Hackers found a way to open any of 3M hotel keycard locks

MM = 1,000 * 1,000 == 1,000,000 <- thats where MM comes from Roman numerals.

jeasus christ:

https://corporatefinanceinstitute.com/resources/fixed-income...

Seems like you engineers have been behind code and not having to defend your project budgets to CFOs and stakeholders often.

Gamers just write it as 3kk. (PS: never seen MM used as a "million" even in my two decades on the internet)

Interesting, I'd seen it as "MM", as in "Thousand Thousand" in Roman numerals.

Of course lowercase "mm" is most recognizable as millimeter, so that would be confusing in a different way.

3mm hotel keycard form factor.

3MM is three million, for US accountants and thus engineers writing docs for VPs. 3mm is three millimeters.

It took about 1 second to realize that "80 characters" and "unlimited" aren't the only two options.

I think its the lock found on most kids' diaries!

It's the World's tiniest open-source lock.

They were originally "Minnesota Mining and Manufacturing Co."

Seems the 3M branding has worked quite well...

"In business news, 3M and M&M have merged to form, get this, Ultradyne Systems." Simpsons S14E12 [0]

[0] https://www.springfieldspringfield.co.uk/view_episode_script...

You could, of course, still open it with 3M Glass Bubbles or explosives from other brands.

How?

Yes, because the millimeter is “mm”, a meter is “m” and “M” means mega (for example MPa for megapascal) in SI.

I used to work as maintenance on a big chain hotel and we had magstripe card locks, I don’t think strong security is their primary goal as in a hotel the staff can enter any room at any time, the cards me and my team had were “god mode” we could open any door at any time even when locked from inside. If the lock didn’t work “firmware problems, dead batteries, stuck mechanism” we had another device that worked by removing a cover and connecting with a wire, this was also used for testing and FW updates.

Shouldn't that be other way around? Keycard only holding the simple numeric id, which is burned into silicone chip on it and impossible to modify, and the reader at the door, connected to hotel central system checks what privileges that particular keycard grants?

Guess which kind NYC MTA Metrocards are :)

None anymore! They're being phased out as we speak. They were supposed to be end of life last year, though they pushed back end of life EoY 2024, because the MTA is never on time, all the time.

At least with old fashioned keys you can't easily give out a duplicate. I was once in bed, late at night, lights out, when someone let themselves into my room - a rather drunk guy demanding to know what I was doing in his room. The desk clerk had got his room number wrong and given him another card to mine. It all worked out OK, but under other circumstances I could imagine that it might not.

there you go. make a fake coil card and tell the door you're staying for 25 years and a new guest ...get in and own the room

My brain was ANDing the first three paragraphs until I got to the OR in the last paragraph, wondering why in the world those otherwise discrete scenarios would have a combinatorial effect. I'm wired to look ahead to determine AND versus OR with a comma-delimited series, but not with a paragraph-delimited series. It's a cool pattern but very unexpected, and I'm not sure you could successfully tack on other thoughts before or after the series, because what would delimit those from the series without overloading the meaning of a paragraph separation?

Given a need for multi-sentence items within a series, I go for bullet points. Hyphen character to start each point if no rich UL formatting is available.

It's the phone. Have had this happen multiple times with just the card and my phone. Not sure if it's doing some kind of NFC ping on the phone or if there's just enough of a magnetic field around it or what, but I reliably locked myself out of my room the first week doing field work this year by putting my phone and my hotel card in the same pocket.

Heh, You mean IE6 and ActiveX controls :D

Compat is a factor and valid in some instances. It's not valid at all in this case. The old systems are wholly insecure, and should not be offered at all.

This is just some faceless corp being cheap and ignoring the consequences, not their problem.

Maybe operating on the "easier to ask forgiveness than permission" principle?

I think landlords have to give you notice before entering your unit in most areas.

Swapping locks is maybe a ten minute job (probably less if you've done it a lot).

There's nothing to stop a tenant from swapping out the locks, then swapping the landlord's locks back in before a scheduled visit.

I agree, I have never rented anywhere where I was permitted to change the locks.

I have changed the locks everywhere I have rented.

“Oops forgot to tell you.. was I not allowed to do that?”

The only way they would ever find out is if they were trying to enter your place unannounced.

Pretty much everywhere in Europe it is a legal right to be able to do so.

Change the cylinder. Put the old one back, when your rental period ends. Takes 10 mins to replace the cylinder.

One rental apartment where I'd changed the lock core, one day the nice handyman admired the fancy Mul-T-Lock style key while I was letting him in, and later remarked about it to landlord.

So I had to put the old cylinder back in, because of condo rules about the property management company needing keys.

(Though I later learned that the property management company might not have been able to find my unit's key if they ever wanted to. One day, the fire department was at the building, trying to get into a different unit, which had an alarm sounding, but they found that the key box was empty. I was there, so I called the management company, but they refused to send a runner with the key. Even after I handed my phone to the firefighter in charge, and he identified himself and asked them again. :)

This is quite different around the world. I've rented both at places where I could bring my own security locks and others where the landlord pretty much insisted in having a copy of all keys so they could enter in an emergency (e.g. a water leak) without breaking down the front door.

What about giving a copy of the new key to the landlord? It's not as secure as keeping the key to yourself of course, but at least it eliminates the likelihood of prior tenants having a copy which is usually the primary threat.

I’m in Europe, but the first thing I said to the renters of my Grandmother’s house was “here’s the keys, these are all the copies, but feel free to change the lock if it makes you feel more comfortable”.

People need to feel safe in their own homes.

I locked myself out of the room on several occastions, and at the very least they ask for your name and double check in the system. It's not as easy as you describe.

Similar to the wrench principle. [1]

[1] https://xkcd.com/538/

I have an original London Underground Oyster Card which still works fine! It's MIFARE Classic according to Wikipedia, and do often wonder when TfL will cancel them.

There are very fast card-only cloning attacks against even the newest "hardened" cards

Do you mean for MIFARE Classic or for all RFID cards? I was not aware of any cloning attacks for types such as HID Seos.

I don't have a formed opinion on available lockpicking kits other than if you make them contraband they will still be available in different ways and that measure will have the opposite effect.

But a lockpicking kit has one purpose, it's picking locks. A Flipper Zero type device has plenty of legitimate, legal, personal uses in an IoT equipped home.

The Flipper Zero being banned will lead to a flood of copies, not to mention black market OEM versions.

UK is notoriously prohibitive of things that could be used in crimes; I mean, we're talking about a country where a screwdriver is potentially an "offensive weapon" if carried without a "legitimate purpose".

However, that is a fairly extreme case, and most countries don't have such laws on the books (or if they do, what's illegal is "possession with intent").

US lockpicking enthusiasts tend to know their states' laws (see e.g. https://www.toool.us/lockpicking-laws.php)

In general it's probably okay to bring your picks somewhere in most parts of the country if you're a hobbyist.

In general it's a bad idea to carry picks if you're doing anything that a prosecutor could construe as breaking into a building to steal things. This is an area to be particularly aware of for urban exploration, where trespassing is bad but burglary with burglarious tools is like felony bad.

As long as we are talking about specific markets, I have a couple of stories.

In the United States, postal services have access to clusters of mailboxes and some common areas where mailman can leave mail and parcels, which can be entryways or some kind of storage rooms in them, for example, so that the owners can pick them up when they get home. These rooms are locked with padlocks made by several local companies. Once a key is inserted and turned in the lock, it can only be retrieved by turning it in the opposite direction to the default position, but even then they manage to forget them in the locks.

A customer from the USA came to us and asked us to combine this padlock with an intercom system we are developing to signal the administrator that the letter carrier came, opened/closed the lock or forgot the key in it. Nobody wants to switch to RFID, of course, or else the employees of the lock manufacturing company will have nothing to eat, so we had to enlarge the intercom vertically in order to build into it a lock whose transom will close a group of contacts on the panel, letting us know that something is going on. On the edge, lmao.

https://imgur.com/a/63GoaTB

In the UK, mailmen are treated very differently - the intercoms have a special button on the intercom which, when pressed, will open the door so that the mailman can enter and drop off the mail without having to carry keys or RFID identifiers. Normally this button is set for some working hours, for example from 9 to 5 and of course anyone can press it and get into the premises.

In my opinion it's clear that NFC is indeed designed with a higher focus on security than general RFID applications. In fact it emphasizes secure data exchange by design. Yes it is a subset of RFID technology operating at 13.56 MHz. Because NFC enables encrypted communication over very short distances (typically less than 4 cm), it is more challenging for unauthorized interception to happen. Also NFC supports two-way communication, which allows for more dynamic and secure interactions between devices, such as payment systems or secure access controls.

RFID, while versatile and utilized across a range of applications from inventory management to access control, does not inherently prioritize security to the same extent. Its broader application spectrum means that specific security measures can vary significantly based on the use case and the design of the RFID system. For example, passive RFID tags, which are widely used due to their cost-effectiveness and simplicity, can be read from distances up to several meters, potentially exposing them to unauthorized scans. Active RFID tags offer longer read ranges and can incorporate additional security features, but their cost and complexity limit their use to specific applications.

Therefore, when comparing the security aspects directly, NFC's design principles inherently prioritize secure exchanges, leveraging close proximity communication and encryption standards that are well-suited for transactions and sensitive data exchanges. This focus on security, combined with the technology's adaptability for consumer use (e.g., smartphones for payments), underscores NFC's advantage in scenarios where security is paramount.

Most hotels use non-NFC RFID and on top of that most use passive tags. So it is certainly an inherent security flaw of hotel door locks. Unfortunately non-meatspace security is also drastically in need of choosing more effective already existing measures.

OTOH I can use my credit card to open my door - and this is even advertised as a feature by the manufacturer!

It only becomes non-urgent once you can get in the room to confirm they’re dead.

Once the hotel is big enough this will occur so frequently that all those locksmith bills and new doors incur a notable cost, enough that for your next lock system you choose something that lets hotel employees override the deadbolt. Most customers won't care or notice, and those that do are offset by those that got inconvenienced by someone breaking down the door next to them.

Imagine how much faster it would be with an emergency key unlocking the security deadbolt rather than just the door lock. Housekeeping keys do not have the ability to unlock the security bolt, but management does that can used by the appropriate emergency responders. Police doing an investigation with a warrant would be appropriate, but a cop with a hunch would not

You still need to tell the door somehow that the UUID you have now is valid for X days.

Encrypting this information on the card itself is essier