Don't put that duffel bag full of cash in the hotel room safe Hotel safes are far less secure than guests are led to believe. Widespread use of default codes and other issues mean that it is relatively easy for criminals to get at hotel guests' valuables, security firm G DATA warns. The input panel, in front of the safe, to enter the PIN code or swipe a card through the credit card …
I don't think anyone's ever thought it sensible to entrust hotel provided safes with their priceless family jewels, but unless the cleaner also dabbles in locksmithing and/or hacking electronics, they're probably still fine for keeping housekeeping's opportunist mitts off my passport and a paltry bit of foreign shrapnel.
This has always been the case. These locks are just a deterent, and won't stand up to any serious attempt at hacking. But what people fail to realise is that it is true of *any* safe. They not unconditionally secure, but usually a reasonable time that a determined attacker will take to open them is quoted (and unless you spend a *lot* it's only in the hours range).
It also reminds me of a trip to the former communist countries, a colleague had his room burgled while he slept in it. After that I took to wearing a moneybelt containing my passport and cards while asleep in bed. If I lost that at least I would have got a cheap thrill. This was the same country that someone stole a railway line from (they only noticed when the train had to stop because there were no tracks in front of it anymore).
I don't always use them when staying in hotels that have them fitted, but when I have I've done so not so much because I feel them particularly secure but because I figure you may be opening yourself up to your insurance provider saying "Sorry you weren't covered" if you had something stolen and hadn't used the safe?
I stayed in a hotel where the mag card were so poor quality I pretty much daily had to get it recoded, requiring only my name and the room number. I once forgot what code I'd used for the safe and asked reception to open it, requiring only my name and room number... I never use the safe now - what would be the point?
A confident manner is all you need. 2 stories from my last company illustrate:
1. Someone walked into one of the branches. Overalls and clipboard. "Sign here please". Put £10,000 of copiers onto dolly, and wheeled them out to his van. Byeee. Wonder how much he got for them down the pub?
2. Chap walks into head office. Finds a nice side office with 3 people in. "I've lost my contact lens, can you help me find it?" Gets them all into the gents looking, then he remembers it might have fallen out in the car. Pops out, nicks their wallets, then to allay suspicion pops back into the gents, "Sorry chaps, it was in the car, thanks for all your help." Leaves. The credit card company spotted the odd transaction, and phoned one of the guys to check it, which was the first time they noticed.
As you say, I've never had trouble getting into a hotel room. At one family occasion my brother managed to go to the desk and get a duplicate key to someone else's room. Even though we'd all booked and paid separately. And the one time I've had to ask to be let back into my room, no questions were asked but the number.
I think you missed the point.
A bypass needs to be available so the hotel can access the safe when the guest forgets the code or the batteries fail.
Makes sense to put the emergency access BEHIND a screwed panel to increase the attack time required. You still need the emergency key to actually open the safe.
"Bit like putting screws for the padlock latch on the outside but covering them with thick paint that clogs the slot"
Yes, but what about using one-way screws? They are common enough around here and, as long as they are counter sunk and used with some Locktite or similar adhesive, are truly hard to remove. You are reduced to drilling them out. That might get the attention of security staff
My fave, a couple of guys followed delivery vans. When they noticed high value boxes delivered (Dell, HP etc). They simply waited 5 minutes and rocked up to the good in dept. and said that the delivery had been made in error and that their delivery was on the next lorry in about 20 minutes.
A signature and receipt and they took the boxes away - simple !
I still reckon that a tool box, overalls and confidence will get you past 90% of security.
"I still reckon that a tool box, overalls and confidence will get you past 90% of security."
Especially when they come with the job and security lets you in. Staff may be checked and supervised, are the cleaners? One corporate datacenter. "Only 3 members of staff have access to this room". Quick check of their access control system finds +2 contract cleaner passes. Apologies to the IT guys in that site who ended up with additional cleaning duties after that one.
I still reckon that a tool box, overalls and confidence will get you past 90% of security.
A friend of mine did this. He's a furniture designer, but was meeting a client at his office. In one of GEC Marconi's buildings doing defence work. He coudn't be arsed to go through the long security checks this time, so he removed his suit jacket, rolled up his sleeves and waltzed past security and reception carrying a rolled-up newspaper, his lunchbox and a pad of paper. He got in unchallenged of course.
I presume the KGB weren't equipped with lunch boxes at the time, thus our national security was safe.
Rather like our planes are safe from the hijack danger of the metal cutlery that 1st class passengers are given onboard. This is because Al Qaeda HR policy is that people have to fly economy, on pain of a disciplinary interview...
Rather like our planes are safe from the hijack danger of the metal cutlery that 1st class passengers are given onboard. This is because Al Qaeda HR policy is that people have to fly economy, on pain of a disciplinary interview...
Nope, plastic cutlery even in first. It was one of the things people commented on when Concorde scheduled services resumed following its crash - 9/11 happened while it was out. It had been solid silver stuff prior to that.
It baffles me at how many companies I've been to that have very paranoid levels of security put in place, yet they pay their security guards, janitors/maintenance staff and help desk workers crap wages. In my career as a security consultant, I've seen so many thefts of data by rival companies paying-off low-paid employees.
In one case a security guard and a help desk drone got paid at least a couple hundred thousands dollars each by a foreign company to steal some chemical formulas from my client. Since neither of them triggered any alerts, no one found out about it until after the two of them and their families were long gone. They were corrupted by the simple fact that neither of them were getting paid well enough to support a family.
So this fella used to work in a wheel barrow factory and would often leave of an evening pushing a brand new wheel barrow with a sack draped over it. The chaps on the gate would lift up the sacking and look underneath, whereupon, seeing there wasn't anything in it, they would wave him through the factory gates with a smile.
Even more bizarre, I was told this by an old boy that I used to rent a room from many moons ago. A friend of his worked in a meat packing plant and managed to smuggle an entire pig out of the plant by putting a wax cotton jacket and trousers on it, a motorcycle helmet and goggles and strapping it to his back and riding out past security on his motorbike, with the pig as pillion. Admittedly he chose a dark, wet winter's night to do this but even so. A bit tricky to claim it was a mistake if caught!
I did some consultancy for the Probation Service in England. I visited a Probation Office which used a PIN entry system for securing teh doors between the insecure offender area and the secure office area. Each member of staff had a PIN used to gain acess.
One day an offender was found in the office area unescorted. When aske how he got there he said he had been 'playing' wiht the PIN pad and the door had just opened. The PIN he said he used worked, but was not one issued by the Probatin Office to its staff. neither could the Probation Office delete it. It turned out to be the manufacturer's hard-coded access PIN to be used in case a customer got locked out. It took a bespoke software patch to fix it.
So now I advise clients to get a letter signed yb the supplier to the effect that there are no means of acess of which the customer is not aware, and in particular no hard coded PINs or master pass cards (for RFI enabled locks).
(The offender was not a violent one, forunately, but had lots of time to do a key search attack, something else to think about.)
Vaguely similar issue when my youngest son was in intensive care after he was born. Buzzer system to get onto the ward, with a keypad next to the door for staff - a quick look told you that the number 5 was worn down and a quick count of the number of times pressed got you onto the ward quicker than waiting for some passing staff member to answer the buzzer.
My mother was in hospital recently and visitors were supposed not to be allowed into wards during meal times.
So, due to various circumstances, I arrive late and think "bugger, they won't let me in", but, at that moment, there's an old guy having a bit of difficulty getting his wheelchair out of the lift.
"Want a hand, mate?"
"Sure."
"Tell you what, I'll just push you into the ward, how about that?"
Nurse sees person pushing patient in wheelchair, lets us in...
(Ok, so it's not High Security, but still :-) )
I like to start early and get things done before people arrive and ask for help. On my last day, I had to wait for someone else to arrive because my number had already been deleted. As you would expect, he had forgotten his number because he never had to use it before. There we were with the bungler alarm screaming waiting for someone else to turn up and cancel the alarm. Just on the off-chance, I tried 1066 and the alarm turned off. Given enough people, someone will pick 1066 if they are not allowed to use 1234.
I had the misfortune of locking my wallet and keys into one of these style of safes where either the internally battery wasn't quite charged or the bolt motor was failing. It locked itself fine but when I put my code back in, the locking bolt did not retract. I fiddled with the controls for a while "locking" and "unlocking" it hoping it would open.
Eventually in a hail of swearing and huffing I just yanked on the door as hard as I was able and the door thankfully popped open. I am by no measure a physically strong person so either the lock was only partially engaged or these are the least-secure safes ever made.
Plenty of videos on YouTube about how to 'break' in to hotel room safes. The lock's just controlled by a sprung solinoid. Enter the correct code and the solinoid energises/pulls the in down allowing the handle to turn. After a timeout/when you close the door the solinoid de-energises and a spring pushes the pin back up to stop the handle turning.
Hold the handle in the open direction and give the top of the door a good thump and the precusive actions usually enough to drop the pin down against the spring enough to release the handle. See from 60sec in - http://www.youtube.com/watch?v=hcYB9ceiAiY
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
