Hackers create hotel master keys that can access millions of rooms

Security researchers say it takes an average of 60 seconds to gain access to any hotel room using the hacking technique

The technique works on key cards made by Assa Abloy, which counts some of the world's largest hotel chains among its customers. (REUTERS)

Millions of hotel rooms are vulnerable to hackers after researchers found a technique to create master keys that can open rooms.

Researchers from the cybersecurity firm F-Secure discovered the flaw with key cards used by some of the world’s biggest hotel chains, including Intercontinental, Radisson and Sheraton Hotels and Resorts.

Tomi Tuominen and Timo Hirvonen from F-Secure began investigating the vulnerability 15 years ago after a laptop belonging to one of their colleagues mysteriously went missing from a hotel room.

The flaws they discovered with key cards made by the world’s largest lock manufacturer, Assa Abloy, allowed them to create a master key using any key card from a hotel, even one that was long-since expired.

“The hack consists of three steps,” Mr Tuominen explains to The Independent. “Firstly, get access to a key card, it doesn’t matter which. Secondly, use a relatively-cheap piece of hardware, combined with our custom software, to read the card and search for the master key code.

“Thirdly, write the master key onto the key card, or any other key card, to gain access to any room in the facility.”

F-Secure researcher Timo Hirvonen shows a device that is able to create a master key out of a single hotel key card in Helsinki, Finland April 19, 2018. (Reuters)

Mr Tuominen and Mr Hirvonen say that it takes an average of 60 seconds to gain access to a room using this technique.

The researchers, who are set to present their findings at the Infiltrate conference later this week, informed Assa Abloy of the vulnerability and offered a patch to fix it. It is expected to take a long time to roll out the fix across all hotels affected.

“We appreciate F-Secure’s ethical approach in bringing these issues to our attention,” a spokesperson for Assa Abloy said.

“We strive for the utmost security and quality in our products, so we are glad to have the opportunity to ensure our products pass the most rigorous evaluations. With these updates, we have elevated hospitality security to the next level.”