Since identifying the vulnerability, F-Secure has been working with Assa Abloy over the past year to develop a fix that will make its key systems harder to hack. F-Secure told the site, “a malicious actor could download guest data or create, delete, and modify guest entries.”

The hackers gained access to VingSecure’s server by unplugging a cable from a computer at a hotel’s reception desk, allowing them to see guests’ room assignments. The pair of hackers told Gizmodo, a technology-news website, that it is not just keycards that are vulnerable to thieves. Messrs Tuominen and Hirvonen say their hack, which uses software they created, allows them to turn any VingSecure keycard-including discarded and disabled ones-into a master key. Staff keys, such as those carried by cleaners, are particularly valuable targets, since they can access all guest rooms. By holding an RFID reader near a keycard, a hacker can capture the card’s response and then use it later to create a new card with the same properties. Many keycards use electromagnetic fields known as radio-frequency identification (RFID). But the basic concept goes something like this. Messrs Tuominen and Hirvonen have not revealed exactly how their hack works, for fear of inspiring more hackers and thefts like the one that hit their colleague.

The BBC reports that big hotel chains such as Sheraton, Hyatt and Radison use locks made by VingSecure’s parent company, Sweden’s Assa Abloy (although the company has not formally stated which hotels use the vulnerable version of the software). According to F-Secure, the affected software is used in more than 40,000 hotel properties across 166 countries. Tomi Tuominen and Timo Hirvonen of F-Secure, a cyber-security firm, devised a hack that they say allows them to create a master key that mimics the guest keycards produced by VingSecure, a manufacturer of hotel locks. Now they have succeeded-and in the process they have exposed a security vulnerability that leaves millions of hotel rooms susceptible to theft.

So how did the thief get into the room? Two of his colleagues spent more than a decade trying to answer that question. On returning to his hotel room, he found that his laptop had been stolen, but there was no evidence of forced entry. That is exactly what an attendee at a hacking conference in Berlin in 2003 did when the keycard-operated lock of his hotel room got hacked. WHEN a hacker gets hacked, hackers hack back.

Timo hirvonen f secure