Hackers found a way to open any of 3M hotel keycard locks
Researchers have revealed a technique to open millions of Dormakaba Saflok hotel keycard locks using inexpensive tools that exploit weaknesses in both the lock maker’s encryption and the MIFARE Classic RFID system. Commenters highlight that a single card from a property can be enough to compromise every door, that electronic deadbolts often don’t add real protection, and that hotels and access-control vendors routinely favor insecure, legacy tech for cost and convenience. Many argue manufacturers have been too slow to patch vulnerable installations and suggest travelers rely on additional physical security if they’re concerned.
Title and “3M” Confusion
- Many readers initially misread “3M” as the company, not “3 million,” prompting calls to retitle the submission.
- Long tangent on notation: M vs MM vs mm, SI units vs accounting shorthand; some argue for “3MM” or spelling out “3 million” to avoid ambiguity.
Nature and Impact of the Saflok Vulnerability
- Vulnerability affects millions of Dormakaba Saflok locks; one valid card from a property can be used to open any room there.
- Attack can be executed with inexpensive tools (Proxmark, Android, Flipper Zero, blank cards).
- Deadbolt is controlled by the same keycard system, so it does not add real protection.
Hotel Deadbolts and “Security Theater”
- Surprise that deadbolts don’t provide independent security; others say this is intentional so staff and emergency responders can always enter.
- Discussion of “swing bar” latches and how bypass tools and DIY methods can defeat them.
- Broader point: many locks mainly deter honest people; serious attackers have multiple fast bypass options.
Keycard Tech, RFID, and NFC Security
- MIFARE Classic widely regarded as effectively broken; cloning and rapid attacks are possible.
- Many access systems only check a static ID, send it in cleartext (e.g., Wiegand), and reuse insecure cards because they’re cheap and compatible.
- Debate whether NFC is inherently more secure; one side claims it’s designed for secure, short-range encrypted use, the other stresses base NFC has no built‑in encryption and security depends entirely on higher‑level protocols.
Vendor Response and Responsibility
- Dormakaba was informed in 2022; as of the article, only ~36% of locks reportedly updated.
- Some view this as unacceptably slow for a critical security issue; others note customers also resist upgrades due to cost and complexity.
Operational and Social Risks
- Even without hacking, many hotels reissue keycards with minimal or no ID checks, so social engineering remains a major threat.
- Various explanations of how hotel cards actually work: offline locks, data and expiry written to card, “new key invalidates old” logic.
Guest and Tenant Mitigations
- Suggestions: door jammers, straps, extra physical devices when in the room.
- For apartments, multiple stories about changing cylinders or avoiding insecure RFID locks, with tension between tenant security and landlord/emergency access requirements.