DEF CON 32 - Unsaflok: Hacking millions of hotel locks - Lennert Wouters, Ian Carroll

[BLUF: A vulnerability in Dorma Caba Saf Lock hotel door systems allows attackers to clone and resequence locks, enabling access to any room in a property using just one stolen card, with the attack exploiting weak encryption and hardcoded keys.]2:43

Key Takeaways:
• Saf Lock systems use a hardcoded substitution cipher for card encryption, shared across all properties, making decryption trivial 12:03.
• Attackers can resequence a lock using a forged resequencing card, invalidating previous guest keys and granting access to all doors in the property 17:00.
• The vulnerability stems from weak key derivation and lack of unique per-property encryption, with the system being vulnerable since 1988 27:41.
• A new enhanced security mode uses AES encryption and Myer Ultralight C cards, with secure elements in new encoders to mitigate risks 22:47.

The attack highlights long-standing security flaws in legacy hotel lock systems, now being addressed through firmware updates and hardware upgrades, though adoption remains slow due to integration complexity and cost 33:55.

Sources:

• 2:43 Discussion of the vulnerability’s core and initial motivation.
• 12:03 Explanation of the shared substitution cipher and its implications.
• 17:00 Description of the resequencing attack and its effectiveness.
• 22:47 Details on the enhanced security mode and improved encryption.
• [33:55](https://www.youtube.com/watch?v=4cx0RUV7i0s&t=2