AI
Why Offline Access Control Systems Are Insecure by Design
Online PAX systems pass a facility code and card number to a server that checks authorization. Hotel locks use offline PAX: the card itself carries all access data. The reader and lock never talk to a central server. Privilege escalation becomes trivial because the card can be rewritten. Audit logging is limited to each lock’s memory. Hotels stick with offline because not every door can be wired. The tradeoff is security for convenience.
Dormakaba’s Patch Left Most Hotels Exposed
Dormakaba responded to the original Saflok exploit with a two-part update: move from MIFARE Classic cards to Ultralight C, then enable per-site diversified AES-128 keys. The presenters found that almost every hotel they tested had finished only the first step. Ultralight C in standard security mode still uses the same encrypted data fields. The KDF is hidden, but attackers can bypass it by sniffing the authentication handshake or using a cheap encoder as an oracle.
The HH6 Programmer: A Master Key in One Tap
The HH6 handheld programmer connects to a lock over a serial or NFC interface. It can interrogate any Saflok lock regardless of property ID, reading the facility’s property ID and shift times. That single number is enough to generate a master key. The HH6 also supports Emergency Lock Power Supply mode, which emulates an emergency key and opens the lock directly. No physical card is required. The original talk claimed the HH6 would error out on mismatched property IDs. The presenters found that claim false.
How to Exploit Ultralight C Cards Anyway
Ultralight C cards use a secure handshake, but after authentication the card transmits all data in plain text. Sniffing that exchange with a Proxmark yields the same 17 encrypted bytes used on MIFARE Classic. The KDF for Ultralight C Saflok is embedded in older encoder models. By placing a known UID on a changeable card and writing to it with the encoder, the encoder sends the keys in plain text. Those keys then allow full read/write access to the target card.
Q&A
How do sequence numbers work with duplicate keys and elevators? Sequence numbers are paired with card IDs to differentiate cards in logs; elevators can be programmed to accept any guest key sharing the facility code. ▶ 31:22
Did you find any fully patched (enhanced security) hotels? Only two or three in the cities tested, usually larger properties. ▶ 34:07
Where is the KDF stored for Ultralight C? It lives in the encoder box, not the System 6000 software. Older gen 1 encoders are widely available and can be used as an oracle. ▶ 35:10
Will hotels need to move to DESFire cards? DESFire is supported but costs more per card. Attacks on Ultralight C key recovery are reportedly in development, which may force a shift soon. ▶ 36:28
Notable Quotes
it takes less than a minute from the time you would plug into a lock with an HH6 to the time that you could get a working key Josh Stiebel · ▶ 27:23
upgrading to Ultralite C alone is just a real marginal security benefit over Myare Classic Josh Stiebel · ▶ 28:18
He makes a master key and he mails it to them and they say, ‘Sorry, we don’t believe you. It doesn’t work.’ Josh Stiebel · ▶ 17:43
the KDF isn’t known but you can get around that and it might take a little bit longer to make a key Josh Stiebel · ▶ 28:23
Key Takeaways
- Offline PAX systems encode authorization on the card, making privilege escalation straightforward.
- Upgrading to Ultralight C without enabling per-site AES-128 keys leaves hotels exploitable.
- The HH6 programmer can read any lock’s property ID and generate a master key in under 60 seconds.
About the Speaker(s)
Noah Holland is a Cybersecurity Undergraduate at Michigan Tech. He is the president of the MTU Linux User’s Group and MTU RedTeam, specializing in Access Control & Physical Security.
Josh Stiebel recently graduated with a CS degree from Michigan Tech. He helps run the access control village at various conventions. He is currently walking from Mexico to Canada on the PCT.