Your Hotel Room May Not Be As Secure As You Think

by December 13, 2012 12/13/12

Staying safe and protecting your valuables when away from home should always be a priority. Like most people, you might think that your electronically locked hotel door is secure enough to keep out the unwanted. There’s no physical lock to pick and you need a key card to get in, that’s good, right?

Unfortunately, it’s not. There’s a tiny device out there that can open approximately one third of all hotel doors in seconds.

Using an Arduino microcontroller and a few other components, almost anyone can build a device small enough to fit inside of a dry erase marker. This can then be used to unlock most hotel doors, including the dead bolt, in no time at all.

Watch the NBC News Report below and see what you think.  What unnerves me the most about this situation is that the President of the American Hotel and Lodging Association  doesn’t feel that guests are vulnerable.  His statement? They have “extra security in a lot of the hotels.” It does look as if Onity is finally starting to fix this issue though.  Forbes  recently shared news of their progress a few days ago but with this being one of the most popular locks for hotel room doors, it may take a while to secure all of them.

Note: The purpose of showing this is to inform the public of this issue. Don’t be lulled into a false sense of security in anything you do. We’ve always advocated providing information educates on the illusion of security.

This hack was discovered by  Cody Brocious who posted an excellent writeup on how and why it works to open these types of locks.

Matt Jakubowski, a pentester for Trustwave SpiderLabs, did a test at home with an Onity door lock and a device he built himself.

Image by Matt Jakubowski

 

What You Can Do

So now that you know how it all works, how can you secure yourself and your belongings? It’s probably a good idea to call the hotel ahead of time and find out if they use Onity locks on the doors and if they do, ask if the locks have been upgraded. Ultimately, no lock is truly safe, but staying at a hotel with a massive security breach is obviously not a good idea.

If you are already in the hotel and in the room, use the chain on the inside of the door. If someone manages to open your deadbolt from the outside (as this device can), they would only be able to open the door a couple of inches which would provide you time to call for help. Just don’t think that the chain is the be-all end-all answer, but it is an added safety measure. This obviously only works if you’re in the room.

When you leave the hotel, use the safe in the room or one at the front desk if they have them. The easiest solution is to simply bring your valuables with you. If you do have to leave items in the room, it may be good idea to hide them in plain sight. Here are some interesting ways to store your stuff when you leave your hotel room.

Do note that these aren’t truly “safes” as they don’t lock. They do however allow you to keep small items relatively secure. If you want to save money, get creative and try and make some of these yourself.

Another option is something like the Pacsafe steel mesh cabling, which covers your entire bag or pack and could possibly deter a thief. What’s nice about Pacsafe devices like the image on the right, is that it completely covers your luggage, it’s not just a cable lock that leaves the majority of your bag still exposed.

Face it though, all security is ultimately defeatable by someone or something. Take the approach that we like to mention, all security is just simply buying time…


Are you getting more than 14¢ of value per day from ITS Tactical?

Please consider joining our Crew Leader Membership and our growing community of supporters.

At ITS Tactical we’re working hard every day to provide different methods, ideas and knowledge that could one day save your life. Instead of simply asking for your support with donations, we’ve developed a membership to allow our readers to support what we do and allow us to give you back something in return.

For less than 14¢ a day you can help contribute directly to our content, and join our growing community of supporters who have directly influenced what we’ve been able to accomplish and where we’re headed.

Click here to learn about all the benefits and Join!


crchristo91
crchristo91

Wooden door wedges are a direct violation of almost all Hotel Fire Safety. This could actually cause serious trouble for the hotel owners and employees. Use a plastic one instead. Super Glue? Seriously? Are you trying to damage the property you're staying at? Most hotels have extra manual looks on the insides of the rooms that cannot be tampered with by using any electrical devices. 

Eric Ebeling
Eric Ebeling

I always travel with a simple wooden door wedge...if you're in a room and someone tries to force the door, the resistance offered by the wedge buys you time to get your shit together and hopefully makes the slobs lose interest. The 'Do not disturb' sign is also handy, if you're nipping out, put the sign on the door & run the shower...(I had one friend that used to carry an empty holster, he'd leave it on the bedside cabinet... anyone entering would see the 'do not disturb' - hear the shower running, see the holster & think 'Oh crap...what kind of guy takes a gun into the shower?')

Ryan Rhoades
Ryan Rhoades

99c super glue... you fill that port with superglue when you first get to your room... they'll never get it all out of there to be able to use that pen with... with how small the hole is not a lot of tools would allow them to scrap it out enough...

this is a quick in for thieves if they realize it wont work on your room they will likely move on to the next...

Ryan Rhoades
Ryan Rhoades

99c super glue... you fill that port with superglue when you first get to your room... they'll never get it all out of there to be able to use that pen with... with how small the hole is not a lot of tools would allow them to scrap it out enough... this is a quick in for thieves if they realize it wont work on your room they will likely move on to the next...

redbear762
redbear762

From staying in hotels downrange, I learned that a simple chock or doorstop can be enough to deter/slow down an intruder.

ShadowCougar
ShadowCougar

The locks in my hotel actually have a physical lock back up in the underside. (most do in case the batteries die in the lock). It is better to always assume that unless you set up security yourself, it is not secure.

Tasi
Tasi

Wow ten bucks is a great deal. I feel like that little device would be a nice thing to take to a hotel room. thanks for sharing that.

Dax Murray
Dax Murray

Something else you can take with you are rubber door stops... Place one behind the door while you're in the room.. I read it in a Vince Flynn book and may have heard about it on here or somewhere else.

Turf
Turf

Another safety measure to take in hotels (as well as your own home) is to get a mace door jammer (or similar device). It is basically like putting a chair against the door (except it can be adjusted to wedge very tightly). Not only do you have to worry about criminals breaking in, but the hotel staff have master keys. I feel a lot more comfortable with that in place.

Sesrun
Sesrun

Even without this vulnerability hotel locks are not very secure. Check out the videos at these two links on how to go under the door to bypass a lock (and how to mitigate such an attack), and how to bypass a chain lock. http://bit.ly/U4Y4o9 and http://bit.ly/UpXuOX

You can also see a full presentation on Hotel Lock Hacking by Babak and Deviant Ollam from "The Next Hope (2010) at http://vimeo.com/13764069

Sesrun
Sesrun

Even without this vulnerability hotel locks are not very secure. Check out the videos at these two links on how to go under the door to bypass a lock (and how to mitigate such an attack), and how to bypass a chain lock. http://bit.ly/U4Y4o9 and http://bit.ly/UpXuOX You can also see a full presentation on Hotel Lock Hacking by Babak and Deviant Ollam from "The Next Hope (2010) at http://vimeo.com/13764069

JD Wallace
JD Wallace

Exactly, Highwaystreets! I live by the old saying "Don't rely on others to protect you and your stuff".

Highwaystreets
Highwaystreets

That really doesn't surprise me but I've always been extra cautious in hotels. Staff have master keys for all rooms and inside jobs are more common then people think.

I try and keep all valuables at home and the ones I'm forced to bring with me usually leave the room with me or get locked in the room safe.

Highwaystreets
Highwaystreets

That really doesn't surprise me but I've always been extra cautious in hotels. Staff have master keys for all rooms and inside jobs are more common then people think. I try and keep all valuables at home and the ones I'm forced to bring with me usually leave the room with me or get locked in the room safe.

Hopper
Hopper

I recently ran across some battery-powered alarm door stops. They have a sensor on the ramp that turns on a 120-db or so alarm if someone opens a door onto it, giving you a quick alert and possibly scaring off the offender. They are fairly cheap at around 10 bucks or so.

NickM
NickM

Hotel safes are just as vulnerable. There are plenty of hotels that don't change the master code from 000000, and at most hotels where the master code *has* been changed, the whole staff knows it.

The Latest
Squawk Box