An attack method ``Unsaflok'' is discovered that hacks the hotel card key and unlocks the door in a few seconds
An attack method called `` Unsaflok '' has been announced that exploits vulnerabilities in card key systems to unlock them. The card key system targeted by Unsaflok is used in hotels around the world, including Japan, and it is said that more than 3 million doors will be affected by the attack.
Unsaflok | Unsaflok is a series of serious security vulnerabilities in the Saflok brand of hotel locks.
◆Types of doors that can be unlocked with Unsaflok
Unsaflok is an attack method that targets the card key system ' Saflok ' manufactured by dormakaba . There are multiple types of card key systems that use Saflok, but all Saflok-based systems are subject to attacks.
Saflok's adoption system is used by more than 13,000 hotels in 131 countries, with more than 3 million doors affected by the attack.
◆Attack method
Unsaflok attacks require one card key from the same facility as the door you want to unlock and one
After preparing the two types of cards, use an NFC card reader to read the contents of the 'same facility card key' and write the necessary information on the 'MIFARE Classic standard card'. The NFC card reader can also be used as an alternative to Android smartphones.
Once the card preparation is complete, hold up the 'card key from the same facility' and the 'MIFARE Classic standard card' in order over the card key reading part of the door to be attacked.
The door is now open. With Unsaflok, you can unlock all Saflok-compatible locks in the facility just by obtaining the 'same facility card key'.
The research team that discovered Unsaflok plans to release details of the attack in the future. However, the proof-of-concept code is kept private for security reasons.
◆Compatibility status
The research team reported the existence of Unsaflok to dormakaba in August 2022, and dormakaba began updating and replacing the card key system targeted by the attack in November 2023.
In order to avoid attacks by Unsaflok, it is necessary to ``update or replace the software of all card key systems in the facility,'' ``reissue all card keys,'' ``update the management system,'' and ``update related systems such as elevators and parking lots.'' ” is required. For this reason, at the time of article creation, only about 36% of systems had completed countermeasures against Unsaflok.
◆How to tell whether the measures have been taken or not
In systems where Unsaflok measures have been completed, the card key standard has been upgraded from 'MIFARE Classic' to ' MIFARE Ultralight C. ' Therefore, by reading the card key with the smartphone app 'NFC TagInfo by NXP' and checking the compatible standards, you can tell whether or not measures against Unsaflok have been completed. NFC TagInfo by NXP has an iOS version and an Android version, which can be downloaded from the link below.
'NFC TagInfo by NXP' on the App Store
https://apps.apple.com/jp/app/nfc-taginfo-by-nxp/id1246143596
NFC TagInfo by NXP - Apps on Google Play
https://play.google.com/store/apps/details?id=com.nxp.taginfolite
Related Posts:
