While the revelation is worrying, we should keep things in perspective. Should we be worried about hotel security? Installing the updates is somewhat labour-intensive since you need first to update the backend software and then go to each and every lock to update the lock firmware.' However, it is up to the hotels whether they patch their systems in a timely manner. 'The patches fix all the vulnerabilities we have identified. 'We have worked together with Assa Abloy for over a year to address these security issues and the patch has been available since early 2018', Hirvonen told Telegraph Travel. It took us a considerable amount of time and effort to come up with this attack,' Hirvonen told Telegraph Travel.Īfter successfully bypassing the electronic lock system, F-Secure informed Assa Abloy of their findings and they have helped to develop software fixes.Īssa Abloy have since rolled out updates, although it is not clear how many hotels have actually implemented the change. 'Although not impossible, most likely this is something that a bedroom hacker would have a hard time replicating. They have stressed that the exact details of the hack will not be disclosed.Ĭould a regular hacker replicate a similar attack? 'Building a secure access control system is very difficult because there are so many things you need to get right. 'We wanted to find out if it's possible to bypass the electronic lock without leaving a trace,' Timo Hirvonen, Senior Security Consultant at F-Secure, said in a public statement. So F-Secure's researchers Tomi Tuominen and Timo Hirvonen decided to investigate themselves.

Hotel staff found no sign of forced entry and there was no evidence of unauthorized access to the room through their logs. The research began over a decade ago when a member of staff at F-Secure discovered their laptop had been stolen from a hotel room during a security conference.

Hotels with an Assa Abloy locking system include major chains such as Sheraton, Radisson and Hyatt. Researchers at a leading cybersecurity company have revealed that millions of hotel rooms around the world have been vulnerable to a hack, after discovering a way of creating a master key that can open doors.Ĭybersecurity company F-Secure this week announced that hotel rooms fitted with electronic locks made by Assa Abloy, the world's largest lock manufacturer, could have been exploited by attackers to access any room. Hotel keycard locks can be hacked, a cybersecurity firm has found.

Timo hirvonen f secure