Security research firm F-Secure has discovered a critical vulnerability in electronic locks made by the world’s largest lock manufacturer, Assa Abloy. The vulnerability allowed F-Secure researchers to gain access to any locked room in hotels secured by one of Assa Abloy’s electronic lock systems — leaving roughly 40 thousand major hotels around the world potentially exposed.
“The researchers’ attack involves using any ordinary electronic key to the target facility – even one that’s long expired, discarded, or used to access spaces such as a garage or closet. Using information on the key, the researchers are able to create a master key with privileges to open any room in the building. The attack can be performed without being noticed,” F-Secure’s announcement reads.
With this exploit, F-Secure researchers were able to gain “master key” access to any hotel facility using Assa Abloy’s VingCard system — all they needed was a guest’s key card. Using off-the-shelf hardware, F-Secure’s researchers were able to read these key cards remotely — say, through your pocket — and using the same device, effectively circumvent the electronic key card system’s protections in just a matter of minutes, creating their own master keys out of thin air. To be clear though, this system is primarily used in the hospitality industry, and consumer Assa Abloy products are unaffected.
“You can imagine what a malicious person could do with the power to enter any hotel room, with a master key created basically out of thin air,” said Tomi Tuominen, practice leader at F-Secure.
Tomi said F-Secure doesn’t believe anyone is currently using this exact exploit in the wild, which should help all you frequent travelers breathe a sigh of relief. Still, that doesn’t mean there aren’t similar vulnerabilities in electronic key card systems. After all, F-Secure’s odyssey to discover this vulnerability was kicked off after one of its researchers experienced a similar exploit firsthand.
“The researchers’ interest in hacking hotel locks was sparked a decade ago when a colleague’s laptop was stolen from a hotel room during a security conference. When the researchers reported the theft, hotel staff dismissed their complaint, given that there was not a single sign of forced entry, and no evidence of unauthorized access in the room entry logs,” the announcement continues.
F-Secure has been working hand in hand with Assa Abloy to mitigate this particular vulnerability and develop software patches for all affected hotel properties.
“I would like to personally thank the Assa Abloy R&D team for their excellent cooperation in rectifying these issues,” said Tuominen. “Because of their diligence and willingness to address the problems identified by our research, the hospitality world is now a safer place. We urge any establishment using this software to apply the update as soon as possible.”
Apple is less than a day away from launching its highly anticipated OLED MacBook Pro with a touch-sensitive screen. But it appears that the upgrade is going to cost a pretty penny. According to a report by Bloomberg, Apple is reportedly eyeing a starting price of $2,899 for the 14-inch MacBook Pro, while the 16-inch version could start at $3,399 in the US.
"At $2,899, the 14-inch model would mark the highest starting price for a new MacBook Pro model, surpassing the $2,799 Apple charged for a 17-inch version introduced in 2006," says the report. The report claims that Apple is targeting a minimum price hike of $400 for its upcoming redesigned 14-inch and 16-inch MacBook Pro models.
I've spent a good amount of time digging into the spec sheet of the new M6 MacBook Pro (14-inch), and for all intents and purposes, this is a classic Apple "chip and connectivity" refresh. It's not a full redesign. The chassis, Liquid Retina XDR panel, speakers, ports, and battery, all of them carry over unchanged.
However, the M6 brings more cores, stronger on-device AI, higher memory bandwidth on the larger configs, and modern wireless. Here’s the practical rundown of what actually improved, and whether those gains are worth your money.
Two new highly requested iCloud plugins just got added to ChatGPT, giving people who rely on Apple’s Mail and Calendar services a way to search emails, check appointments, and manage their schedules directly through the chatbot.
The integration is rolling out to all ChatGPT plans, including the free tier. You can access it on the web, desktop, and iOS.