Master keys for hotel rooms can be created “out of thin air,” F-Secure, a Finnish cyber-security firm said in a statement this week, adding that room keys at major hotel chains worldwide “can be hacked to gain access to any room in the building.”

The design flaws were discovered in the lock system’s software, used to secure millions of hotel rooms worldwide, according to F-Secure. Two intrepid cybersecurity researchers have figured out a way to crack the security systems of hotel rooms around the world, exploiting lapses in the electronic lock systems made by Swedish lock manufacturer Assa Abloy, according to a Wednesday press release. “Assa Abloy has developed a software patch that corrects the issue and we are working diligently to apply the software patch as quickly as possible.”

Here’s how the hack works: The bad guys get a keycard from the target hotel. Using off-the-shelf hardware, F-Secure’s researchers were able to read these key cards remotely — say, through your pocket — and using the same device, effectively circumvent the electronic key card system’s protections in just a matter of minutes, creating their own master keys out of thin air. “You can imagine what a malicious person could do with the power to enter any hotel room, with a master key created basically out of thin air,” Tomi Tuominen, Practice Leader at F-Secure Cyber Security Services, said in the statement. When the researchers reported the theft, hotel staff dismissed their complaint, given that there was not a single sign of forced entry, and no evidence of unauthorized access in the room entry logs,” the announcement continues.
A flaw, called the "Ghost in the Locks" exploit, is reported with hotel keycard systems created by the Swedish lock company Assa Abloy. The company states that they began deploying a patch in February.