log.

The F-Secure team said it had worked with the locks' maker over the past year to create a fix.

But the Swedish manufacturer is playing down the risk to those hotels that have yet to install an update.

"Vision Software is a 20-year-old product, which has been compromised after 12 years and thousands of hours of intensive work by two employees at F-Secure," said a spokeswoman for the company, Assa Abloy.

"These old locks represent only a small fraction [of the those in use] and are being rapidly replaced with new technology."

She added that hotels had begun deploying the fix two months ago.

"Digital devices and software of all kinds, are vulnerable to hacking. However, it would take a big team of skilled specialists years to try to repeat this."

Assa Abloy's locks are used by some of the world's biggest hotel chains - including Intercontinental, Hyatt, Radisson and Sheraton - although it has not disclosed which properties still use a compromised version of the Vision by VingCard system.

The F-Secure researchers said they began their inquiry after a colleague's laptop was stolen from a hotel room without the thief leaving behind any sign of unauthorised access.

Image copyright F-Secure

"We wanted to find out if it's possible to bypass the electronic lock without leaving a trace," explained Timo Hirvonen, describing the Ghost In The Locks exploit.

"Only after we thoroughly understood how it was designed were we able to identify seemingly innocuous shortcomings [and] come up with a method for creating master keys."

He added that data scanned from any discarded VingCard could be used to mount the attack, even if the card's access privileges had long expired or had been used to open a garage or other parts of the targeted hotel rather than a bedroom.

The hack can also be applied to access other areas of a hotel - including sending a lift to a VIP floor of a property - if it is protected by the same system.

F-Secure has confirmed it will not be sharing the hardware and software tools it used to demonstrate its attack with others.</s>STOCKHOLM, April 26 (Reuters) - Assa Abloy, the world's biggest lock group, plans to cut costs further from later this year after posting first-quarter profits that roughly matched expectations.

The group, which has more than doubled sales over a decade and outgrown rivals thanks to acquisitions in a fragmented market, flagged in February it would present new savings this year as it integrates recent purchases.

The Swedish group said on Thursday the programme would run over three years and costs would be in line with previous programmes, with a payback time of around three years.

Assa Abloy expects a pick-up in sales growth this year as customers increasingly switch from mechanical locks to hi-tech alternatives ranging from fingerprint scanners to smartphone-activated systems.

New CEO Nico Delvaux, who joined Assa Abloy from Finnish mining equipment group Metso, said on Thursday he planned to further develop Assa's strategy with focus on product leadership, cost efficiency and a strong acquisition agenda.

"I am confident that we will create new business opportunities through our new products and solutions, and that we have seen only the initial phase of the market transition and technology shift from mechanical solutions to digital, connected products and services," he said.

Quarterly operating profit was 2.83 billion crowns ($331 million) against a year-ago 2.79 billion and a Reuters poll forecast of 2.86 billion.

Organic sales growth slowed to 4 percent from 6 percent a year earlier, topping a forecast 3 percent. The group said high demand for electromechanical locks and for access control systems boosted sales.

Jan Molin, who stepped down in March after 12 years as CEO, in February predicted core group sales growth in the first half of 2018 above the 4 percent achieved a year earlier.

Before his time at Metso, new CEO Delvaux headed the compressor technique business at Sweden's Atlas Copco , where both Molin and Assa Abloy's Chairman Lars Renstrom held executive positions earlier in their careers. ($1 = 8.5475 Swedish crowns) (Reporting by Anna Ringstrom Editing by Niklas Pollard/Keith Weir)</s>Researchers have discovered that hacking into a hotel room can be done with pretty much any electronic key lying around.

Master keys for hotel rooms can be created “out of thin air,” F-Secure, a Finnish cyber-security firm said in a statement this week, adding that room keys at major hotel chains worldwide “can be hacked to gain access to any room in the building.”

The design flaws were discovered in the lock system’s software, used to secure millions of hotel rooms worldwide, according to F-Secure. Assa Abloy, the lock manufacturer, has issued software updates in response to the security breach.

FLIP PHONES ARE BACK: LESS DISTRACTING AND A LOT CHEAPER THAN A SMARTPHONE

“Assa Abloy has fixed the flaws in the Vision software and issued software updates, released in February. Hotels that have applied the updates to their systems are not vulnerable,” Assa Abloy said in a statement.

Marriott, which uses Assa Abloy's locks, was recently made aware of the vulnerability, a company spokesperson told Fox News.

“We are currently working with the vendor to understand the impact to our hotels,” Marriott said. “Assa Abloy has developed a software patch that corrects the issue and we are working diligently to apply the software patch as quickly as possible.”

Here’s how the hack works: The bad guys get a keycard from the target hotel. “Even one that’s long expired, discarded, or used to access spaces such as a garage or closet,” according to F-Secure. The keycard’s data is scanned and a master key is produced “after a few minutes.” That key can then bypass any lock in the target hotel.



The most insidious part is, all of this can be done unnoticed, according to F-Secure.

“You can imagine what a malicious person could do with the power to enter any hotel room, with a master key created basically out of thin air,” Tomi Tuominen, Practice Leader at F-Secure Cyber Security Services, said in the statement.

So far, there are no known, publicly-disclosed cases of this happening, Tuominen added.

HACKERS ARE GOING AFTER YOUR ONLINE BANK ACCOUNT, REPORT SAYS

The genesis for this research is an incident about a decade ago when a laptop was stolen from a hotel room during a security conference. A complaint was lodged with the hotel but it was dismissed because there was no sign of forced entry or unauthorized access in the room entry logs.

Since the laptop had been stolen from colleague’s room, the researchers decided to investigate further. “We wanted to find out if it’s possible to bypass the electronic lock without leaving a trace,” Timo Hirvonen, Senior Security Consultant at F-Secure, said in a statement. The ensuing research to figure out how to hack the lock system took several thousand hours.



Indeed, the lock maker says it’s a lot more difficult to do than it sounds. “It would take a big team of skilled specialists years to try to repeat the effort. Since the tools are not made available, it is not about just going into a hotel and getting instant access,” Assa Abloy said.

“These locks represent only a small fraction of the hotel locks in the world and are being rapidly replaced with new, more advanced technology,” Assa Abloy added.</s>Security research firm F-Secure has discovered a critical vulnerability in electronic locks made by the world’s largest lock manufacturer, Assa Abloy. The vulnerability allowed F-Secure researchers to gain access to any locked room in hotels secured by one of Assa Abloy’s electronic lock systems — leaving roughly 40 thousand major hotels around the world potentially exposed.

“The researchers’ attack involves using any ordinary electronic key to the target facility – even one that’s long expired, discarded, or used to access spaces such as a garage or closet. Using information on the key, the researchers are able to create a master key with privileges to open any room in the building. The attack can be performed without being noticed,” F-Secure’s announcement reads.

With this exploit, F-Secure researchers were able to gain “master key” access to any hotel facility using Assa Abloy’s VingCard system — all they needed was a guest’s key card. Using off-the-shelf hardware, F-Secure’s researchers were able to read these key cards remotely — say, through your pocket — and using the same device, effectively circumvent the electronic key card system’s protections in just a matter of minutes, creating their own master keys out of thin air. To be clear though, this system is primarily used in the hospitality industry, and consumer Assa Abloy products are unaffected.

“You can imagine what a malicious person could do with the power to enter any hotel room, with a master key created basically out of thin air,” said Tomi Tuominen, practice leader at F-Secure.

Tomi said F-Secure doesn’t believe anyone is currently using this exact exploit in the wild, which should help all you frequent travelers breathe a sigh of relief. Still, that doesn’t mean there aren’t similar vulnerabilities in electronic key card systems. After all, F-Secure’s odyssey to discover this vulnerability was kicked off after one of its researchers experienced a similar exploit firsthand.

“The researchers’ interest in hacking hotel locks was sparked a decade ago when a colleague’s laptop was stolen from a hotel room during a security conference. When the researchers reported the theft, hotel staff dismissed their complaint, given that there was not a single sign of forced entry, and no evidence of unauthorized access in the room entry logs,” the announcement continues.

F-Secure has been working hand in hand with Assa Abloy to mitigate this particular vulnerability and develop software patches for all affected hotel properties.

“I would like to personally thank the Assa Abloy R&D team for their excellent cooperation in rectifying these issues,” said Tuominen. “Because of their diligence and willingness to address the problems identified by our research, the hospitality world is now a safer place. We urge any establishment using this software to apply the update as soon as possible.”</s>Security researchers have built a master key that exploits a design flaw in a popular and widely used hotel electronic lock system, allowing unfettered access to every room in the building.

The electronic lock system, known as Vision by VingCard and built by Swedish lock manufacturer Assa Abloy, is used in more than 42,000 properties in 166 countries, amounting to millions of hotel rooms -- as well as garages and storage units.

These electronic lock systems are commonplace in hotels, used by staff to provide granular controls over where a person can go in a hotel -- such as their room -- and even restricting the floor that the elevator stops at. And these keys can be wiped and reused when guests check-out.

It turns out these key cards aren't as secure as first thought.

F-Secure's Tomi Tuominen and Timo Hirvonen, who carried out the work, said they could create a master key "basically out of thin air."

Any key card will do. Even old and expired, or discarded keys retain enough residual data to be used in the attack. Using a handheld device running custom software, the researchers can steal data off of a key card -- either using wireless radio-frequency identification (RFID) or the magnetic stripe. That device then manipulates the stolen key data, which identifies the hotel, to produce an access token with the highest level of privileges, effectively serving as a master key to every room in the building.

This wasn't an overnight effort. It took the researchers over a decade of work to get here.

The researchers started their room key bypass efforts in 2003 when a colleague's laptop was stolen from a hotel room. With no sign of forced entry or unauthorized access to the room, the hotel staff are said to have dismissed the incident. The researchers set out to find a popular brand of smart lock to examine. In their words, finding and building the master key was far from easy, and took "several thousand hours of work" on an on-off basis, and using trial and error.

"Developing [the] attack took considerable amount of time and effort," said Tuominen and Hirvonen, in an email to ZDNet.

"We built a RFID demo environment in 2015 and were able to create our first master key for a real hotel in March 2017," they said. "If somebody was to do this full time, it would probably take considerably less time.

There was good news, the researchers said.

"We don't know of anyone else performing this particular attack in the wild right now," said the researchers, downplaying the risk to hotel customers.

Their discovery also prompted Assa Abloy to release a security patch to fix the flaws. According to their disclosure timeline, Assa Abloy was first told of the vulnerabilities a month later in April 2017, and met again over several months to fix the flaws.

The software is patched at the central server, but the firmware on each lock needs to be updated.

"This requires someone to be physically present at the lock," the researchers wrote.

But few details are available about the patch. A spokesperson for Assa Abloy did not return several emails and phone calls requesting comment. The company delivered the patch to customers in early 2018, but it's not known how many hotels have rolled out the fix.

Several major hotels, including the Waldorf Astoria in Berlin, the Grand Hyatt in San Francisco, and the Renaissance Downtown in Toronto, are said to be customers of the Swedish lock maker.

We reached out to representatives of Hyatt and Marriott but did not hear back by the time of publication.

A Hilton spokesperson said the company was "aware" of the vulnerabilities.

"The safety and security of our guests are of paramount importance. We are working closely with Ving to remediate impacted systems at a limited number of hotels," said the spokesperson.

The researchers urged buildings using the door locks to update as soon as possible.</s>
• Strong growth was shown by Global Technologies and Entrance Systems and good growth by , EMEA and Americas
• Operating income (EBIT) increased by 2% and amounted to (2,787), corresponding to an operating margin of 15.3% (15.4)

[1] Excluding costs for a new restructuring program for the full year 2016, totaling SEK -1,597 M before tax, corresponding to SEK –1,221 M after tax.

Comments by the President and CEO

The year took off with good organic growth of 4% in the first quarter, despite the negative calendar effect of two trading days less due to an early Easter. We achieved strong or good growth in all divisions. Global Technologies and Entrance Systems reported strong organic growth of 6% and 5% respectively. EMEA and Americas reported 3% organic growth and Asia Pacific reported 4%. Our new products contributed strongly, with high demand for electromechanical locks and for access control solutions.

The first quarter's operating income increased by 2% year-on-year and amounted to SEK 2,829 M, corresponding to an operating margin of 15.3%. The Group's underlying margin improved but was diluted by the acquisitions.

Operating cash flow was seasonally low totaling SEK 575 M for the quarter. We are continuing to focus on cost-efficiency and to deliver on our current restructuring program and, as previously communicated, we expect to announce a new program by the end of 2018.

I spent my first months at ASSA ABLOY on the move, visiting the different Group locations to meet our people, our partners and our customers as well as to get acquainted with the sites, the corporate culture and the business. So far, I have visited 18 of our main locations and I am impressed by the competence, the innovation capacity and the technology driven culture. There have been several changes in ASSA ABLOYs executive team over the last 12 months. I am convinced that we have a strong team in place, equipped with energy and ambition to continue the Group's successful journey. I am both eager and humble in taking on the mission to further develop ASSA ABLOY.

As the new CEO, it is very encouraging to see our strong market position. Product and innovation leadership, backed by the largest installed base of door opening solutions in the world, gives us a very strong platform to grow from. I am confident that we will create new business opportunities through our new products and solutions, and that we have seen only the initial phase of the market transition and technology shift from mechanical solutions to digital, connected products and services.

ASSA ABLOY's strategy, with focus on market presence, product leadership and cost efficiency, has been very successful for many years. In combination with a strong acquisition agenda, this strategy has generated significant long-term value. I look forward to further developing this successful strategy together with my colleagues.

Further information can be obtained from:

ASSA ABLOY is holding an analysts' meeting at 10.00 today at Operaterrassen in Stockholm, Sweden.

The analysts' meeting can also be followed on the Internet at www.assaabloy.com.

It is possible to submit questions by telephone on: +46-8-5055-6476, +44-203-364-5371 or +1-877 679-2993

This information is information that ASSA ABLOY AB is obliged to make public pursuant to the EU Market Abuse Regulation. The information was submitted for publication, through the agency of the contact persons set out above, at 08.00 CEST on 26 April 2018.

This information was brought to you by Cision http://news.cision.com

The following files are available for download:</s>It’s very rare these days that a hotel will give you a real key when you check in. Instead, most chain hotels and mid-sized establishments have switched over to electronic locks with a keycard system. As researchers from F-Secure have discovered, these electronic locks may not be very secure. Researchers from the company have managed to create a “master key” for a popular brand of hotel locks that can unlock any door.

The team began this investigation more than a decade ago, when an F-Secure employee had a laptop stolen from a hotel room. Some of the staff began to wonder how easy it would be to hack the keycard locks, so they set out to do it themselves. The researchers are quick to point out this has not been a focus of F-Secure for 10 years — it took several thousand total man-hours, mostly in the last couple years.

F-Secure settled on cracking the Vision by VingCard system built by Swedish lock manufacturer Assa Abloy. These locks are used in more than 42,000 properties in 166 countries. The project was a huge success, too. F-Secure reports they can create a master key in about a minute that unlocks any door in a hotel. That’s millions of potentially vulnerable hotel rooms around the world.

The hack involves a small handheld computer and an RFID reader (it also works with older magnetic stripe cards). All the researchers need to pull off the hack is a keycard from a hotel. It doesn’t even have to be an active one. Even old and invalid cards have the necessary data to reconstruct the keys that unlock doors. The custom software then generates a key with full privileges that can bypass all the locks in a building. Many hotels use these keys not only for guest rooms, but also elevators and employee-only areas of the hotel.

F-Secure disclosed the hack to Assa Abloy last year, and the lock maker developed a software patch to fix the issue. It’s available for customers to download now, but there’s one significant problem. The firmware on each lock needs an update, and there’s no guarantee every hotel with this system will have the resources to do that. Many of them might not even know the vulnerability exists. This hack could work for a long time to come, but F-Secure isn’t making the attack tools generally available. Anyone who wants to compromise these locks will have to start from scratch.</s>
• Security researchers notified Swedish lock manufacturer Assa Abloy of critical vulnerabilities in their system, forcing them to release an update earlier this year.
• According to the researchers, the company admitted that the flaw they found could affect at least 500,000 hotels.

Two intrepid cybersecurity researchers have figured out a way to crack the security systems of hotel rooms around the world, exploiting lapses in the electronic lock systems made by Swedish lock manufacturer Assa Abloy, according to a Wednesday press release.

Assay Abloy, which created VingCard's "Vision" system, has deployed it at 42,000 properties in 166 countries, including everything from hotel rooms to garages and secure spaces, as noted by our sister site ZDNet.

Tomi Tuominen and Timo Hirvonen, researchers from F-Secure, discovered a way to breach the system after nearly a decade of research following a strange occurrence at a Berlin security conference in 2003. A friend of theirs had a laptop stolen from his hotel room with no signs of forced entry, leading the two men on a decade-long journey to prove their theory that someone had figured out how to manipulate the RFID card reader.

SEE: Cybersecurity strategy research: Common tactics, issues with implementation, and effectiveness (Tech Pro Research)

The specific RFID card reader they were looking into was a typical kind sold by VingCard and created by Assay Abloy for mass use at hotels across the world, as noted by Wired. What Tuominen and Hirvonen have discovered, and will exhibit at a conference in Miami this week, is a program that can not only create cards for certain rooms but a master key for every room, giving potential thieves access to any part of any hotel they choose, the release said.

The main instruments needed are a $300 Proxmark RFID card reading and writing tool and any card, either old or new, from a hotel, according to Wired. From there, Tuominen and Hirvonen only need one minute to steal data from the used card and create a master card that can open any door on the same system.

Both men have tried to downplay any fears hotels and customers may have about the loophole and have actively worked with Assay Abloy to fix their system. Although it took them more than a decade, they said if someone worked full time, they could create a similar system in far less time.

"We don't know of anyone else performing this particular attack in the wild right now," they told ZDNet in an email.

They later added: "Developing [the] attack took considerable amount of time and effort. We built a RFID demo environment in 2015 and were able to create our first master key for a real hotel in March 2017. If somebody was to do this full time, it would probably take considerably less time."

Assay Abloy has since created a new line of locks and released a patch update earlier this year to address the issue, the release said. But the patch has to be installed manually by each hotel in each lock, leading both men to wonder whether the updates had actually been implemented.

There was also a discrepancy in the number of hotel rooms that are vulnerable. According to Wired, Assay Abloy told Tuominen and Hirvonen privately that "the problem affects millions of locks in total," while publicly they have said the problem would only affect close to 500,000 rooms locks.

A spokeswoman for Assay Abloy told the BBC that any electronic device is vulnerable to hacking and that a breach of this kind would require large teams and copious amounts of time.

"Vision Software is a 20-year-old product, which has been compromised after 12 years and thousands of hours of intensive work by two employees at F-Secure," the spokeswoman told the BBC. "These old locks represent only a small fraction [of the those in use] and are being rapidly replaced with new technology."

Tuominen and Hirvonen have said they will not release information on how their device works and will only give a broad overview of their method at the conference in Miami this week, the release noted.

A similar situation six years ago led to a US-wide robbery spree of hotel rooms following the release of a list of possible lock system vulnerabilities by a security researcher. Wired noted in their article that a number of government intelligence agencies, including those in the US and Israel, claim to already have ways to hack into hotel room key systems.

The ACLU noted as far back as 2012 that some security companies were even marketing themselves by advertising their ability to teach people how to crack VingCard locks.

Many major international hotels, including the Intercontinental, Hyatt, Radisson and Sheraton, use VingCard's system and are in the process of updating the locks now that the system's vulnerabilities have been made public.

Being that a stolen laptop was the impetus for this research, it goes without saying that business travelers should use extra caution when traveling and staying at a hotel. Check with management to see if the locks have been updated and, if worried, be sure to bring your valuables with you when you leave the room.
• US Secret Service warns of keyloggers on public hotel computers (ZDNet)</s>Might want to put that chair under the door on your next hotel visit. Security researchers have hacked electronic door locks by scanning old key cards.

Security firm F-Secure uncovered a hard-to-find, but serious design flaw in the electronic locking systems used at many well-known hotel chains, which lets you create a master key. All you need is an old key card, even an expired one from five years ago. The data from that card can be scanned to a handheld device, which is used to unlock any room in the hotel.

The hack also doesn't leave a trace and can be done in minutes with the right equipment.

"You can imagine what a malicious person could do with the power to enter any hotel room, with a master key created basically out of thin air," said F-Secure researcher Tomi Tuominen in a statement.

The good news is that the flaw has been fixed. Assa Abloy, the company that produces the electronic locking software, has been rolling out a software patch to its clients, F-Secure said.

The hack also wasn't easy to develop. The equipment itself can be bought online for a "few hundreds euros," F-Secure said. But the company's researchers spent several thousand hours studying the locking system and developing the software that could hack it.

F-Secure said it hasn't noticed any bad actors exploiting the same flaw. However, the company's researchers began investigating the security of electronic locks after a colleague's laptop was mysteriously stolen from a hotel room.

The hack is a good reminder that leaving your valuables in an unattended hotel room can be a risk. F-Secure has kept technical details of the hack under wraps to prevent malicious parties from replicating it.

Assa Abloy told Reuters that the affected sofware is being used in "several hundred thousand hotel rooms worldwide." In addition to the patches, the vendor has been replacing the affected software with newer technology.

On Thursday, Assa Abloy added in a statement that in February, the company began releasing the patches to fix the problem. Most of the vendor's clients have also been upgrading to a newer platform.</s>Hotel door locks can be compromised by simple tweaks to their in-built security software, according to research from one of the world's biggest cybersecurity firms.

A team from F-Secure found that a software system used in hotels around the world, including many well-known chains, can be hacked to possibly grant criminals entries to multiple rooms.

F-Secure's researchers studied card keys from a wide range of hotels, and found that using hardware costing only a few hundred euros, they could create a tool allowing them to create so-called "master keys" that could bypass the protection offered by Assa Abloy's door locks.

The card key did not even need to be one currently in use, the team said, with some as much as five years old still allowing access.

The hardware kit used to clone keys involved scanning the RFID tag or mag stripe included in a card key, which is then copied by a small device which is then able to generate a huge number of extra keys in a matter of minutes

The researchers notified Assa Abloy of their findings in April 2017, and since then have been working with the company's R&D team to fix the flaws, with Assa Abloy recently issuing a software update to the affected hotels.

“Because of Assa Abloy’s diligence and willingness to address the problems identified by our research, the hospitality world is now a safer place,” says Tomi Tuominen, practice leader at F-Secure Cyber Security Services. “We urge any establishment using this software to apply the update as soon as possible.”
A flaw, called the "Ghost in the Locks" exploit, is reported with hotel keycard systems created by the Swedish lock company Assa Abloy. The company states that they began deploying a patch in February.