Unsaflok flaw can let hackers unlock millions of hotel doors

Researchers disclosed “Unsaflok,” a chain of vulnerabilities in Dormakaba Saflok electronic RFID locks that lets an attacker create two forged MIFARE Classic keycards to rewrite a lock’s data and open any room; the issue impacts about 3 million doors at 13,000 properties, can be executed with inexpensive tools (Proxmark3, Flipper Zero, NFC phones), and although no confirmed in-the-wild exploitation has been reported, remediation is ongoing and a majority of locks remained vulnerable as of March 2024.